Security advisories

high2026-07-29

CVE-2026-54079-veraPDF Validation XXE via XFA

verapdf/verapdf-validation · GHSA-36mm-w85j-3q2j

high2026-07-29

CVE-2026-54666-swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies

acacode/swagger-typescript-api · GHSA-w284-33mx-6g9v

high2026-07-29

CVE-2026-54664-swagger-typescript-api vulnerable to code injection via unescaped enum string values

acacode/swagger-typescript-api · GHSA-5f94-x226-ccpm

high2026-07-29

CVE-2026-54661-swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template

acacode/swagger-typescript-api · GHSA-38c3-wv3c-v3xj

medium2026-07-29

CVE-2026-54663-swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`

acacode/swagger-typescript-api · GHSA-x36r-4347-pm5x

high2026-07-29

CVE-2026-54662-swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template

acacode/swagger-typescript-api · GHSA-hqj5-cw9f-rx67

high2026-07-29

CVE-2026-54660-swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`

acacode/swagger-typescript-api · GHSA-h754-fxp7-88wx

medium2026-07-28

CVE-2026-66064-goshs has ACL Bypass & Path Traversal

goshs-labs/goshs · GHSA-964w-f6gj-5236

medium2026-07-28

CVE-2026-54659-Pagy I18n locale option is not validated before being used in a file path

ddnexus/pagy · GHSA-2xmw-f8j8-wfxc

medium2026-07-28

skilo add follows symbolic links, allowing arbitrary local file disclosure from a malicious skill source

manuelmauro/skilo · GHSA-6xx4-9wp6-65p7

high2026-07-28

CVE-2026-54639-Style Dictionary - Prototype Pollution in convertTokenData utility function

style-dictionary/style-dictionary · GHSA-vj5c-m527-mpff

high2026-07-28

CVE-2026-54650-openhole-server vulnerable to path traversal via URL-decoded request path

bablilayoub/openhole · GHSA-fh2f-xfxc-q9cc

critical2026-07-28

CVE-2026-54658-@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution

hypequery/hypequery · GHSA-6wcc-39rp-hh9p

high2026-07-28

CVE-2026-54638-td has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.Decode

gotd/td · GHSA-whmm-qj9r-wvr2

medium2026-07-28

CVE-2026-66063-goshs has a Path Traversal issue

goshs-labs/goshs · GHSA-wg2q-39h6-66x9

critical2026-07-28

CVE-2026-64863-goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite

goshs-labs/goshs · GHSA-hq33-8jgp-8qq3

high2026-07-28

CVE-2026-54719-goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx)

goshs-labs/goshs · GHSA-rmxw-pq4x-3fvh

critical2026-07-28

CVE-2026-62325-goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)

goshs-labs/goshs · GHSA-rjrw-mjq6-hpmm

high2026-07-28

CVE-2026-54654-`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field

koxudaxi/datamodel-code-generator · GHSA-wjv6-jcfj-mf9r

high2026-07-28

CVE-2026-55389-datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs`

koxudaxi/datamodel-code-generator · GHSA-8359-h9fx-j6v9