kin-openapi has uncontrolled resource consumption in openapi3filter deepObject query parameter decoding

Summary An uncontrolled resource consumption vulnerability in openapi3filter lets any unauthenticated client force multi-gigabyte heap allocation with a single, tiny HTTP request. When a spec declares a deepObject-style query parameter whose schema contains an array a normal, documented pattern,...

Use of Incorrect Operator

Overview Affected versions of this package are vulnerable to Use of Incorrect Operator via the take parameter in GraphQL queries. An attacker can cause excessive resource consumption by supplying negative values to bypass intended query limits. Workaround This vulnerability can be mitigated by...

CVE-2026-77354 kin-openapi: Uncontrolled resource consumption in openapi3filter deepObject query parameter decoding

kin-openapi is a Go project for handling OpenAPI files. From 0.124.0 until 0.142.0, openapi3filter.sliceMapToSlice in openapi3filter/reqrespdecoder.go converts attacker-controlled sparse indexes from a deepObject query parameter into a dense slice by allocating entries from zero through the large...

CVE-2026-77354 kin-openapi: Uncontrolled resource consumption in openapi3filter deepObject query parameter decoding

kin-openapi is a Go project for handling OpenAPI files. From 0.124.0 until 0.142.0, openapi3filter.sliceMapToSlice in openapi3filter/reqrespdecoder.go converts attacker-controlled sparse indexes from a deepObject query parameter into a dense slice by allocating entries from zero through the large...

CVE-2026-77354

kin-openapi (Go library for OpenAPI file handling) versions 0.124.0 through 0.142.0 are affected by an uncontrolled resource consumption vulnerability in openapi3filter.sliceMapToSlice (req_resp_decoder.go). The function converts attacker-controlled sparse indexes from a deepObject query paramete...

EUVD-2026-64151

kin-openapi is a Go project for handling OpenAPI files. From 0.124.0 until 0.142.0, openapi3filter.sliceMapToSlice in openapi3filter/reqrespdecoder.go converts attacker-controlled sparse indexes from a deepObject query parameter into a dense slice by allocating entries from zero through the large...

CVE-2026-54457 TensorZero: Arbitrary file read and SSRF in TensorZero Gateway's internal object storage endpoint

TensorZero is an open-source LLMOps platform that unifies an LLM gateway, observability, evaluation, optimization, and experimentation. Prior to 2026.6.0, the TensorZero Gateway /internal/objectstorage endpoint accepts a caller-supplied JSON storagepath parameter that dynamically overrides the...

CVE-2026-54457 TensorZero: Arbitrary file read and SSRF in TensorZero Gateway's internal object storage endpoint

TensorZero is an open-source LLMOps platform that unifies an LLM gateway, observability, evaluation, optimization, and experimentation. Prior to 2026.6.0, the TensorZero Gateway /internal/objectstorage endpoint accepts a caller-supplied JSON storagepath parameter that dynamically overrides the...

CVE-2026-54457

TensorZero (open-source LLMOps platform) is vulnerable to arbitrary file read and SSRF via its Gateway /internal/object_storage endpoint in versions prior to 2026.6.0 . The endpoint accepts a caller-supplied JSON storage_path parameter that dynamically overrides the [object_storage] configuration...

CVE-2026-67359

Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An unauthenticated visitor could supply any orderid as a query parameter to render the full checkout confirmation page for that order, including line items, prices, and totals...

CVE-2026-53572 KEDA: PostgreSQL connection string parameter injection via incomplete whitespace escaping

KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresqlscaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, while escapePostgreConnectionParameter only quotes values...

CVE-2026-53572 KEDA: PostgreSQL connection string parameter injection via incomplete whitespace escaping

KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresqlscaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, while escapePostgreConnectionParameter only quotes values...

CVE-2026-53572

KEDA (Kubernetes-based Event Driven Autoscaling) is affected by a PostgreSQL connection string parameter injection in pkg/scalers/postgresql_scaler.go prior to version 2.20.0 . The root cause is that escapePostgreConnectionParameter() only quotes values containing a literal space, leaving tabs, n...

EUVD-2026-64131

KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresqlscaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, while escapePostgreConnectionParameter only quotes values...

CVE-2026-53572 KEDA: PostgreSQL connection string parameter injection via incomplete whitespace escaping

KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresqlscaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, while escapePostgreConnectionParameter only quotes values...

CVE-2026-53572

KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresqlscaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, while escapePostgreConnectionParameter only quotes values...

EUVD-2026-64127

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop has a reflected Cross-Site Scripting XSS vulnerability in its dashboard revert functionality with the parameter dashboardid in /pages/ajax.render.php. This issue has been fixed in version 3.2.3...

CVE-2026-67359

J2Store (a Joomla e-commerce extension by j2commerce.com) is affected by an order content disclosure vulnerability in versions 1.0.0–3.3.20, 4.0.0–4.0.20, and 4.1.0–4.1.5 . An unauthenticated attacker can supply an arbitrary order_id as a query parameter to render the full checkout confirmation p...

CVE-2026-67359 Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An unauthenticated visitor could supply any orderid as a query parameter to render the full checkout confirmation page for that order, including line items, prices, and totals...

EUVD-2026-64060

Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An unauthenticated visitor could supply any orderid as a query parameter to render the full checkout confirmation page for that order, including line items, prices, and totals...