PT-2026-97408

Name of the Vulnerable Software and Affected Versions orval versions 8.14.0 through 8.28.1 Description The @orval/effect generator improperly converts OpenAPI schema defaults into template literals. This allows for code injection where arbitrary JavaScript expressions using the $... syntax can be...

CVE-2026-96756: Improper Control of Generation of Code

orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the...

CVE-2026-96755: Improper Control of Generation of Code

orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing $... syntax, which are executed at module...

PT-2026-97410

Name of the Vulnerable Software and Affected Versions orval versions prior to 8.29.0 Description The software fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code. This allows attackers to inject JavaScript via crafted...

PT-2026-97409

Name of the Vulnerable Software and Affected Versions orval versions prior to 8.30.0 Description The @orval/core factory generator fails to escape date default values within new Date calls. This allows attackers to inject arbitrary expressions using apostrophes in OpenAPI schema defaults, leading...

CVE-2026-94492

A security vulnerability has been detected in Yonyou U8cloud 5.x. This vulnerability affects unknown code of the file /u8cloud/openapi/so.saleorder.sendaudit of the component OpenAPI. The manipulation of the argument operator leads to sql injection. The attack can be initiated remotely. The explo...

CVE-2026-94492 Yonyou U8cloud OpenAPI so.saleorder.sendaudit sql injection

A security vulnerability has been detected in Yonyou U8cloud 5.x. This vulnerability affects unknown code of the file /u8cloud/openapi/so.saleorder.sendaudit of the component OpenAPI. The manipulation of the argument operator leads to sql injection. The attack can be initiated remotely. The explo...

CVE-2026-94492 Yonyou U8cloud OpenAPI so.saleorder.sendaudit sql injection

A security vulnerability has been detected in Yonyou U8cloud 5.x. This vulnerability affects unknown code of the file /u8cloud/openapi/so.saleorder.sendaudit of the component OpenAPI. The manipulation of the argument operator leads to sql injection. The attack can be initiated remotely. The explo...

CVE-2026-94492

A SQL injection vulnerability exists in Yonyou U8cloud 5.x , specifically in the OpenAPI component at the endpoint /u8cloud/openapi/so.saleorder.sendaudit. Manipulation of the operator argument allows a remote attacker with low privileges to inject SQL, leading to low impact on confidentiality, i...

CVE-2026-94492: Improper Neutralization of Special Elements used in an SQL Command

A security vulnerability has been detected in Yonyou U8cloud 5.x. This vulnerability affects unknown code of the file /u8cloud/openapi/so.saleorder.sendaudit of the component OpenAPI. The manipulation of the argument operator leads to sql injection. The attack can be initiated remotely. The explo...

PT-2026-96328

Name of the Vulnerable Software and Affected Versions Yonyou U8cloud versions 5.x Description A SQL injection issue exists within the OpenAPI component. A remote attacker can exploit this by manipulating the operator argument in the '/u8cloud/openapi/so.saleorder.sendaudit' endpoint. SQL injectio...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion in the ordered-JSON marshal/unmarshal paths through the jsonutils/adapters/stdlib/json and jsonutils/adapters/easyjson/json ordered map handlers. An attacker can crash the process by sending a deeply nested JSON...

EUVD-2026-82602

go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI specifications, causing...

CVE-2026-93450

go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI specifications, causing...

AZL-103377 CVE-2026-93450 affecting package kubevirt 1.8.4-2

go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI specifications, causing...

CVE-2026-93450: Uncontrolled Recursion

go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI specifications, causing...

CVE-2026-93450

CVE-2026-93450 affects go-openapi/swag (the jsonutils component) in versions before 0.27.1 . The root cause is unbounded recursion with no depth limit in ordered JSON marshal and unmarshal operations. A remote, unauthenticated attacker can submit a deeply nested JSON document to any service that ...

CVE-2026-93450 go-openapi/swag jsonutils before 0.27.1 Uncontrolled Recursion in Ordered JSON Marshal and Unmarshal

go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI specifications, causing...

CVE-2026-93450 go-openapi/swag jsonutils before 0.27.1 Uncontrolled Recursion in Ordered JSON Marshal and Unmarshal

go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI specifications, causing...

CVE-2026-93450 go-openapi/swag jsonutils before 0.27.1 Uncontrolled Recursion in Ordered JSON Marshal and Unmarshal

go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI specifications, causing...