Threat Intelligence Database
Comprehensive database of the latest cyber threats affecting organizations worldwide. Filter and search to find specific threat intelligence relevant to your organization.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threat Intelligence
Click on any threat for detailed analysis and mitigation recommendations
0 Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions 7.19.0 and below and 8.0.0-rc.0 through 8.0.2 allow untrusted OpenAPI specifications to inject arbitrary TypeScript/JavaScript into generated mock files via the const keyword on schema properties. These const values are interpolated into the mock scalar generator (getMockScalar in packages/mock/src/faker/getters/scalar.ts) without proper escaping or type-safe serialization, which results in attacker-controlled code being emitted into both interface definitions and faker/MSW handlers. The vulnerability is similar in impact to the previously reported enum x-enumDescriptions (GHSA-h526-wf6g-67jv), but it affects a different code path in the faker-based mock generator rather than @orval/core. The issue has been fixed in versions 7.20.0 and 8.0.3. Join the discussion | CVE Database V5 | 01/22/2026, 23:47:45 UTC Added: 01/23/2026, 19:09:44 UTC |
0 CVE-2026-23947 is a critical command injection vulnerability in orval, a tool generating type-safe TypeScript clients from OpenAPI/Swagger specs. Versions prior to 7.19.0 and between 8.0.0-rc.0 and 8.0.2 are affected. The flaw allows untrusted OpenAPI specifications to inject arbitrary JavaScript/TypeScript code via the x-enumDescriptions field, which is embedded without proper escaping during enum generation. Join the discussion | CVE Database V5 | 01/20/2026, 00:19:48 UTC Added: 01/20/2026, 00:50:56 UTC |
0 orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Prior to 7.18.0, the MCP server generation logic relies on string manipulation that incorporates the summary field from the OpenAPI specification without proper validation or escaping. This allows an attacker to "break out" of the string literal and inject arbitrary code. This vulnerability is fixed in 7.18.0. Join the discussion | CVE Database V5 | 01/12/2026, 18:43:16 UTC Added: 01/12/2026, 18:53:46 UTC |
Showing 1 to 3 of 3 results