Permalink CVE-2026-66063

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 10 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse accepted 10 hours ago
• @LeSuisse published on GitHub 10 hours ago

goshs has a Path Traversal issue

• https://github.com/goshs-labs/goshs/security/advisories/GHSA-wg2q-39h6-66x9 x_refsource_CONFIRM
• https://github.com/goshs-labs/goshs/commit/f3ef599e409151d1380866e47de8b1afb0bb54fa x_refsource_MISC

---

goshs

• ==< 2.1.5

Permalink CVE-2026-66064

5.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 10 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse accepted 10 hours ago
• @LeSuisse published on GitHub 10 hours ago

goshs has ACL Bypass & Path Traversal

• https://github.com/goshs-labs/goshs/security/advisories/GHSA-964w-f6gj-5236 x_refsource_CONFIRM
• https://github.com/goshs-labs/goshs/pull/222 x_refsource_MISC
• https://github.com/goshs-labs/goshs/commit/f3ef599e409151d1380866e47de8b1afb0bb54fa x_refsource_MISC

---

goshs

• ==< 2.1.5

Permalink CVE-2026-16313

7.6 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Physical (P)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Physical (P)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 10 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse accepted 10 hours ago
• @LeSuisse published on GitHub 10 hours ago

Sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export

• https://access.redhat.com/security/cve/CVE-2026-16313 x_refsource_REDHATvdb-entry
• RHBZ#2502845 issue-trackingx_refsource_REDHAT
• https://github.com/doug-gilbert/sg3_utils/pull/83

---

rhcos

sg3_utils

Permalink CVE-2026-47483

8.2 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 10 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse ignored package dcgm 10 hours ago
• @LeSuisse accepted 10 hours ago
• @LeSuisse published on GitHub 10 hours ago

NVIDIA DCGM Exporter for all platforms contains a vulnerability in …

• https://nvd.nist.gov/vuln/detail/CVE-2026-47483
• https://www.cve.org/CVERecord?id=CVE-2026-47483
• https://github.com/NVIDIA/product-security/tree/main/2026/5857

---

DCGM

• ==0.0 to 4.5.2

DCGM Exporter

• ==0.0 to 4.8.2

Permalink CVE-2026-54719

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 10 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse accepted 10 hours ago
• @LeSuisse published on GitHub 10 hours ago

goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of CVE-2026-40189)

• https://github.com/goshs-labs/goshs/security/advisories/GHSA-rmxw-pq4x-3fvh x_refsource_CONFIRM
• https://github.com/goshs-labs/goshs/commit/7cf911a26ace737e1a55b7dc073e307a25f7fd1d x_refsource_MISC
• https://github.com/goshs-labs/goshs/releases/tag/v2.1.1 x_refsource_MISC

---

goshs

• ==< 2.1.1

26.05 needs some backports

Permalink CVE-2026-64863

9.1 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 10 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse accepted 10 hours ago
• @LeSuisse published on GitHub 10 hours ago

goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite

• https://github.com/goshs-labs/goshs/security/advisories/GHSA-hq33-8jgp-8qq3 x_refsource_CONFIRM
• https://github.com/goshs-labs/goshs/commit/0444ac6b1a8176ddae70d940adf7a26b2e5a6c29 x_refsource_MISC
• https://github.com/goshs-labs/goshs/releases/tag/v2.1.4 x_refsource_MISC

---

goshs

• ==< 2.1.4

Permalink CVE-2026-62325

9.1 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 10 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse accepted 10 hours ago
• @LeSuisse published on GitHub 10 hours ago

goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)

• https://github.com/goshs-labs/goshs/security/advisories/GHSA-rjrw-mjq6-hpmm x_refsource_CONFIRM
• https://github.com/goshs-labs/goshs/commit/32f4a0e1790a709f722d0f3b2341f139d003180a x_refsource_MISC
• https://github.com/goshs-labs/goshs/releases/tag/v2.1.4 x_refsource_MISC

---

goshs

• ==>= 2.1.3, < 2.1.4

Permalink CVE-2026-66913

6.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 10 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse ignored
  2 packages

  • python314Packages.lookyloo-models
  • python313Packages.lookyloo-models
  10 hours ago
• @LeSuisse accepted 10 hours ago
• @LeSuisse published on GitHub 10 hours ago

Zip Bomb in Lookyloo Capture Upload Allows Denial of Service

• https://github.com/Lookyloo/lookyloo/commit/96589da290f018e356db7c0eaddf1aa5016… patch

---

lookyloo

• =<1.40.0

Backport needed

Permalink CVE-2026-18047

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

updated 10 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse accepted 10 hours ago
• @LeSuisse published on GitHub 10 hours ago

Dogtag-pki: pki-core: redhat-pki: pki: acme admin enable/disable endpoint authentication bypass via trailing slash

• https://access.redhat.com/security/cve/CVE-2026-18047 x_refsource_REDHATvdb-entry
• RHBZ#2507956 issue-trackingx_refsource_REDHAT

---

pki-core

dogtag-pki

redhat-pki

pki-core:10.6/pki-core

redhat-pki:10/redhat-pki

Permalink CVE-2026-18107

7.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 10 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse accepted 10 hours ago
• @LeSuisse published on GitHub 10 hours ago

Criu: criu: container escape via rseq critical section hijack during checkpoint/restore

• https://access.redhat.com/security/cve/CVE-2026-18107 x_refsource_REDHATvdb-entry
• RHBZ#2508140 issue-trackingx_refsource_REDHAT
• https://github.com/checkpoint-restore/criu/pull/3097

---

criu

rhcos

container-tools:rhel8/criu

https://github.com/checkpoint-restore/criu/commit/4861932648206c658c0dc824342a80f5f9ac5cec

Permalink CVE-2026-54691

8.2 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 10 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse accepted 10 hours ago
• @LeSuisse published on GitHub 10 hours ago

datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects

• https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-rfr2-mq9m-x2qx x_refsource_CONFIRM
• https://github.com/koxudaxi/datamodel-code-generator/commit/5fdba4a09f2d7a9996a504975b7ef7d63e3715bb x_refsource_MISC
• https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.61.0 x_refsource_MISC

---

datamodel-code-generator

• ==>= 0.9.1, < 0.61.0

Permalink CVE-2026-55391

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 10 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse accepted 10 hours ago
• @LeSuisse published on GitHub 10 hours ago

datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding

• https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-vx7x-vcc2-c44g x_refsource_CONFIRM
• https://github.com/koxudaxi/datamodel-code-generator/commit/25c8b7e497419eb20b230fa3318c04f9bebc5a6f x_refsource_MISC
• https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.63.0 x_refsource_MISC

---

datamodel-code-generator

• ==< 0.63.0

Permalink CVE-2026-54656

7.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 10 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse accepted 10 hours ago
• @LeSuisse published on GitHub 10 hours ago

`datamodel-code-generator` vulnerable to code execution on import via unescaped `validators` entries in --extra-template-data

• https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-8m8r-38jm-f355 x_refsource_CONFIRM
• https://github.com/koxudaxi/datamodel-code-generator/commit/a43d02906111a2fdcaf13ee5b62eb2da85376f19 x_refsource_MISC
• https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.2 x_refsource_MISC

---

datamodel-code-generator

• ==>= 0.52.1, < 0.60.2

Permalink CVE-2026-55403

3.7 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 10 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse accepted 10 hours ago
• @LeSuisse published on GitHub 10 hours ago

datamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemas

• https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-r5vv-ff45-prp2 x_refsource_CONFIRM
• https://github.com/koxudaxi/datamodel-code-generator/commit/a585c037c8307b7aae815de193b7fe1c4c44994b x_refsource_MISC
• https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.63.0 x_refsource_MISC

---

datamodel-code-generator

• ==< 0.63.0

Permalink CVE-2026-55390

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 10 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse accepted 10 hours ago
• @LeSuisse published on GitHub 10 hours ago

Arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate

• https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-442q-2j6p-642g x_refsource_CONFIRM
• https://github.com/koxudaxi/datamodel-code-generator/commit/d2d5cecd9fd3a2a6dbf148bf0740b83a11fc6820 x_refsource_MISC
• https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.62.0 x_refsource_MISC

---

datamodel-code-generator

• ==>= 0.59.0, < 0.62.0

Permalink CVE-2026-55389

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 10 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse accepted 10 hours ago
• @LeSuisse published on GitHub 10 hours ago

datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs`

• https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-8359-h9fx-j6v9 x_refsource_CONFIRM
• https://github.com/koxudaxi/datamodel-code-generator/commit/2ff4a72b4550a2b2069754c5b075b1655067e5fb x_refsource_MISC
• https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.62.0 x_refsource_MISC

---

datamodel-code-generator

• ==< 0.62.0

Permalink CVE-2026-55415

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 10 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse accepted 10 hours ago
• @LeSuisse published on GitHub 10 hours ago

datamodel-code-generator vulnerable to code injection via `x-python-import` / `customTypePath` in generated import statements

• https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-5578-w22f-pfx9 x_refsource_CONFIRM
• https://github.com/koxudaxi/datamodel-code-generator/commit/577d49569c2254c371a97e495020ae2238a73b84 x_refsource_MISC
• https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.64.0 x_refsource_MISC

---

datamodel-code-generator

• ==>= 0.11.6, < 0.64.0

Permalink CVE-2026-54621

7.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 10 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse accepted 10 hours ago
• @LeSuisse published on GitHub 10 hours ago

`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description

• https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-j884-q54q-mmx3 x_refsource_CONFIRM
• https://github.com/koxudaxi/datamodel-code-generator/commit/aec47bc414779f4a9992b3919c8f7663afd6c988 x_refsource_MISC
• https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.1 x_refsource_MISC

---

datamodel-code-generator

• ==>= 0.25.0, < 0.60.1

Permalink CVE-2026-54654

7.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 10 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse accepted 10 hours ago
• @LeSuisse published on GitHub 10 hours ago

`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field

• https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-wjv6-jcfj-mf9r x_refsource_CONFIRM
• https://github.com/koxudaxi/datamodel-code-generator/commit/b73abb5cd703a50471b8950bbd3bd0b82ad71de7 x_refsource_MISC
• https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.2 x_refsource_MISC

---

datamodel-code-generator

• ==>= 0.14.1, < 0.60.2

Permalink CVE-2026-54655

7.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 10 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse accepted 10 hours ago
• @LeSuisse published on GitHub 10 hours ago

`datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generator

• https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-m34r-v34r-rf9q x_refsource_CONFIRM
• https://github.com/koxudaxi/datamodel-code-generator/commit/2c93c9b712f43391dcfa975a1e4aa0b7c93ccbba x_refsource_MISC
• https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.2 x_refsource_MISC

---

datamodel-code-generator

• ==>= 0.51.0, < 0.60.2

Permalink CVE-2026-54690

8.2 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 10 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse accepted 10 hours ago
• @LeSuisse published on GitHub 10 hours ago

datamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default)

• https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-954p-556p-r752 x_refsource_CONFIRM
• https://github.com/koxudaxi/datamodel-code-generator/commit/5fdba4a09f2d7a9996a504975b7ef7d63e3715bb x_refsource_MISC
• https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.61.0 x_refsource_MISC

---

datamodel-code-generator

• ==>= 0.9.1, < 0.61.0

Permalink CVE-2026-54653

8.8 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

updated 10 hours ago by @LeSuisse Activity log

• Created suggestion 14 hours ago
• @LeSuisse accepted 10 hours ago
• @LeSuisse published on GitHub 10 hours ago

`datamodel-code-generator` vulnerable to code injection in via attacker-controlled `default_factory` schema field

• https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-386q-5hp3-95m9 x_refsource_CONFIRM
• https://github.com/koxudaxi/datamodel-code-generator/commit/17fc235e234cbcfaaadef8c74cb72c9687db0d1d x_refsource_MISC
• https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.60.2 x_refsource_MISC

---

datamodel-code-generator

• ==>= 0.17.0, < 0.60.2

Permalink CVE-2026-59950

7.6 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): Passive (P)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Passive (P)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 day, 2 hours ago by @erictapen Activity log

• Created suggestion 1 week, 2 days ago
• @erictapen ignored
  18 packages

  • python314Packages.aliyun-python-sdk-config
  • python313Packages.aliyun-python-sdk-config
  • python314Packages.aliyun-python-sdk-alimt
  • python313Packages.aliyun-python-sdk-alimt
  • python314Packages.aliyun-python-sdk-dbfs
  • python314Packages.aliyun-python-sdk-core
  • python313Packages.aliyun-python-sdk-dbfs
  • python313Packages.aliyun-python-sdk-core
  • python314Packages.aliyun-python-sdk-sts
  • python314Packages.aliyun-python-sdk-kms
  • python314Packages.aliyun-python-sdk-iot
  • python314Packages.aliyun-python-sdk-cdn
  • python313Packages.aliyun-python-sdk-sts
  • python313Packages.aliyun-python-sdk-kms
  • python313Packages.aliyun-python-sdk-iot
  • python313Packages.aliyun-python-sdk-cdn
  • python314Packages.bce-python-sdk
  • python313Packages.bce-python-sdk
  1 day, 2 hours ago
• @erictapen accepted 1 day, 2 hours ago
• @erictapen published on GitHub 1 day, 2 hours ago

MCP Python SDK: WebSocket server transport does not support Host/Origin validation

• https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-vj7q-gjh5-988w x_refsource_CONFIRM
• https://github.com/modelcontextprotocol/python-sdk/pull/2992 x_refsource_MISC
• https://github.com/modelcontextprotocol/python-sdk/commit/777b8d06710c140e3606b0d4598e2aa48546c266 x_refsource_MISC
• https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.28.1 x_refsource_MISC

---

python-sdk

• ==< 1.28.1

Affects python3Packages.mcp

Permalink CVE-2026-52869

7.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): Low (L)

updated 1 day, 2 hours ago by @erictapen Activity log

• Created suggestion 1 week, 2 days ago
• @erictapen ignored
  18 packages

  • python314Packages.aliyun-python-sdk-config
  • python313Packages.aliyun-python-sdk-config
  • python314Packages.aliyun-python-sdk-alimt
  • python313Packages.aliyun-python-sdk-alimt
  • python314Packages.aliyun-python-sdk-dbfs
  • python314Packages.aliyun-python-sdk-core
  • python313Packages.aliyun-python-sdk-dbfs
  • python313Packages.aliyun-python-sdk-core
  • python314Packages.aliyun-python-sdk-sts
  • python314Packages.aliyun-python-sdk-kms
  • python314Packages.aliyun-python-sdk-iot
  • python314Packages.aliyun-python-sdk-cdn
  • python313Packages.aliyun-python-sdk-sts
  • python313Packages.aliyun-python-sdk-kms
  • python313Packages.aliyun-python-sdk-iot
  • python313Packages.aliyun-python-sdk-cdn
  • python313Packages.bce-python-sdk
  • python314Packages.bce-python-sdk
  1 day, 2 hours ago
• @erictapen accepted 1 day, 2 hours ago
• @erictapen published on GitHub 1 day, 2 hours ago

MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal

• https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-jpw9-pfvf-9f58 x_refsource_CONFIRM
• https://github.com/modelcontextprotocol/python-sdk/pull/2690 x_refsource_MISC
• https://github.com/modelcontextprotocol/python-sdk/pull/2719 x_refsource_MISC
• https://github.com/modelcontextprotocol/python-sdk/commit/1abcca2408a6b50e10ec601181f63f9978705c00 x_refsource_MISC
• https://github.com/modelcontextprotocol/python-sdk/commit/ce267b6fc515dc4efc1dc70b6975b16ff0feef0a x_refsource_MISC
• https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.27.2 x_refsource_MISC

---

python-sdk

• ==< 1.27.2

Affects python3Packages.mcp