Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
25 results
Oct 26, 2026Specially crafted CBOR input passed to QCborValue::fromCbor() in Qt Core can cause an out-of-bounds read, which may crash the application and could expose inforCVE-2026-107157 · Other software · qt · reported by a59d8014-47c4-4630-ab43-e1b13cbe58e3Low 2
Specially crafted CBOR input passed to QCborValue::fromCbor() in Qt Core can cause an out-of-bounds read, which may crash the application and could expose information.
- Product
- Qt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodereview.qt-project.orgwiki.qt.io
Sep 23, 2026orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects.CVE-2026-96759 · Other software · orval-labs · reported by VulnCheckCritical 9.3
orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects. Attackers can inject arbitrary JavaScript code through a crafted operationId in an OpenAPI specification that executes when generated hooks are called.
- Product
- orval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated tCVE-2026-96758 · Other software · orval-labs · reported by VulnCheckCritical 9.3
orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject ${...} expressions into OpenAPI schema property names that execute as live interpolation when the generated client builds FormData bodies with consumer process privileges.
- Product
- orval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code.CVE-2026-96757 · Other software · orval-labs · reported by VulnCheckCritical 9.3
orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code. Attackers can inject JavaScript through crafted media-type keys in OpenAPI specifications that executes when generated fetch operations or mock resolvers are invoked.
- Product
- orval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date() CVE-2026-96756 · Other software · orval-labs · reported by VulnCheckCritical 9.2
orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date() calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the consumer process when factoryMethods and useDates options are enabled.
- Product
- orval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template lCVE-2026-96755 · Other software · orval-labs · reported by VulnCheckCritical 9.3
orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing ${...} syntax, which are executed at module scope when the generated code is built or imported.
- Product
- orval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape OpenAPI path values in single-quoted routeCVE-2026-96754 · Other software · orval-labs · reported by VulnCheckCritical 9.3
orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape OpenAPI path values in single-quoted route literals. Attackers can craft an OpenAPI document with an apostrophe in a static path segment to inject arbitrary JavaScript code that executes when the generated TypeScript module is imported.
- Product
- orval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications.CVE-2026-72717 · Other software · orval-labs · reported by GitHubCritical 9.3
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a schema default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0.
- Product
- orval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications.CVE-2026-72716 · Other software · orval-labs · reported by GitHubCritical 9.3
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a query parameter default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0.
- Product
- orval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications.CVE-2026-71871 · Other software · orval-labs · reported by GitHubCritical 9.3
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a header parameter default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0.
- Product
- orval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications.CVE-2026-71869 · Other software · orval-labs · reported by GitHubCritical 9.3
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in an array item default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0.
- Product
- orval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications.CVE-2026-71868 · Other software · orval-labs · reported by GitHubCritical 9.3
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in an enum default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0.
- Product
- orval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications.CVE-2026-71867 · Other software · orval-labs · reported by GitHubCritical 9.3
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a single quote in a schema property name is emitted into single-quoted object keys in generated MSW mock factories without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated mock factory is called by tests or an MSW handler, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/core/src/getters/keys.ts function getKey and MSW mock generation. This issue is fixed in version 8.21.0.
- Product
- orval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications.CVE-2026-71866 · Other software · orval-labs · reported by GitHubCritical 9.3
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. From version 8.19.0 until 8.21.0, a double quote in a schema property name is emitted into the generated zod.object({...}) schema without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts and zod object-key generation. This issue is fixed in version 8.21.0.
- Product
- orval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications.CVE-2026-71865 · Other software · orval-labs · reported by GitHubCritical 9.3
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a query parameter name is emitted into the generated request-validation zod.object({...}) schema without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts and query request-validation generation. This issue is fixed in version 8.21.0.
- Product
- orval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications.CVE-2026-71864 · Other software · orval-labs · reported by GitHubCritical 9.3
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a header parameter name is emitted into the generated request-validation zod.object({...}) schema without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts and header request-validation generation. This issue is fixed in version 8.21.0.
- Product
- orval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications.CVE-2026-62682 · Other software · orval-labs · reported by GitHubCritical 9.3
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in servers[0].url is emitted into request URL template literals generated when output.baseUrl.getBaseUrlFromSpecification is enabled without safe encoding. This permits attacker-controlled JavaScript to be evaluated when a generated request or URL-builder function is called, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/core/src/getters/route.ts function getFullRoute. This issue is fixed in version 8.21.0.
- Product
- orval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications.CVE-2026-62681 · Other software · orval-labs · reported by GitHubCritical 9.3
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in an OpenAPI path is emitted into request URL template literals generated for axios, fetch, react-query, and SWR clients without safe encoding. This permits attacker-controlled JavaScript to be evaluated when a generated request, URL-builder, or query-key function is called, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/core/src/getters/route.ts and route generation consumers. This issue is fixed in version 8.21.0.
- Product
- orval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications.CVE-2026-62680 · Other software · orval-labs · reported by GitHubHigh 7.1
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can cause requests from the developer or CI host to attacker-selected or internal HTTP services, read absolute or out-of-tree local files, and inline untrusted remote schemas into generated clients. The affected code is packages/orval/src/import-specs.ts external reference loading. This issue is fixed in version 8.22.0.
- Product
- orval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2026Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification.CVE-2026-25141 · Other software · orval-labs · reported by GitHubCritical 9.3
Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions starting with 7.19.0 and prior to 7.21.0 and 8.2.0 have an incomplete fix for CVE-2026-23947. While the jsStringEscape function properly handles single quotes ('), double quotes (") and so on, it is still possible to achieve code injection using only a limited set of characters that are currently not escaped. The vulnerability lies in the fact that the application can be forced to execute arbitrary JavaScript using characters such as []()!+. By using a technique known as JSFuck, an attacker can bypass the current sanitization logic and run arbitrary code without needing any alphanumeric characters or quotes. Version 7.21.0 and 8.2.0 contain an updated fix.
- Product
- orval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification.CVE-2026-24132 · Other software · orval-labs · reported by GitHubHigh 7.7
Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions 7.19.0 and below and 8.0.0-rc.0 through 8.0.2 allow untrusted OpenAPI specifications to inject arbitrary TypeScript/JavaScript into generated mock files via the const keyword on schema properties. These const values are interpolated into the mock scalar generator (getMockScalar in packages/mock/src/faker/getters/scalar.ts) without proper escaping or type-safe serialization, which results in attacker-controlled code being emitted into both interface definitions and faker/MSW handlers. The vulnerability is similar in impact to the previously reported enum x-enumDescriptions (GHSA-h526-wf6g-67jv), but it affects a different code path in the faker-based mock generator rather than @orval/core. The issue has been fixed in versions 7.20.0 and 8.0.3.
- Product
- orval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2026Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification.CVE-2026-23947 · Other software · orval-labs · reported by GitHubCritical 9.3
Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions prior to 7.19.0 until 8.0.2 are vulnerable to arbitrary code execution in environments consuming generated clients. This issue is similar in nature to CVE-2026-22785, but affects a different code path in @orval/core that was not addressed by CVE-2026-22785's fix. The vulnerability allows untrusted OpenAPI specifications to inject arbitrary TypeScript/JavaScript code into generated clients via the x-enumDescriptions field, which is embedded without proper escaping in getEnumImplementation(). I have confirmed that the injection occurs during const enum generation and results in executable code within the generated schema files. Orval 7.19.0 and 8.0.2 contain a fix for the issue.
- Product
- orval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification.CVE-2026-22785 · Other software · orval-labs · reported by GitHubCritical 9.3
orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Prior to 7.18.0, the MCP server generation logic relies on string manipulation that incorporates the summary field from the OpenAPI specification without proper validation or escaping. This allows an attacker to "break out" of the string literal and inject arbitrary code. This vulnerability is fixed in 7.18.0.
- Product
- orval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2024In the Linux kernel, the following vulnerability has been resolved: fork: defer linking file vma until vma is fully initialized Thorvald reported a WARNING [1CVE-2024-27022 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: fork: defer linking file vma until vma is fully initialized Thorvald reported a WARNING [1]. And the root cause is below race: CPU 1 CPU 2 fork hugetlbfs_fallocate dup_mmap hugetlbfs_punch_hole i_mmap_lock_write(mapping); vma_interval_tree_insert_after -- Child vma is visible through i_mmap tree. i_mmap_unlock_write(mapping); hugetlb_dup_vma_private -- Clear vma_lock outside i_mmap_rwsem! i_mmap_lock_write(mapping); hugetlb_vmdelete_list vma_interval_tree_foreach hugetlb_vma_trylock_write -- Vma_lock is cleared. tmp->vm_ops->open -- Alloc new vma_lock outside i_mmap_rwsem! hugetlb_vma_unlock_write -- Vma_lock is assigned!!! i_mmap_unlock_write(mapping); hugetlb_dup_vma_private() and hugetlb_vm_op_open() are called outside i_mmap_rwsem lock while vma lock can be used in the same time. Fix this by deferring linking file vma until vma is fully initialized. Those vmas should be initialized first before they can be used.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jul 12, 2018Catfish CMS v4.7.9 allows XSS via the admin/Index/write.html editorValue parameter (aka an article posted by an administrator).CVE-2018-13999 · Other software · Catfish-cms · reported by MITREMedium 4.8
Catfish CMS v4.7.9 allows XSS via the admin/Index/write.html editorValue parameter (aka an article posted by an administrator).
- Product
- Catfish CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.