CVE-2026-54663 swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts warmUpRemoteSchemasCache resolves external $ref URLs and fetchRemoteSchemaDocument uses isHttpUrl to fetch any http or https target without private IP,...

EUVD-2026-50364

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts warmUpRemoteSchemasCache resolves external $ref URLs and fetchRemoteSchemaDocument uses isHttpUrl to fetch any http or https target without private IP,...

NPM: swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`

NPM: swagger-typescript-api vulnerable to authorization-token exfiltration via spec $ref vulnerability discovered by ? in WordPress Npm swagger-typescript-api versions = 13.12.1...

CVE-2026-54660 swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts getRemoteRequestHeaders forwards --authorizationToken to every URL fetched by fetchRemoteSchemaDocument while warmUpRemoteSchemasCache resolves external $r...

EUVD-2026-50361

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts getRemoteRequestHeaders forwards --authorizationToken to every URL fetched by fetchRemoteSchemaDocument while warmUpRemoteSchemasCache resolves external $r...

CVE-2026-54660

swagger-typescript-api prior to 13.12.2 forwards the Authorization token to every external $ref request during openapi schema resolution, enabling token exfiltration to attacker-controlled endpoints. The root cause is getRemoteRequestHeaders attaching the token to all fetchRemoteSchemaDocument ca...

MINI-J97J-878G-WJ57

Bulletin has no description...

MINI-FP74-CCM4-3RQQ

Bulletin has no description...

MINI-Q222-MJ94-X98M

Bulletin has no description...

MINI-WF3C-736W-8GF3

Bulletin has no description...

MINI-9WP4-R3H5-X75Q

Bulletin has no description...

MINI-QMJQ-255F-4R58

Bulletin has no description...

MINI-P8FQ-2859-R2GJ

Bulletin has no description...

MINI-J7J8-P8FP-9275

Bulletin has no description...

MINI-QFP9-R9VM-FJHM

Bulletin has no description...

MINI-MW67-CVX8-839H

Bulletin has no description...

MINI-4X27-WGMX-XGWX

Bulletin has no description...

CVE-2026-64376

A flaw was found in the Linux kernel's firmware loader component. This vulnerability occurs in the firmwareuploadregister function when an allocation failure happens after a device instance is created. The system fails to properly release a device reference, leading to an unbalanced reference...

CVE-2023-25262

creationtimestamp| type| source ---|---|--- 2026-07-29 12:00:44+00:00| seen| https://t.me/CVEhub/9265 2026-07-30 00:01:15+00:00| seen| https://t.me/CVEhub/9265 2026-07-31 11:00:03+00:00| published-proof-of-concept| https://t.me/CVEhub/9265 2026-08-01 00:00:33+00:00| published-proof-of-concept|...

CVE-2026-5060

The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14. This is due to the stmlmsdeletecover function lacking ownership validation on the fileid parameter before...