Security advisories

high2026-07-28

CVE-2026-54653-`datamodel-code-generator` vulnerable to code injection in via attacker-controlled `default_factory` schema field

koxudaxi/datamodel-code-generator · GHSA-386q-5hp3-95m9

high2026-07-28

CVE-2026-55391-datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding

koxudaxi/datamodel-code-generator · GHSA-vx7x-vcc2-c44g

high2026-07-28

CVE-2026-54656-`datamodel-code-generator` vulnerable to code execution on import via unescaped `validators` entries in --extra-template-data

koxudaxi/datamodel-code-generator · GHSA-8m8r-38jm-f355

high2026-07-28

CVE-2026-54690-datamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default)

koxudaxi/datamodel-code-generator · GHSA-954p-556p-r752

high2026-07-28

CVE-2026-55415-datamodel-code-generator vulnerable to code injection via `x-python-import` / `customTypePath` in generated import statements

koxudaxi/datamodel-code-generator · GHSA-5578-w22f-pfx9

high2026-07-28

CVE-2026-54621-`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description

koxudaxi/datamodel-code-generator · GHSA-j884-q54q-mmx3

high2026-07-28

CVE-2026-54655-`datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generator

koxudaxi/datamodel-code-generator · GHSA-m34r-v34r-rf9q

low2026-07-28

CVE-2026-55403-datamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemas

koxudaxi/datamodel-code-generator · GHSA-r5vv-ff45-prp2

high2026-07-28

CVE-2026-54691-datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects

koxudaxi/datamodel-code-generator · GHSA-rfr2-mq9m-x2qx

high2026-07-28

CVE-2026-55390-datamodel-code-generator vulnerable to arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate

koxudaxi/datamodel-code-generator · GHSA-442q-2j6p-642g

high2026-07-28

CVE-2026-32203-Microsoft Security Advisory CVE-2026-32203 – .NET and Visual Studio Denial of Service Vulnerability

dotnet/runtime · GHSA-6588-8gv4-xfgh

medium2026-07-28

CVE-2026-52888-NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass

nocobase/nocobase · GHSA-v8vm-cqh8-q87q

medium2026-07-28

CVE-2026-49446-Cosmos-Server has an authentication bypass via forward-auth header smuggling on Constellation tunnel

azukaar/cosmos-server · GHSA-2rx5-2g7j-2659

medium2026-07-28

CVE-2026-49447-Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokens

azukaar/cosmos-server · GHSA-5fqm-cc34-fcf5

low2026-07-28

CVE-2026-50568-Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape

fission/fission · GHSA-r5jh-q2mw-gcx4

high2026-07-28

CVE-2026-50567- Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory

fission/fission · GHSA-q6vm-xqc9-v3ff

medium2026-07-28

CVE-2026-50569-Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks

fission/fission · GHSA-vchh-r53j-8mpw

high2026-07-28

CVE-2026-50570-Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP_SYS_TIME and cross-tenant node wall-clock corruption

fission/fission · GHSA-qf5v-m7p4-95rp

high2026-07-28

CVE-2026-54635-pytonapi has a Webhook Custom Path Authentication Bypass

nessshon/tonapi · GHSA-3fcr-jvgp-7f58

high2026-07-28

CVE-2026-54632-SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS)

sipsorcery-org/sipsorcery · GHSA-28gm-jrmw-xx93