swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-parser/base-schema-parsers/enum.ts passes components....

CVE-2026-54664

swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/sch

历史摘要 · 未重新核验 · NVD

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers[0].url into...

CVE-2026-54662

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-

历史摘要 · 未重新核验 · NVD

swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates s...

CVE-2026-54661

swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templat

历史摘要 · 未重新核验 · NVD

swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies

CVE-2026-54666

### Summary `swagger-typescript-api` interpolates OpenAPI path strings (the keys of the `paths` object, e.g. `/users/{i

历史摘要 · 未重新核验 · GitHub Advisory

swagger-typescript-api vulnerable to code injection via unescaped enum string values

CVE-2026-54664

### Summary `swagger-typescript-api` interpolates `components.schemas.*.enum[i]` string values into the body of generat

历史摘要 · 未重新核验 · GitHub Advisory

A Server-Side Template Injection (SSTI) vulnerability was identified in the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This flaw...

CVE-2026-9177

A Server-Side Template Injection (SSTI) vulnerability was identified in the mail template functionality of the Axway Se

历史摘要 · 未重新核验 · NVD

datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment field is rendered into Python comments...

CVE-2026-54654

datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-tem

历史摘要 · 未重新核验 · NVD

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV....

CVE-2026-54653

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Sch

历史摘要 · 未重新核验 · NVD

datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, GraphQL Union description values in src/datamodel_code_generator/model/template/U...

CVE-2026-54621

datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, GraphQL Union descriptio

历史摘要 · 未重新核验 · NVD

`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field

CVE-2026-54654

### Summary `datamodel-code-generator` is vulnerable to code injection when a developer passes an `--extra-template-dat

历史摘要 · 未重新核验 · GitHub Advisory

`datamodel-code-generator` vulnerable to code injection in via attacker-controlled `default_factory` schema field

CVE-2026-54653

### Summary `datamodel-code-generator` is vulnerable to code injection when generating Python models from an attacker-c

历史摘要 · 未重新核验 · GitHub Advisory

`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description

CVE-2026-54621

### Summary `datamodel-code-generator` is vulnerable to code injection when generating Python models from an attacker-c

历史摘要 · 未重新核验 · GitHub Advisory

Oh My Posh: Arbitrary command execution via template injection in the path segment

### Summary Oh My Posh re-renders the resolved path string, which contains the raw folder names taken from the filesyste

历史摘要 · 未重新核验 · GitHub Advisory

MeltanoHub is the source code for hub.meltano.com, the central place for Meltano plugins. Versions of the repo prior to commit 923820de8f64d753951fbbd54f7282a3d5f75173 were vuln...

CVE-2026-47690

MeltanoHub is the source code for hub.meltano.com, the central place for Meltano plugins. Versions of the repo prior to

历史摘要 · 未重新核验 · NVD

MeltanoHub vulnerable to command injection in the `test_dispatcher` GitHub Actions workflow

CVE-2026-47690

MeltanoHub is the source code for hub.meltano.com, the central place for Meltano plugins. Versions of the repo prior to

历史摘要 · 未重新核验 · OSV.dev

Gitleaks prior to 8.30.1 contains a template injection vulnerability that allows attackers who...

CVE-2026-63728

Gitleaks prior to 8.30.1 contains a template injection vulnerability that allows attackers who can supply or influence r

历史摘要 · 未重新核验 · GitHub Advisory

Gitleaks prior to 8.30.1 contains a template injection vulnerability that allows attackers who can supply or influence report templates to read arbitrary environment variables a...

CVE-2026-63728

Gitleaks 是一款用于检测 Git 仓库中硬编码密钥和凭证的开源工具。该漏洞影响 8.30.1 之前的版本，存在于报告模板处理中。Gitleaks 使用 Go 模板引擎，并引入了非封闭的 Sprig 模板函数库。攻击者如果能够控制或影

历史摘要 · 未重新核验 · NVD

Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm. In versions 2.0.0rc2 and above, ...

CVE-2026-44181

Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kuber

历史摘要 · 未重新核验 · NVD

Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection results in Remote Code Execution

CVE-2026-44181

Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kuber

历史摘要 · 未重新核验 · OSV.dev

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, an authenticated user with a standard operational role can trigger server-sid...

CVE-2026-55242

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, an authenticated use

历史摘要 · 未重新核验 · NVD