PT-2026-71939

Name of the Vulnerable Software and Affected Versions eyaushev swagger-testcase-mcp affected versions not specified Description A flaw in the fetch swagger component allows for remote server-side request forgery SSRF, a condition where an attacker can induce the server to make requests to an...

CLSA-2026-1786375655 TuxCare security update for swagger-ui-dist (2 CVEs)

TuxCare rebuilt swagger-ui-dist to address 2 CVEs. Fixed in 3.52.5-tuxcare.1...

CLSA-2026-1786359305 TuxCare security update for swagger-ui (3 CVEs)

TuxCare rebuilt swagger-ui to address 3 CVEs. Fixed in 2.2.10-tuxcare.2...

PT-2026-80046

TuxCare rebuilt swagger-ui-dist to address 2 CVEs. Fixed in 3.52.5-tuxcare.1...

PT-2026-80024

TuxCare rebuilt swagger-ui to address 3 CVEs. Fixed in 2.2.10-tuxcare.2...

EUVD-2025-210645

The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to be loaded, overriding the existing API definitions within the Publisher portal. By exploiting this vulnerability, malicious actors can deceive users into interacting with these...

CVE-2025-6508

The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to be loaded, overriding the existing API definitions within the Publisher portal. By exploiting this vulnerability, malicious actors can deceive users into interacting with these...

CVE-2025-6508

The CVE-2025-6508 entry concerns the Swagger UI Try-out console in the WSO2 API Manager’s API Publisher docs. A misbehavior allows loading an external Swagger API definition URL, which overwrites existing API definitions in the Publisher portal. This deception can lead users to interact with over...

CVE-2025-6508 User Interface Misrepresentation via Swagger UI Try-out Console in WSO2 API Manager Allows Sensitive Information Exposure or Unintended Requests

The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to be loaded, overriding the existing API definitions within the Publisher portal. By exploiting this vulnerability, malicious actors can deceive users into interacting with these...

CVE-2025-6508 User Interface Misrepresentation via Swagger UI Try-out Console in WSO2 API Manager Allows Sensitive Information Exposure or Unintended Requests

The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to be loaded, overriding the existing API definitions within the Publisher portal. By exploiting this vulnerability, malicious actors can deceive users into interacting with these...

PT-2026-68633

Name of the Vulnerable Software and Affected Versions API Publisher affected versions not specified Description The Swagger UI Try-out console within the API Publisher documentation allows the loading of an external Swagger API definition URL, which overrides the existing API definitions in the...

CVE-2025-6508: Improper Neutralization of Input During Web Page Generation

The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to be loaded, overriding the existing API definitions within the Publisher portal. By exploiting this vulnerability, malicious actors can deceive users into interacting with these...

Malicious code in dolyame-boxy-independent-bnpl-swagger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c9922ed471321378d155bfabb5d15f3efe59f8524e30face28e25dadd3305b3 dolyame-boxy-independent-bnpl-swagger ships an index.js that unconditionally requires setup.js on load. setup.js reconstructs remote hostnames from...

CLSA-2026-1785468079 TuxCare security update for swagger-ui (3 CVEs)

TuxCare rebuilt swagger-ui to address 3 CVEs. Fixed in 2.2.10-tuxcare.1...

PT-2026-75847

TuxCare rebuilt swagger-ui to address 3 CVEs. Fixed in 2.2.10-tuxcare.1...

CVE-2026-54663

creationtimestamp| type| source ---|---|--- 2026-07-29 16:35:19+00:00| published-proof-of-concept| https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-x36r-4347-pm5x...

CVE-2026-54664

creationtimestamp| type| source ---|---|--- 2026-07-29 16:35:14+00:00| published-proof-of-concept| https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-5f94-x226-ccpm 2026-07-29 18:08:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrsjfnwzxr2q...

CVE-2026-54660

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts getRemoteRequestHeaders forwards --authorizationToken to every URL fetched by fetchRemoteSchemaDocument while warmUpRemoteSchemasCache resolves external $r...

CVE-2026-54662

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers0.url into apiConfig.baseUrl, and templates/base/http-clients/fetch-http-client.ejs interpolates apiConfig.baseUrl into the generate...

CVE-2026-54663

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts warmUpRemoteSchemasCache resolves external $ref URLs and fetchRemoteSchemaDocument uses isHttpUrl to fetch any http or https target without private IP,...