Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
74 results · page 1 of 2
Sep 26, 2026Budibase versions before 3.45.0 fail to disable external JSON reference resolution in the OpenAPI/Swagger import validator, allowing authenticated builders to rCVE-2026-100680 · Other software · budibase · reported by VulnCheckHigh 8.6
Budibase versions before 3.45.0 fail to disable external JSON reference resolution in the OpenAPI/Swagger import validator, allowing authenticated builders to read arbitrary local files. Attackers with builder access can embed file:// references in OpenAPI specifications submitted to the import endpoint to exfiltrate sensitive files including environment variables containing JWT secrets, API keys, and database credentials.
- Product
- server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 17, 2026go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depCVE-2026-93450 · Other software · go-openapi · reported by VulnCheckHigh 8.7
go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI specifications, causing fatal stack overflow that terminates the process and all in-flight requests.
- Product
- swag
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2026HCL Hive is affected by an information exposure vulnerability where Swagger documentation was found exposed publicly.CVE-2026-21759 · Other software · HCLSoftware · reported by psirt@hcl.comMedium 4.3
HCL Hive is affected by an information exposure vulnerability where Swagger documentation was found exposed publicly. Although no sensitive information (e.g., credentials, PII) was discovered, exposing API documentation to unauthenticated users can increase the overall attack surface.
- Product
- HCL Hive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Aug 19, 2026Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications.CVE-2026-72717 · Other software · orval-labs · reported by GitHubCritical 9.3
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a schema default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0.
- Product
- orval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications.CVE-2026-72716 · Other software · orval-labs · reported by GitHubCritical 9.3
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a query parameter default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0.
- Product
- orval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications.CVE-2026-71871 · Other software · orval-labs · reported by GitHubCritical 9.3
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a header parameter default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0.
- Product
- orval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications.CVE-2026-71869 · Other software · orval-labs · reported by GitHubCritical 9.3
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in an array item default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0.
- Product
- orval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications.CVE-2026-71868 · Other software · orval-labs · reported by GitHubCritical 9.3
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in an enum default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0.
- Product
- orval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications.CVE-2026-71867 · Other software · orval-labs · reported by GitHubCritical 9.3
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a single quote in a schema property name is emitted into single-quoted object keys in generated MSW mock factories without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated mock factory is called by tests or an MSW handler, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/core/src/getters/keys.ts function getKey and MSW mock generation. This issue is fixed in version 8.21.0.
- Product
- orval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications.CVE-2026-71866 · Other software · orval-labs · reported by GitHubCritical 9.3
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. From version 8.19.0 until 8.21.0, a double quote in a schema property name is emitted into the generated zod.object({...}) schema without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts and zod object-key generation. This issue is fixed in version 8.21.0.
- Product
- orval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications.CVE-2026-71865 · Other software · orval-labs · reported by GitHubCritical 9.3
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a query parameter name is emitted into the generated request-validation zod.object({...}) schema without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts and query request-validation generation. This issue is fixed in version 8.21.0.
- Product
- orval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications.CVE-2026-71864 · Other software · orval-labs · reported by GitHubCritical 9.3
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a header parameter name is emitted into the generated request-validation zod.object({...}) schema without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts and header request-validation generation. This issue is fixed in version 8.21.0.
- Product
- orval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications.CVE-2026-62682 · Other software · orval-labs · reported by GitHubCritical 9.3
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in servers[0].url is emitted into request URL template literals generated when output.baseUrl.getBaseUrlFromSpecification is enabled without safe encoding. This permits attacker-controlled JavaScript to be evaluated when a generated request or URL-builder function is called, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/core/src/getters/route.ts function getFullRoute. This issue is fixed in version 8.21.0.
- Product
- orval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications.CVE-2026-62681 · Other software · orval-labs · reported by GitHubCritical 9.3
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in an OpenAPI path is emitted into request URL template literals generated for axios, fetch, react-query, and SWR clients without safe encoding. This permits attacker-controlled JavaScript to be evaluated when a generated request, URL-builder, or query-key function is called, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/core/src/getters/route.ts and route generation consumers. This issue is fixed in version 8.21.0.
- Product
- orval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications.CVE-2026-62680 · Other software · orval-labs · reported by GitHubHigh 7.1
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can cause requests from the developer or CI host to attacker-selected or internal HTTP services, read absolute or out-of-tree local files, and inline untrusted remote schemas into generated clients. The affected code is packages/orval/src/import-specs.ts external reference loading. This issue is fixed in version 8.22.0.
- Product
- orval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026A security flaw has been discovered in eyaushev swagger-testcase-mcp 5babb27c951fb404bc2b25ec80593616e49054e5.CVE-2026-19765 · Other software · eyaushev · reported by VulDBLow 2.1
A security flaw has been discovered in eyaushev swagger-testcase-mcp 5babb27c951fb404bc2b25ec80593616e49054e5. This vulnerability affects the function loadSource of the file src/utils/swagger-parser.ts of the component fetch_swagger. Performing a manipulation results in server-side request forgery. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- swagger-testcase-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2026The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to be loaded, overriding the existing API deCVE-2025-6508 · Other software · WSO2 · reported by ed10eef1-636d-4fbe-9993-6890dfa878f8Medium 4.3
The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to be loaded, overriding the existing API definitions within the Publisher portal. By exploiting this vulnerability, malicious actors can deceive users into interacting with these overwritten API definitions. This could lead to the exposure of sensitive information or the initiation of unintended requests to backend services.
- Product
- WSO2 API Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.docs.wso2.com
Jul 29, 2026swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification.CVE-2026-54666 · Other software · acacode · reported by GitHubHigh 8.3
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-routes/schema-routes.ts passes OpenAPI path keys through parseRouteName to templates/default/procedure-call.ejs and templates/modular/procedure-call.ejs without escaping JavaScript template literal interpolation, allowing an attacker-controlled path containing ${...} to execute when the generated method is called. This issue is fixed in version 13.12.2.
- Product
- swagger-typescript-api
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2026swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification.CVE-2026-54664 · Other software · acacode · reported by GitHubHigh 8.3
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-parser/base-schema-parsers/enum.ts passes components.schemas.*.enum[i] values to Ts.StringValue in src/configuration.ts without escaping before templates/base/enum-data-contract.ejs renders TypeScript enum declarations, allowing an attacker-controlled OpenAPI spec to inject code that executes when the generated module is imported. This issue is fixed in version 13.12.2.
- Product
- swagger-typescript-api
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2026swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications.CVE-2026-54663 · Other software · acacode · reported by GitHubMedium 6.1
swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts warmUpRemoteSchemasCache resolves external $ref URLs and fetchRemoteSchemaDocument uses isHttpUrl to fetch any http or https target without private IP, redirect, DNS rebinding, or same-origin validation, allowing an attacker-controlled OpenAPI spec to make the generator issue requests to internal or link-local services. This issue is fixed in version 13.12.2.
- Product
- swagger-typescript-api
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2026swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications.CVE-2026-54662 · Other software · acacode · reported by GitHubHigh 8.3
swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers[0].url into apiConfig.baseUrl, and templates/base/http-clients/fetch-http-client.ejs interpolates apiConfig.baseUrl into the generated HttpClient baseUrl field without escaping, allowing an attacker-controlled OpenAPI spec to inject TypeScript static field code that executes when the generated fetch client module is imported. This issue is fixed in version 13.12.2.
- Product
- swagger-typescript-api
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2026swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification.CVE-2026-54661 · Other software · acacode · reported by GitHubHigh 8.3
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers[0].url from src/code-gen-process.ts into the HttpClient constructor without escaping, allowing an attacker-controlled OpenAPI spec to inject code that executes when new HttpClient() or new Api() is constructed. This issue is fixed in version 13.12.2.
- Product
- swagger-typescript-api
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2026swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications.CVE-2026-54660 · Other software · acacode · reported by GitHubHigh 7.4
swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts getRemoteRequestHeaders forwards --authorizationToken to every URL fetched by fetchRemoteSchemaDocument while warmUpRemoteSchemasCache resolves external $ref URLs, allowing an attacker-controlled OpenAPI spec to exfiltrate the developer or CI bearer token to a cross-origin endpoint. This issue is fixed in version 13.12.2.
- Product
- swagger-typescript-api
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026APIFold reads an OpenAPI 3.x or Swagger 2.x specification and generates a live, production-ready MCP server endpoint.CVE-2026-47769 · Other software · Work90210 · reported by GitHubMedium 5.3
APIFold reads an OpenAPI 3.x or Swagger 2.x specification and generates a live, production-ready MCP server endpoint. Prior to commit 7f19b52280f414f57af2b79a95333d1c8fbeece5, the `/webhooks/:serverSlug/:eventName` endpoint accepts arbitrary unauthenticated JSON and stores it in Redis and the `webhook_events` PostgreSQL table without any signature check or authentication requirement. The root cause is that `createWebhookRouter` is called at `server.ts:188` without a `validators` map, so `receivers.ts:80`'s optional-chaining guard evaluates to `undefined` and the signature-validation block (`receiver.ts:81–95`) is unconditionally skipped. Any unauthenticated network client that knows a valid server slug can inject arbitrary payloads, which are subsequently served as trusted resource state to legitimate MCP clients. Commit 7f19b52280f414f57af2b79a95333d1c8fbeece5 patches the issue.
- Product
- APIFold
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2026Shopware is an open commerce platform.CVE-2026-32100 · Other software · swag · reported by GitHubMedium 5.3
Shopware is an open commerce platform. /api/_info/config route exposes information about active security fixes. This vulnerability is fixed in 2.0.16, 3.0.12, and 4.0.7.
- Product
- platform-security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2026Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification.CVE-2026-25141 · Other software · orval-labs · reported by GitHubCritical 9.3
Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions starting with 7.19.0 and prior to 7.21.0 and 8.2.0 have an incomplete fix for CVE-2026-23947. While the jsStringEscape function properly handles single quotes ('), double quotes (") and so on, it is still possible to achieve code injection using only a limited set of characters that are currently not escaped. The vulnerability lies in the fact that the application can be forced to execute arbitrary JavaScript using characters such as []()!+. By using a technique known as JSFuck, an attacker can bypass the current sanitization logic and run arbitrary code without needing any alphanumeric characters or quotes. Version 7.21.0 and 8.2.0 contain an updated fix.
- Product
- orval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification.CVE-2026-24132 · Other software · orval-labs · reported by GitHubHigh 7.7
Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions 7.19.0 and below and 8.0.0-rc.0 through 8.0.2 allow untrusted OpenAPI specifications to inject arbitrary TypeScript/JavaScript into generated mock files via the const keyword on schema properties. These const values are interpolated into the mock scalar generator (getMockScalar in packages/mock/src/faker/getters/scalar.ts) without proper escaping or type-safe serialization, which results in attacker-controlled code being emitted into both interface definitions and faker/MSW handlers. The vulnerability is similar in impact to the previously reported enum x-enumDescriptions (GHSA-h526-wf6g-67jv), but it affects a different code path in the faker-based mock generator rather than @orval/core. The issue has been fixed in versions 7.20.0 and 8.0.3.
- Product
- orval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2026Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification.CVE-2026-23947 · Other software · orval-labs · reported by GitHubCritical 9.3
Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions prior to 7.19.0 until 8.0.2 are vulnerable to arbitrary code execution in environments consuming generated clients. This issue is similar in nature to CVE-2026-22785, but affects a different code path in @orval/core that was not addressed by CVE-2026-22785's fix. The vulnerability allows untrusted OpenAPI specifications to inject arbitrary TypeScript/JavaScript code into generated clients via the x-enumDescriptions field, which is embedded without proper escaping in getEnumImplementation(). I have confirmed that the injection occurs during const enum generation and results in executable code within the generated schema files. Orval 7.19.0 and 8.0.2 contain a fix for the issue.
- Product
- orval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification.CVE-2026-22785 · Other software · orval-labs · reported by GitHubCritical 9.3
orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Prior to 7.18.0, the MCP server generation logic relies on string manipulation that incorporates the summary field from the OpenAPI specification without proper validation or escaping. This allows an attacker to "break out" of the string literal and inject arbitrary code. This vulnerability is fixed in 7.18.0.
- Product
- orval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2025An issue in petstore v.1.0.7 allows a remote attacker to execute arbitrary code via accessing a non-existent endpoint/cart, the server returns a 404-error page CVE-2025-29157 · Other software · Smartbear · reported by MITREMedium 6.5
An issue in petstore v.1.0.7 allows a remote attacker to execute arbitrary code via accessing a non-existent endpoint/cart, the server returns a 404-error page exposing sensitive information including the Servlet name (default) and server version
- Product
- Swagger Petstore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Sep 25, 2025Cross Site Scripting vulnerability in petstore v.1.0.7 allows a remote attacker to execute arbitrary code via a crafted script to the /api/v3/petCVE-2025-29156 · Other software · Smartbear · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in petstore v.1.0.7 allows a remote attacker to execute arbitrary code via a crafted script to the /api/v3/pet
- Product
- Swagger Petstore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Sep 25, 2025An issue in petstore v.1.0.7 allows a remote attacker to execute arbitrary code via the DELETE endpointCVE-2025-29155 · Other software · Smartbear · reported by MITREMedium 6.5
An issue in petstore v.1.0.7 allows a remote attacker to execute arbitrary code via the DELETE endpoint
- Product
- Swagger Petstore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jun 28, 2025The MIB3 infotainment unit used in Skoda and Volkswagen vehicles does not incorporate any privilege separation for the proprietary inter-process communication mCVE-2023-29113 · Other software · Preh Car Connect GmbH (JOYNEXT GmbH) · reported by cve@asrg.ioMedium 6.3
The MIB3 infotainment unit used in Skoda and Volkswagen vehicles does not incorporate any privilege separation for the proprietary inter-process communication mechanism, leaving attackers with presence in the system an ability to undermine access control restrictions implemented at the operating system level. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.
- Product
- Volkswagen MIB3 infotainment system MIB3 OI MQB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2025The MIB3 unit stores the synchronized phone contact book in clear-text, allowing an attacker with either code execution privilege on the system or physical acceCVE-2023-28912 · Other software · Preh Car Connect GmbH (JOYNEXT GmbH) · reported by cve@asrg.ioMedium 5.7
The MIB3 unit stores the synchronized phone contact book in clear-text, allowing an attacker with either code execution privilege on the system or physical access to the system to obtain vehicle owner's contact data. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.
- Product
- Volkswagen MIB3 infotainment system MIB3 OI MQB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2025A specific flaw exists within the Bluetooth stack of the MIB3 infotainment.CVE-2023-28911 · Other software · Preh Car Connect GmbH (JOYNEXT GmbH) · reported by cve@asrg.ioMedium 6.5
A specific flaw exists within the Bluetooth stack of the MIB3 infotainment. The issue results from the lack of proper validation of user-supplied data, which can result in an arbitrary channel disconnection. An attacker can leverage this vulnerability to cause a denial-of-service attack for every connected client of the infotainment device. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.
- Product
- Volkswagen MIB3 infotainment system MIB3 OI MQB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2025A specific flaw exists within the Bluetooth stack of the MIB3 infotainment system.CVE-2023-28910 · Other software · Preh Car Connect GmbH (JOYNEXT GmbH) · reported by cve@asrg.ioHigh 8
A specific flaw exists within the Bluetooth stack of the MIB3 infotainment system. The issue results from the disabled abortion flag eventually leading to bypassing assertion functions. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.
- Product
- Volkswagen MIB3 infotainment system MIB3 OI MQB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2025A specific flaw exists within the Bluetooth stack of the MIB3 unit.CVE-2023-28909 · Other software · Preh Car Connect GmbH (JOYNEXT GmbH) · reported by cve@asrg.ioHigh 8
A specific flaw exists within the Bluetooth stack of the MIB3 unit. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow when receiving fragmented HCI packets on a channel. An attacker can leverage this vulnerability to bypass the MTU check on a channel with enabled fragmentation. Consequently, this can lead to a buffer overflow in upper layer profiles, which can be used to obtain remote code execution. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.
- Product
- Volkswagen MIB3 infotainment system MIB3 OI MQB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2025A specific flaw exists within the Bluetooth stack of the MIB3 infotainment.CVE-2023-28908 · Other software · Preh Car Connect GmbH (JOYNEXT GmbH) · reported by cve@asrg.ioMedium 5.4
A specific flaw exists within the Bluetooth stack of the MIB3 infotainment. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow when receiving non-fragmented HCI packets on a channel. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.
- Product
- Volkswagen MIB3 infotainment system MIB3 OI MQB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2025There is no memory isolation between CPU cores of the MIB3 infotainment.CVE-2023-28907 · Other software · Preh Car Connect GmbH (JOYNEXT GmbH) · reported by cve@asrg.ioMedium 6.7
There is no memory isolation between CPU cores of the MIB3 infotainment. This fact allows an attacker with access to the main operating system to compromise the CPU core responsible for CAN message processing. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.
- Product
- Volkswagen MIB3 infotainment system MIB3 OI MQB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2025A command injection in the networking service of the MIB3 infotainment allows an attacker already presenting in the system to escalate privileges and obtain admCVE-2023-28906 · Other software · Preh Car Connect GmbH (JOYNEXT GmbH) · reported by cve@asrg.ioHigh 7.8
A command injection in the networking service of the MIB3 infotainment allows an attacker already presenting in the system to escalate privileges and obtain administrative access to the system. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.
- Product
- Volkswagen MIB3 infotainment system MIB3 OI MQB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2025A heap buffer overflow in the image processing binary of the MIB3 infotainment unit allows an attacker to execute arbitrary code on it.CVE-2023-28905 · Other software · Preh Car Connect GmbH (JOYNEXT GmbH) · reported by cve@asrg.ioHigh 8
A heap buffer overflow in the image processing binary of the MIB3 infotainment unit allows an attacker to execute arbitrary code on it. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.
- Product
- Volkswagen MIB3 infotainment system MIB3 OI MQB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2025A logic flaw leading to a RAM buffer overflow in the bootloader component of the MIB3 infotainment unit allows an attacker with physical access to the MIB3 ECU CVE-2023-28904 · Other software · Preh Car Connect GmbH (JOYNEXT GmbH) · reported by cve@asrg.ioMedium 5.2
A logic flaw leading to a RAM buffer overflow in the bootloader component of the MIB3 infotainment unit allows an attacker with physical access to the MIB3 ECU to bypass firmware signature verification and run arbitrary code in the infotainment system at boot process.
- Product
- Volkswagen MIB3 infotainment system MIB3 OI MQB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2025An integer overflow in the image processing binary of the MIB3 infotainment unit allows an attacker with local access to the vehicle to cause a denial-of-servicCVE-2023-28903 · Other software · Preh Car Connect GmbH (JOYNEXT GmbH) · reported by cve@asrg.ioLow 3.3
An integer overflow in the image processing binary of the MIB3 infotainment unit allows an attacker with local access to the vehicle to cause a denial-of-service of the infotainment system.
- Product
- Volkswagen MIB3 infotainment system MIB3 OI MQB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2025An integer underflow in the image processing binary of the MIB3 infotainment unit allows an attacker with local access to the vehicle to cause denial-of-serviceCVE-2023-28902 · Other software · Preh Car Connect GmbH (JOYNEXT GmbH) · reported by cve@asrg.ioLow 3.3
An integer underflow in the image processing binary of the MIB3 infotainment unit allows an attacker with local access to the vehicle to cause denial-of-service of the infotainment system. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list of affected MIB3 OEM part numbers is provided in the referenced resources.
- Product
- Volkswagen MIB3 infotainment system MIB3 OI MQB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025Due to insufficient input validation, SAP Commerce (Swagger UI) allows an unauthenticated attacker to inject the malicious code from remote sources, which can bCVE-2025-27434 · Websites & servers · SAP_SE · reported by cna@sap.comHigh 8.8
Due to insufficient input validation, SAP Commerce (Swagger UI) allows an unauthenticated attacker to inject the malicious code from remote sources, which can be leveraged by an attacker to execute a cross-site scripting (XSS) attack. This could lead to a high impact on the confidentiality, integrity, and availability of data in SAP Commerce.
- Product
- SAP Commerce (Swagger UI)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2025Embed Swagger UI: Stored Cross-Site ScriptingCVE-2024-13700 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Embed Swagger UI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpsgui' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Embed Swagger UI
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Embed Swagger UI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Dec 30, 2024IBM WebSphere Automation 1.7.5 could allow a remote privileged user, who has authorized access to the swagger UI, to execute arbitrary code.CVE-2024-54181 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.2
IBM WebSphere Automation 1.7.5 could allow a remote privileged user, who has authorized access to the swagger UI, to execute arbitrary code. Using specially crafted input, the user could exploit this vulnerability to execute arbitrary code on the system.
- Product
- WebSphere Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2024An issue in the component /api/swaggerui/static of Bazaar v1.4.3 allows unauthenticated attackers to execute a directory traversal.CVE-2024-40348 · Other software · bazarr · reported by MITREHigh 8.2
An issue in the component /api/swaggerui/static of Bazaar v1.4.3 allows unauthenticated attackers to execute a directory traversal.
- Product
- bazarr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2024An attacker with access to the private network (the charger is connected to) or local access to the Ethernet-Interface can exploit a faulty implementation of thCVE-2024-5684 · Other software · Volkswagen Group Charging GmbH - Elli, EVBox · reported by cve@asrg.ioMedium 6.3
An attacker with access to the private network (the charger is connected to) or local access to the Ethernet-Interface can exploit a faulty implementation of the JWT-library in order to bypass the password authentication to the web configuration interface and then has full access as the user would have. However, an attacker will not have developer or admin rights. If the implementation of the JWT-library is wrongly configured to accept "none"-algorithms, the server will pass insecure JWT. A local, unauthenticated attacker can exploit this vulnerability to bypass the authentication mechanism.
- Product
- ID Charger Connect & Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2024http-swagger before 1.2.6 allows XSS via PUT requests, because a file that has been uploaded (via httpSwagger.WrapHandler and *webdav.memFile) can subsequently CVE-2024-25712 · Other software · Http-swagger Project · reported by MITREMedium 6.1
http-swagger before 1.2.6 allows XSS via PUT requests, because a file that has been uploaded (via httpSwagger.WrapHandler and *webdav.memFile) can subsequently be accessed via a GET request. NOTE: this is independently fixable with respect to CVE-2022-24863, because (if a solution continued to allow PUT requests) large files could have been blocked without blocking JavaScript, or JavaScript could have been blocked without blocking large files.
- Product
- Http-swagger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcosmosofcyberspace.github.iogithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.