5046 matches found
EUVD-2026-61221
fastify vulnerable to schema validation bypass via root primitive coercion mismatch...
NPM: fastify vulnerable to schema validation bypass via root primitive coercion mismatch
NPM: fastify vulnerable to schema validation bypass via root primitive coercion mismatch vulnerability discovered by ? in WordPress Npm fastify versions 5.12.1...
GHSA-W2QP-RPH6-63G4 fastify vulnerable to schema validation bypass via root primitive coercion mismatch
Impact fastify before 5.12.1, when a route uses a root-level primitive body schema for example an integer with a minimum and maximum and the default type coercion, validates the coerced value but exposes the original, uncoerced value to the route handler. For example, a JSON body "10" is coerced ...
fastify vulnerable to schema validation bypass via root primitive coercion mismatch
Impact fastify before 5.12.1, when a route uses a root-level primitive body schema for example an integer with a minimum and maximum and the default type coercion, validates the coerced value but exposes the original, uncoerced value to the route handler. For example, a JSON body "10" is coerced ...
Orval: Import-time RCE via query-parameter default -> zod module-level template literal
Summary Orval's zod schema generation emits the query-parameter default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...
EUVD-2026-62600
Orval: Import-time RCE via query-parameter default - zod module-level template literal...
GHSA-P4CG-3328-RVFG Orval: Import-time RCE via query-parameter default -> zod module-level template literal
Summary Orval's zod schema generation emits the query-parameter default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...
EUVD-2026-62596
Orval: Import-time RCE via schema property name - computed-property-key injection in the zod client...
CVE-2026-77783
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable, allowing unauthenticated visitors to disclose the schema and associated content of draft, pending, private, scheduled and password-protected posts...
CVE-2026-77783
The Rank Math SEO WordPress plugin, in versions prior to 1.0.277 , is vulnerable to an information disclosure flaw because it fails to verify if a post is publicly viewable before rendering its schema on the front end. This allows unauthenticated visitors to access and disclose the schema and ass...
CVE-2026-77783 Rank Math SEO < 1.0.277 - Unauthenticated Non-Public Post Schema and Content Disclosure
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable, allowing unauthenticated visitors to disclose the schema and associated content of draft, pending, private, scheduled and password-protected posts...
EUVD-2026-69838
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable, allowing unauthenticated visitors to disclose the schema and associated content of draft, pending, private, scheduled and password-protected posts...
CVE-2026-77783 Rank Math SEO < 1.0.277 - Unauthenticated Non-Public Post Schema and Content Disclosure
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable, allowing unauthenticated visitors to disclose the schema and associated content of draft, pending, private, scheduled and password-protected posts...
PT-2026-84618
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable, allowing unauthenticated visitors to disclose the schema and associated content of draft, pending, private, scheduled and password-protected posts...
CVE-2026-77783: Authorization Bypass Through User-Controlled Key
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable, allowing unauthenticated visitors to disclose the schema and associated content of draft, pending, private, scheduled and password-protected posts...
Linux Distros Unpatched Vulnerability : CVE-2026-52130
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - llama.cpp b5693 and before is vulnerable to Uncontrolled Recursion in common/json-schema-to-grammar.cpp, resulting in a denial of service. CVE-2026-52130 Note...
CVE-2026-84368
joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where exports.compile and exports.merge reuse inherited objects for...
CVE-2026-84368 joi: Prototype pollution via a `__proto__` language key in custom messages
joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where exports.compile and exports.merge reuse inherited objects for...