Lucene search
+L

468982 matches found

Cvelist
Cvelist
added 2 days ago31 views

CVE-2026-55415 datamodel-code-generator vulnerable to code injection via `x-python-import` / `customTypePath` in generated import statements

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.11.6 until 0.64.0, datamodel-code-generator allows attacker-controlled x-python-import or customTypePath schema...

7.5CVSS0.00276EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment
added 2 days ago4 views

CVE-2026-55415 datamodel-code-generator vulnerable to code injection via `x-python-import` / `customTypePath` in generated import statements

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.11.6 until 0.64.0, datamodel-code-generator allows attacker-controlled x-python-import or customTypePath schema...

7.5CVSS6AI score0.00276EPSS
SaveExploits0References3
Github Security Blog
Github Security Blog
added 2 days ago5 views

`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description

Summary datamodel-code-generator is vulnerable to code injection when generating Python models from an attacker-controlled GraphQL schema. A description on a Union type, written in the regular-string form "..." with a literal \r escape, is rendered into a Python comment by a Jinja2 filter that...

7.8CVSS6.2AI score0.00142EPSS
SaveExploits0References3Affected Software1
CVE
CVE
added 2 days ago12 views

CVE-2026-54621

datamodel-code-generator is affected: before version 0.60.1, GraphQL Union description values in UnionTypeStatement templates are rendered into Python comments without neutralizing carriage returns, enabling attacker-controlled GraphQL schema content to inject Python code that executes upon impor...

7.8CVSS5.9AI score0.00142EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2 days ago32 views

CVE-2026-55403 datamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemas

datamodel-code-generator generates Python data models from schema definitions. Prior to 0.63.0, src/datamodelcodegenerator/http.py getbody reuses Authorization, Cookie, and Proxy-Authorization headers when following cross-origin redirects while fetching remote schemas, allowing credentials scoped...

3.7CVSS0.00211EPSS
SaveExploits0References3
CVE
CVE
added 2 days ago10 views

CVE-2026-55403

CVE-2026-55403 affects the Python package datamodel-code-generator. In versions prior to 0.63.0, the code path in src/datamodel_code_generator/http.py:get_body reuses Authorization, Cookie, and Proxy-Authorization headers when following cross-origin redirects to fetch remote schemas. This can lea...

3.7CVSS5.9AI score0.00211EPSS
SaveExploits0References3
RedHat Linux
RedHat Linux
added 2 days ago3 views

firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of...

9.8CVSS5.9AI score0.00333EPSS
SaveExploits0References6
NVD
NVD
added 2 days ago7 views

CVE-2026-59942

Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a Denial of Service DoS attack via resource exhaustion. An attacker can crash the PHP process by providing a specially crafted HTML document containing a single image with massive dimensions e.g., 30,000x30,000...

6.3CVSS0.00395EPSS
SaveExploits0References4
NVD
NVD
added 2 days ago6 views

CVE-2026-59943

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI...

6.3CVSS0.00308EPSS
SaveExploits0References3
NVD
NVD
added 2 days ago7 views

CVE-2026-59941

Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whose header declares e.g. 6000×6000 is...

6.3CVSS0.00507EPSS
SaveExploits0References3
NVD
NVD
added 2 days ago5 views

CVE-2026-49447

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. In 0.22.18, GET /cosmos/api/constellation/public-devices discloses Constellation device metadata to a requester that supplies any non-empty Authorization heade...

5.3CVSS0.00224EPSS
SaveExploits0References3
NVD
NVD
added 2 days ago5 views

CVE-2026-15325

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to HTTP request smuggling due to improper handling of TRACE requests...

8.7CVSS0.00208EPSS
SaveExploits0References1
NVD
NVD
added 2 days ago12 views

CVE-2026-14976

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by remote code execution with the collectiveController-1.0 feature enabled...

7.1CVSS0.0019EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2 days ago29 views

CVE-2026-14446 IBM WebSphere Application Server is affected by a privilege escalation

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console...

9.8CVSS0.00292EPSS
SaveExploits0References1
Debian CVE
Debian CVE
added 2 days ago5 views

CVE-2026-59942

Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a Denial of Service DoS attack via resource exhaustion. An attacker can crash the PHP process by providing a specially crafted HTML document containing a single image with massive dimensions e.g., 30,000x30,000...

6.3CVSS5.9AI score0.00395EPSS
SaveExploits0
CVE
CVE
added 2 days ago13 views

CVE-2026-59942

Dompdf (PHP HTML-to-PDF library) versions before 3.16 are vulnerable to a DoS via resource exhaustion. A crafted HTML string with a high-entropy, oversized image (e.g., 30000x30000) bypasses dimension checks and triggers heavy bitmap processing during rendering, causing 100% CPU usage and memory ...

6.3CVSS5.9AI score0.00395EPSS
SaveExploits0References4
CVE
CVE
added 2 days ago12 views

CVE-2026-14893

The CVE is applicable to IBM Observability with Instana (Agent). The vulnerable component is the Node.js tracer, package @instana/core version 6.2.1, within IBM Instana Agent builds 1.0.303 through 1.0.320. The root cause is a prototype pollution flaw in the configuration normalization API, enabl...

7.3CVSS5.8AI score0.00334EPSS
SaveExploits0References1
EUVD
EUVD
added 2 days ago4 views

EUVD-2026-50058

IBM Observability with Instana Agent Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1 is vulnerable to prototype pollution through its configuration normalization API...

7.3CVSS5.8AI score0.00334EPSS
SaveExploits0References1
CVE
CVE
added 2 days ago11 views

CVE-2026-49447

Cosmos-Server 0.22.18 reportedly exposes constellation device metadata via GET /cosmos/api/constellation/public-devices when any non-empty Authorization header is provided; the code strips Bearer but does not validate or use the token in the DB query, allowing unauthenticated-like access to devic...

5.3CVSS5.9AI score0.00224EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment
added 2 days ago4 views

CVE-2026-14973 Path Traversal in IBM Desktop App

IBM Aspera Desktop App 1.0.5 through 1.0.19 IBM Aspera for desktop can allow files to be written outside of the user's selected download destination...

9.3CVSS5.8AI score0.00452EPSS
SaveExploits0References1
Rows per page
Query Builder