dataclasses-avroschema enum field defaults can inject statements into generated modules
CVE-2026-108383
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates
2026-10-14 归档
今日共收录 1875 条安全情报，包含 867 个 CVE，609 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Potential command execution on the host running JFrog CLI.
CVE-2026-92892
Potential arbitrary code execution, under specific configurations.
dataclasses-avroschema allows code injection through generated enum-symbol string literals
CVE-2026-108382
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates
dataclasses-avroschema pydantic-class metadata allows code injection in generated annotations
CVE-2026-108381
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates
dataclasses-avroschema field documentation allows code injection in generated Pydantic descriptions
CVE-2026-108380
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates
dataclasses-avroschema fixed namespaces allow code injection in generated annotations
CVE-2026-108379
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates
dataclasses-avroschema record documentation can terminate generated class docstrings
CVE-2026-108378
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates
dataclasses-avroschema allows code injection through generated Meta.schema_name
CVE-2026-108377
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates
dataclasses-avroschema allows code injection through record names in generated default factories
CVE-2026-108376
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates
dataclasses-avroschema allows code injection through generated field-default literals
CVE-2026-108375
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates
libsndfile WAV Parsing wavlike.c wavlike_subchunk_parse uninitialized variable
CVE-2026-109828
A vulnerability was found in libsndfile up to 1.2.2. This issue affects the function wavlike_subchunk_parse of the file
ThriveX-Server through 4.0 Missing Authorization via Article Retrieval Endpoints
CVE-2026-110131
ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/{id}
fuintCatering through commit 122c9e6 IDOR via /clientApi/refund/detail
CVE-2026-110129
fuintCatering through commit 122c9e6 contains an insecure direct object reference vulnerability in the ClientRefundContr
fuint through commit 4c4bc8a Missing Authentication via /clientApi/order/detail
CVE-2026-110128
fuint through commit 4c4bc8a contains a missing authentication vulnerability that allows unauthenticated attackers to re
FastBee through 2.1.0 IDOR via DeviceController /iot/device Endpoints
CVE-2026-110124
FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authent
PickMall lilishop through 4.4 IDOR via Goods Freight Endpoint
CVE-2026-110122
PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated selle
PickMall lilishop through 4.4 IDOR via Goods Edit Endpoint
CVE-2026-110121
PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated selle
WorkFlow-Engine through 9.6.11 Missing Authorization via flowableui buttonOperation Endpoints
CVE-2026-110118
WorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability that allows authenticated users to complet
SmartAdmin through 3.30.0 Missing Authorization via AdminProtectController
CVE-2026-110117
SmartAdmin through 3.30.0 contains a missing authorization vulnerability in AdminProtectController that allows authentic
Digital-Infrastructure 9.6.5 through 9.6.11 Path Traversal via fileManager storeFile
CVE-2026-110116
Risesoft-y9 Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager store