5046 matches found
CVE-2026-86817 Five Star Business Profile and Schema 2.3.20 - 2.3.21 - Author+ Sensitive Data Disclosure via Schema Field Default Callback
The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values, allowing authenticated users with Author-level access and above to store input that discloses sensitive data, including other users' passwo...
WordPress Five Star Business Profile and Schema plugin 2.3.20-2.3.21 - Author+ Sensitive Data Disclosure vulnerability
Author+ Sensitive Data Disclosure vulnerability discovered by Artus KG in WordPress Plugin Five Star Business Profile and Schema versions 2.3.20-2.3.21...
CVE-2026-86817: Undefined Security Weakness
The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values, allowing authenticated users with Author-level access and above to store input that discloses sensitive data, including other users' passwo...
PT-2026-104609
Name of the Vulnerable Software and Affected Versions Five Star Business Profile and Schema WordPress plugin versions prior to 2.4.0 Description Insufficient restriction of callbacks used to resolve schema field default values allows authenticated users with Author-level access and above to store...
[SECURITY] Fedora 45 Update: docbook5-schemas-5.1-19.fc45
Docbook 5.X is a complete rewrite of Docbook in RELAX NG and not compatible with previous Docbook versions. This package contains Relax NG , DTD and W3C schema for Docbook 5.X. Syntax of those schemas is XML-compliant and is developed by the OASIS consortium...
CVE-2026-41242
CVE-2026-41242 — protobuf.js Code Injection to RCE CVSS 9.4 Critical | Code Injection CWE-94 Aperçu protobuf.js npm: protobufjs versions ≤ 7.5.4 et ≤ 8.0.0 présentent une vulnérabilité d'exécution de code arbitraire via les noms de type dans le schéma protobuf. Le module @protobufjs/codegen...
CVE-2026-103877
A flaw was found in Apache Directory LDAP API. This vulnerability allows a rogue or compromised LDAP server, or a network attacker performing a man-in-the-middle MitM attack, to execute arbitrary code on the client. During a schema search request, an attacker can return a crafted schema object...
CVE-2026-103036
oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properties entries through the prototype chain...
CVE-2026-103036
The oRPC tool (specifically the @orpc/json-schema SmartCoercionPlugin ) is vulnerable to a prototype injection issue in versions prior to 1.14.9 . The root cause is the use of JsonSchemaCoercer to resolve schema.properties entries through the prototype chain. A remote client can supply __proto__ ...
CVE-2026-103036 @orpc/json-schema: Prototype injection in smart coercion
oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properties entries through the prototype chain...
EUVD-2026-91791
oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properties entries through the prototype chain...
CVE-2026-103036 @orpc/json-schema: Prototype injection in smart coercion
oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properties entries through the prototype chain...
CVE-2026-103036 @orpc/json-schema: Prototype injection in smart coercion
oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properties entries through the prototype chain...
CVE-2026-103877 Apache Directory LDAP API: Unsafe loading of Java code from LDAP schema elements
Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API. A rogue/compromised LDAP server or pre-TLS MITM can answer a client's loadSchema subschema search with a schema object that contains a serialized Java class, allowing some potential RCE. This issue affects Apache...
PT-2026-104427
Name of the Vulnerable Software and Affected Versions oRPC versions prior to 1.14.9 Description The @orpc/json-schema SmartCoercionPlugin utilizes JsonSchemaCoercer to collect object properties in a plain object and resolve schema.properties entries via the prototype chain. A remote client...
Linux Distros Unpatched Vulnerability : CVE-2023-54404
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a...
CVE-2026-103036: Improperly Controlled Modification of Dynamically-Determined Object Attributes
oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properties entries through the prototype chain...
Improper Certificate Validation
Overview confluent-kafka is a high-level Producer, Consumer and AdminClient compatible with all Apache KafkaTM broker Affected versions of this package are vulnerable to Improper Certificate Validation in HcVaultKmsClient.init in...
CVE-2023-54404 Zod 4.6.5 Uncontrolled Resource Consumption via Array Validation
Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the handleArrayResult parse logic ...