Latest high and critical flaws
- CVE-2026-96759 orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects.Critical 9.3 · Sep 23, 2026
- CVE-2026-96758 orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated tCritical 9.3 · Sep 23, 2026
- CVE-2026-96757 orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code.Critical 9.3 · Sep 23, 2026
- CVE-2026-96756 orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date() Critical 9.2 · Sep 23, 2026
- CVE-2026-96755 orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template lCritical 9.3 · Sep 23, 2026
- CVE-2026-96754 orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape OpenAPI path values in single-quoted routeCritical 9.3 · Sep 23, 2026
- CVE-2026-72717 Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications.Critical 9.3 · Aug 19, 2026
- CVE-2026-72716 Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications.Critical 9.3 · Aug 19, 2026
- CVE-2026-71871 Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications.Critical 9.3 · Aug 19, 2026
- CVE-2026-71869 Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications.Critical 9.3 · Aug 19, 2026
- CVE-2026-71868 Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications.Critical 9.3 · Aug 19, 2026
- CVE-2026-71867 Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications.Critical 9.3 · Aug 19, 2026
- CVE-2026-71866 Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications.Critical 9.3 · Aug 19, 2026
- CVE-2026-71865 Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications.Critical 9.3 · Aug 19, 2026
- CVE-2026-71864 Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications.Critical 9.3 · Aug 19, 2026
- CVE-2026-62682 Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications.Critical 9.3 · Aug 19, 2026
- CVE-2026-62681 Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications.Critical 9.3 · Aug 19, 2026
- CVE-2026-62680 Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications.High 7.1 · Aug 19, 2026
- CVE-2026-25141 Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification.Critical 9.3 · Jan 30, 2026
- CVE-2026-24132 Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification.High 7.7 · Jan 22, 2026
- CVE-2026-23947 Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification.Critical 9.3 · Jan 19, 2026
- CVE-2026-22785 orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification.Critical 9.3 · Jan 12, 2026
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.