漏洞公告

@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution

td has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.Decode

goshs has a Path Traversal issue

goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite

goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx)

goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)

`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field

datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs`

`datamodel-code-generator` vulnerable to code injection in via attacker-controlled `default_factory` schema field

datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding

`datamodel-code-generator` vulnerable to code execution on import via unescaped `validators` entries in --extra-template-data

datamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default)

datamodel-code-generator vulnerable to code injection via `x-python-import` / `customTypePath` in generated import statements

`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description

`datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generator

datamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemas

datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects

datamodel-code-generator vulnerable to arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate

Microsoft Security Advisory CVE-2026-32203 – .NET and Visual Studio Denial of Service Vulnerability

NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass

Cosmos-Server has an authentication bypass via forward-auth header smuggling on Constellation tunnel

Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokens

Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape