EUVD-2026-50088

Pagy is agnostic pagination in plain Ruby. From 43.0.0 until 43.5.6, Pagy::I18n.locale= in gem/lib/pagy/modules/i18n/i18n.rb stored locale values verbatim and later used them as .yml path components, allowing untrusted params:locale values with absolute paths or ../ sequences to create a file...

GHSA-2XMW-F8J8-WFXC Pagy I18n locale option is not validated before being used in a file path

Summary Pagy::I18n.locale= did not validate its argument before using it as a path component to load the matching dictionary file .yml. An application that assigns untrusted input to the locale — e.g. the common pattern Pagy::I18n.locale = params:locale — let that input influence which file Pagy...

Pagy I18n locale option is not validated before being used in a file path

Summary Pagy::I18n.locale= did not validate its argument before using it as a path component to load the matching dictionary file .yml. An application that assigns untrusted input to the locale — e.g. the common pattern Pagy::I18n.locale = params:locale — let that input influence which file Pagy...

CVE-2026-54691

datamodel-code-generator generates Python data models from schema definitions. From 0.9.1 until 0.61.0, src/datamodelcodegenerator/http.py http.getbody accepts --url targets and redirect chain targets without host/IP validation, allowing server-side request forgery against loopback, private,...

goshs has a Path Traversal issue

Summary The multipart upload filename fix splits on the path separator but never rejects dot-dot, allowing a write outside the served tree. Finding Medium: upload filename escapes the served tree residual of CVE-2026-35393 The multipart filename fix updown.go lines 135-136 splits on the path...

Chromium: CVE-2026-15115 Insufficient validation of untrusted input in WebAppInstalls

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium: CVE-2026-15131 Insufficient data validation in Navigation

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium: CVE-2026-15123 Insufficient data validation in DOM

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Server-side Request Forgery (SSRF)

Overview datamodel-code-generator is a Datamodel Code Generator Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the getbody function, which performs DNS resolution validation separately from the actual HTTP connection. An attacker can access internal...

Server-side Request Forgery (SSRF)

Overview datamodel-code-generator is a Datamodel Code Generator Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the getbody function when processing URLs provided via the --url argument, as there is no validation of host or IP addresses and redirects are...

datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects

Summary datamodel-code-generator's built-in HTTP fetcher http.getbody issues an httpx.GET against any URL passed to --url or reached via a redirect chain with no allow-list, no deny-list, no IP/host validation, and followredirects=True. Loopback addresses, RFC1918 ranges, link-local 169.254.169.2...

GHSA-RFR2-MQ9M-X2QX datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects

Summary datamodel-code-generator's built-in HTTP fetcher http.getbody issues an httpx.GET against any URL passed to --url or reached via a redirect chain with no allow-list, no deny-list, no IP/host validation, and followredirects=True. Loopback addresses, RFC1918 ranges, link-local 169.254.169.2...

CVE-2026-54691

CVE-2026-54691 affects datamodel-code-generator prior to 0.61.0; the http.get_body function in src/datamodel_code_generator/http.py accepts --url targets and redirect chains without host/IP validation, enabling server-side request forgery to loopback, private, link-local, metadata, and other netw...

CVE-2026-54691 datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects

datamodel-code-generator generates Python data models from schema definitions. From 0.9.1 until 0.61.0, src/datamodelcodegenerator/http.py http.getbody accepts --url targets and redirect chain targets without host/IP validation, allowing server-side request forgery against loopback, private,...

CVE-2026-59942 Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps

Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a Denial of Service DoS attack via resource exhaustion. An attacker can crash the PHP process by providing a specially crafted HTML document containing a single image with massive dimensions e.g., 30,000x30,000...

CVE-2026-49447 Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokens

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. In 0.22.18, GET /cosmos/api/constellation/public-devices discloses Constellation device metadata to a requester that supplies any non-empty Authorization heade...

Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokens

Summary GET /cosmos/api/constellation/public-devices discloses Constellation device metadata to a requester that supplies any non-empty Authorization header. The handler strips the string Bearer from the header but never validates the resulting token and never uses it in the database query. This...

GHSA-5FQM-CC34-FCF5 Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokens

Summary GET /cosmos/api/constellation/public-devices discloses Constellation device metadata to a requester that supplies any non-empty Authorization header. The handler strips the string Bearer from the header but never validates the resulting token and never uses it in the database query. This...

EUVD-2026-36072

Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape...

CVE-2026-56722 Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML input can bypass this restriction by embedding a target file path inside an SVG image delivered through a data: URI, because dompdf processes the SVG twice and the second pass does not...