357 matches found
@acmekit/acmekit-oas-cli (>=2.13.1 <=2.13.94), @acmekit/cli (>=2.13.1 <=2.13.94) +70 more potentially affected by CVE-2026-34221 via @mikro-orm/core (>=6.0.0-dev.110 <=6.6.10-dev.0)
@mikro-orm/core NPM version =6.0.0-dev.110, =2.13.1, =2.13.1, =2.13.1, =2.13.1, =2.13.1, =2.13.1, =2.13.1, =2.13.1, =0.1.29, =0.1.29, =0.5.0, =0.6.8 and more Source cves: CVE-2026-34221 Source advisory: SNYK:JS-MIKROORMCORE-15917139...
SQL Injection
Overview @mikro-orm/core is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Supports MongoDB, MySQL, PostgreSQL and SQLite databases as well as usage with vanilla JavaScript. Affected versions of this package are vulnerable to SQL Injection via the...
97shop-medusa-admin (>=0.1.0 <=0.1.1), @acildeprem/storage (>=0.0.1 <=0.0.9) +591 more potentially affected by CVE-2026-34220 via @mikro-orm/core (>=4.0.0 <=6.6.10-dev.1)
@mikro-orm/core NPM version =4.0.0, =0.1.0, =0.0.1, =2.13.1, =2.13.1, =2.13.1, =2.13.1, =2.13.1, =2.13.1, =2.13.1, =2.13.1, =2.13.94 - @ai-ecom/medusa-plugin-employee =0.2.0 - @ai-ecom/medusa-plugin-review =0.3.0 - @ai-ecom/medusa-plugin-service =0.5.0 - @aiminaabeejs/aiminaabee-cli =0.0.1 -...
@forklaunch/core (>=0.19.0 <=1.5.2), @forklaunch/express (>=0.11.0 <=1.2.32) +17 more potentially affected by CVE-2026-34220 via @mikro-orm/core (>=7.0.0-dev.10 <=7.0.6-dev.7)
@mikro-orm/core NPM version =7.0.0-dev.10, =0.19.0, =0.11.0, =0.9.0, =0.6.0, =0.9.0, =0.9.0, =0.9.0, =0.10.0, =0.9.0, =0.5.0, =0.5.0, =0.8.22, =0.8.22, =0.4.0, =0.1.0, =1.2.18 and more Source cves: CVE-2026-34220 Source advisory: SNYK:JS-MIKROORMCORE-15916609...
@forklaunch/core (>=0.19.0 <=1.5.2), @forklaunch/express (>=0.11.0 <=1.2.32) +17 more potentially affected by CVE-2026-34220 via @mikro-orm/core (>=7.0.0-dev.10 <=7.0.6-dev.9)
@mikro-orm/core NPM version =7.0.0-dev.10, =0.19.0, =0.11.0, =0.9.0, =0.6.0, =0.9.0, =0.9.0, =0.9.0, =0.10.0, =0.9.0, =0.5.0, =0.5.0, =0.8.22, =0.8.22, =0.4.0, =0.1.0, =1.2.18 and more Source cves: CVE-2026-34220 Source advisory: OSV:GHSA-GWHV-J974-6FXM...
@acmekit/acmekit-oas-cli (>=2.13.1 <=2.13.94), @acmekit/cli (>=2.13.1 <=2.13.94) +70 more potentially affected by CVE-2026-34220 via @mikro-orm/core (>=6.0.0-dev.110 <=6.6.10-dev.0)
@mikro-orm/core NPM version =6.0.0-dev.110, =2.13.1, =2.13.1, =2.13.1, =2.13.1, =2.13.1, =2.13.1, =2.13.1, =2.13.1, =0.1.29, =0.1.29, =0.5.0, =0.6.8 and more Source cves: CVE-2026-34220 Source advisory: SNYK:JS-MIKROORMCORE-15916609...
SQL Injection
Overview @mikro-orm/mariadb is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Supports MongoDB, MySQL, PostgreSQL and SQLite databases as well as usage with vanilla JavaScript. Affected versions of this package are vulnerable to SQL Injection via the...
PT-2026-28612
Name of the Vulnerable Software and Affected Versions MikroORM versions prior to 6.6.10 MikroORM versions prior to 7.0.6 Description A flaw exists in the Utils.merge helper within MikroORM that does not prevent the use of special keys like proto , constructor, and prototype during object merging...
CVE-2026-33530
InvenTree is an Open Source Inventory Management System. Prior to version 1.2.6, certain API endpoints associated with bulk data operations can be hijacked to exfiltrate sensitive information from the database. The bulk operation API endpoints e.g. /api/part/, /api/stock/,...
CVE-2026-33530 InvenTree Vulnerable to ORM Filter Injection
InvenTree is an Open Source Inventory Management System. Prior to version 1.2.6, certain API endpoints associated with bulk data operations can be hijacked to exfiltrate sensitive information from the database. The bulk operation API endpoints e.g. /api/part/, /api/stock/,...
CVE-2026-33530 InvenTree Vulnerable to ORM Filter Injection
InvenTree is an Open Source Inventory Management System. Prior to version 1.2.6, certain API endpoints associated with bulk data operations can be hijacked to exfiltrate sensitive information from the database. The bulk operation API endpoints e.g. /api/part/, /api/stock/,...
CVE-2026-33530
The CVE affects InvenTree prior to version 1.2.6, where bulk data API endpoints (e.g., /api/part/, /api/stock/, /api/order/so/allocation/, etc.) accept a filters parameter that is passed directly to Django queryset.filter(**filters) without any field allowlisting. This allows an authenticated use...
CVE-2026-33530
InvenTree is an Open Source Inventory Management System. Prior to version 1.2.6, certain API endpoints associated with bulk data operations can be hijacked to exfiltrate sensitive information from the database. The bulk operation API endpoints e.g. /api/part/, /api/stock/,...
InvenTree 安全漏洞
InvenTree is an open-source inventory management system developed by InvenTree. It provides robust low-level inventory control and parts tracking capabilities. Versions of InvenTree prior to 1.2.6 contained security vulnerabilities. These vulnerabilities stemmed from the batch operation API...
PT-2026-28488
Name of the Vulnerable Software and Affected Versions InvenTree versions prior to 1.2.6 InvenTree versions 1.2.6 through 1.3.0 Description InvenTree is an Open Source Inventory Management System. Certain API endpoints associated with bulk data operations can be exploited to exfiltrate sensitive...
fastapi-helpers (>=0.0.1 <=0.2.3), fastapi-users-db-ormar (=1.0.0) +11 more potentially affected by CVE-2026-27953 via ormar (>=0.10.16 <=0.20.2)
ormar PYPI version =0.10.16, =0.0.1, =0.3.1, =0.3.0, =0.0.1, =0.3.1, =0.0.1, =1.0.0, =0.0.1, =0.0.2 Source cves: CVE-2026-27953 Source advisory: SNYK:PYTHON-ORMAR-15701843...
UBUNTU-CVE-2026-27953
ormar is a async mini ORM for Python. Versions 0.23.0 and below are vulnerable to Pydantic validation bypass through the model constructor, allowing any unauthenticated user to skip all field validation by injecting "pkonly": true into a JSON request body. By injecting "pkonly": true into a JSON...
litestar-ormar (>=0.0.1 <=0.0.6) potentially affected by CVE-2026-27953 via ormar (=0.20.2)
ormar PYPI version =0.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on ormar and may be impacted: - litestar-ormar =0.0.1, =0.0.6 Source cves: CVE-2026-27953 Source advisory: OSV:GHSA-F964-WHRQ-44H8...
PT-2026-22205
Name of the Vulnerable Software and Affected Versions wger versions prior to 2.4 Description wger is a free, open-source workout and fitness manager. An issue exists where three nutritional values action endpoints bypass user-scoped querysets via a raw ORM call, specifically Model.objects.getpk=p...
