CVE-2026-67432

creationtimestamp| type| source ---|---|--- 2026-07-29 20:57:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrsstprxqw2i 2026-07-29 21:00:25+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrsszcbcnl22 2026-07-30 16:35:23+00:00| published-proof-of-concept|...

EUVD-2026-50562

Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.65.0 through 1.105.0, and 2.0.0b1 through 2.0.0b5, a client that submits message history to a Pydantic AI UI adapter such as the Vercel AI adapter can reference arbitrary files in the application's...

CVE-2026-54663

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts warmUpRemoteSchemasCache resolves external $ref URLs and fetchRemoteSchemaDocument uses isHttpUrl to fetch any http or https target without private IP,...

swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`

Summary swagger-typescript-api walks every $ref value in the input OpenAPI spec and, for any $ref whose target is an https:// URL, issues an HTTP GET to that URL during generation warmUpRemoteSchemasCache. The only URL filter is a regex that matches ^https?:// — there is no private-IP allowlist, ...

CVE-2026-54663 swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts warmUpRemoteSchemasCache resolves external $ref URLs and fetchRemoteSchemaDocument uses isHttpUrl to fetch any http or https target without private IP,...

swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`

Summary When the developer supplies an --authorizationToken commonly required to fetch a private spec behind authentication, swagger-typescript-api attaches that token to the Authorization header of every subsequent HTTP request it makes while resolving external $ref URLs in the spec — with no...

CVE-2026-58161

Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fi...

CVE-2026-58161 Apache Traffic Server: Memory-safety errors in TLS and SNI handling can crash the server

Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fi...

EUVD-2026-50217

Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fi...

PT-2026-65749

Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fi...

CVE-2026-54690

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.9.1 until 0.61.0, datamodel-code-generator silently dereferences attacker-controlled JSON Schema $ref HTTP or...

datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs`

Summary datamodel-code-generator resolves JSON-Schema $ref targets that point at the local filesystem without restricting them to the input/base directory and without honoring the remote-reference security control. In the default configuration, an attacker who controls an input schema a "paste yo...

CVE-2026-55389

The CVE affects datamodel-code-generator (pre-0.62.0), where JSON Schema $ref resolution in src/datamodel_code_generator/parser/jsonschema.py using is_url/_get_ref_body could read arbitrary local files (via file:// or ../ traversal) when --no-allow-remote-refs is not honored. This could expose se...

CVE-2026-55389 datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs`

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.62.0, datamodel-code-generator resolves JSON Schema $ref targets in...

CVE-2026-54690 datamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default)

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.9.1 until 0.61.0, datamodel-code-generator silently dereferences attacker-controlled JSON Schema $ref HTTP or...

CVE-2026-54690

Summary: CVE-2026-54690 affects the datamodel-code-generator project. In versions 0.9.1 through 0.61.0, the tool silently dereferenced attacker-controlled JSON Schema $ref HTTP/HTTPS URLs via src/datamodel_code_generator/parser/jsonschema.py:_get_ref_body, and the --allow-remote-refs gate could w...

CVE-2026-54690 datamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default)

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.9.1 until 0.61.0, datamodel-code-generator silently dereferences attacker-controlled JSON Schema $ref HTTP or...

CVE-2026-56722

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML input can bypass this restriction by embedding a target file path inside an SVG image delivered through a data: URI, because dompdf processes the SVG twice and the second pass does not...

CVE-2026-59943 Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI...

CVE-2026-56722 Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML input can bypass this restriction by embedding a target file path inside an SVG image delivered through a data: URI, because dompdf processes the SVG twice and the second pass does not...