https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 14 Oct 2026 15:14:07 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-10979 bdu:2026-10979 https://cve.radiocsirt.org/vuln/bdu:2026-10979 https://cve.radiocsirt.org/vuln/euvd-2026-318052 EUVD-2026-318052 https://cve.radiocsirt.org/vuln/euvd-2026-318052 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44262 <p>Scramble generates API documentation for Laravel project. From 0.13.2 to before 0.13.22, when documentation endpoints are publicly accessible and validation rules reference user-controlled input, request supplied data may be evaluated during documentation generation, leading to execution of arbitrary PHP code in the application context. This vulnerability is fixed in 0.13.22.</p> <p>Scramble generates API documentation for Laravel project. From 0.13.2 to before 0.13.22, when documentation endpoints are publicly accessible and validation rules reference user-controlled input, request supplied data may be evaluated during documentation generation, leading to execution of arbitrary PHP code in the application context. This vulnerability is fixed in 0.13.22.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-44262 https://cve.radiocsirt.org/vuln/ghsa-4rm2-28vj-fj39 <p><strong>Affected:</strong> Packagist: dedoc/scramble</p> <p>### Impact</p> <p>A remote code execution (RCE) vulnerability affects versions `0.13.2` through `0.13.21`. When documentation endpoints are publicly accessible and validation rules reference user-controlled input, request supplied data may be evaluated during documentation generation, leading to execution of arbitrary PHP code in the application context.</p> <p>### Patches</p> <p>Fixed in version `0.13.22`.</p> <p>### Workarounds</p> <p>If upgrading is not immediately possible:</p> <p>* Restrict access to documentation endpoints (`/docs/api`, `/docs/api.json`) * Avoid using user-controlled variables inside validation rule expressions (e.g., values derived from request input) * Disable documentation endpoints in production environments if not required</p> <p>These measures significantly reduce or prevent exploitability.</p> <p><strong>Affected:</strong> Packagist: dedoc/scramble</p> <p>### Impact</p> <p>A remote code execution (RCE) vulnerability affects versions `0.13.2` through `0.13.21`. When documentation endpoints are publicly accessible and validation rules reference user-controlled input, request supplied data may be evaluated during documentation generation, leading to execution of arbitrary PHP code in the application context.</p> <p>### Patches</p> <p>Fixed in version `0.13.22`.</p> <p>### Workarounds</p> <p>If upgrading is not immediately possible:</p> <p>* Restrict access to documentation endpoints (`/docs/api`, `/docs/api.json`) * Avoid using user-controlled variables inside validation rule expressions (e.g., values derived from request input) * Disable documentation endpoints in production environments if not required</p> <p>These measures significantly reduce or prevent exploitability.</p> https://cve.radiocsirt.org/vuln/ghsa-4rm2-28vj-fj39