Critical
CVE-2026-62681
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 19
Reset filters
Critical
CVE-2026-62682
Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)
Critical
CVE-2026-72717
Orval: Import-time RCE via schema default -> zod module-level template literal
Critical
CVE-2026-71869
Orval: Import-time RCE via array-items default -> zod module-level template literal
Critical
CVE-2026-71871
Orval: Import-time RCE via header-parameter default -> zod module-level template literal
Critical
CVE-2026-71867
Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator
Critical
CVE-2026-71868
Orval: Import-time RCE via enum-typed default -> zod module-level template literal
Critical
CVE-2026-71865
Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli
Critical
CVE-2026-71864
Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client
High
CVE-2026-62680
Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
Critical
CVE-2026-72716
Orval: Import-time RCE via query-parameter default -> zod module-level template literal
Critical
CVE-2026-71866
Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client
High
CVE-2026-58263
Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier
Medium
CVE-2026-62324
Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS
Medium
CVE-2026-82865
PDFME has XSS via Unsanitized i18n Label Injection into innerHTML in multiVariableText propPanel
Critical
CVE-2026-25141
Orval has Code Injection via unsanitized x-enum-descriptions using JS comments
High
CVE-2026-24132
Orval Mock Generation Code Injection via const
Critical
CVE-2026-23947
Orval has a code injection via unsanitized x-enum-descriptions in enum generation
Critical
CVE-2026-22785
orval MCP client is vulnerable to a code injection attack.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.