{"vulnerability": "CVE-2026-5469", "sightings": [{"uuid": "32d7216c-d0d3-42ef-a7ad-8fdee6bd904d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5469", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mim726pmpr2i", "content": "", "creation_timestamp": "2026-04-03T17:00:16.790004Z"}, {"uuid": "e17d2848-5346-4f9c-b3d5-7f91a21d4974", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54695", "type": "published-proof-of-concept", "source": "https://github.com/pipecat-ai/pipecat/security/advisories/GHSA-j8cv-x86q-rj85", "content": "", "creation_timestamp": "2026-06-17T14:39:37.000000Z"}, {"uuid": "836b0551-06fe-4ff1-aee2-b5fcaa985a73", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54696", "type": "seen", "source": "https://bsky.app/profile/selfhost.directory/post/3mpxp77o4qh2i", "content": "\ud83d\ude80 New #release \u00b7 fizzy fizzy@90a244a\n\nWhat's Changed\n\u2022 Add fizzy_solid_cache_* metrics via vendored Yabeda exporter by @rosa in #2958\n\u2022 Bump json to 2.20.0 (CVE-2026-54696) by @rosa in #2962\nF\u2026\n\nCheck and #self-host it \u2192 selfhost.directory/project/fizzy#update-2781027\n\n#selfhost #selfhosted #homelab", "creation_timestamp": "2026-07-06T08:45:04.820622Z"}, {"uuid": "25518e06-194d-43d3-b623-e89d41fd9b09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54696", "type": "seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mpy25hakdu25", "content": "\n\ud83d\udea8 New LOW CVE detected in AWS Lambda \ud83d\udea8\nCVE-2026-54696 impacts json in 3 Lambda base images.\n\nDetails: https://github.com/aws/aws-lambda-base-images/issues/587\nMore: https://lambdawatchdog.com/\n\n#AWS #Lambda #CVE #CloudSecurity #Serverless", "creation_timestamp": "2026-07-06T12:00:55.874257Z"}, {"uuid": "70b5fb6a-f9be-429a-a0d2-fc39efff6688", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54695", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqahs45ntd2x", "content": "CVE-2026-54695 - Pipecat: Telephony WebSocket `/ws` Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID\nCVE ID : CVE-2026-54695\n \n Published : July 9, 2026, 7:17 p.m. | 31\u00a0minutes ago\n \n Description : Pipecat is an open-source Python framework for building real-t...", "creation_timestamp": "2026-07-09T20:26:25.536708Z"}, {"uuid": "19681bfe-ebb4-45a6-8c58-ecf4043a208c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54696", "type": "published-proof-of-concept", "source": "https://github.com/ruby/json/security/advisories/GHSA-x2f5-4prf-w687", "content": "", "creation_timestamp": "2026-07-23T20:35:04.536251Z"}, {"uuid": "912daae4-3b02-4ac6-b40a-ef5260892103", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54690", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-954p-556p-r752", "content": "", "creation_timestamp": "2026-07-28T22:35:16.020275Z"}, {"uuid": "55e9636c-75f3-4df0-9225-accaeec7b4b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54691", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-rfr2-mq9m-x2qx", "content": "", "creation_timestamp": "2026-07-28T22:35:29.797567Z"}, {"uuid": "0d665067-9fae-4b34-830a-80b91a92956e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54691", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mrqilt74cs24", "content": "CVE-2026-54691 - datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects\nCVE ID : CVE-2026-54691\n \n Published : July 28, 2026, 10:17 p.m. | 20\u00a0minutes ago\n \n Description : datamodel-code-generator generates Python data models from schema...", "creation_timestamp": "2026-07-28T22:48:36.068237Z"}, {"uuid": "19169364-c27d-4e76-bd3a-6af42fb5788f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54690", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mrqkdikp762b", "content": "CVE-2026-54690 - datamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default)\nCVE ID : CVE-2026-54690\n \n Published : July 28, 2026, 10:17 p.m. | 20\u00a0minutes ago\n \n Description : datamodel-code-generator generates Pydantic v2 models, datacla...", "creation_timestamp": "2026-07-28T23:19:44.069102Z"}, {"uuid": "daa7a92f-17c9-4c84-95df-08d78f617176", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54690", "type": "seen", "source": "https://gist.github.com/alon710/6612cc2025e5b81484a44c804b090d50", "content": "# CVE-2026-54690: CVE-2026-54690: Server-Side Request Forgery in datamodel-code-generator Remote Schema Resolution\n\n> **CVSS Score:** 8.2\n> **Published:** 2026-07-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54690\n\n## Summary\nCVE-2026-54690 (GHSA-954p-556p-r752) is a Server-Side Request Forgery (SSRF) vulnerability in the datamodel-code-generator Python library from version 0.9.1 to 0.61.0. The library silently resolves remote JSON Schema references ($ref) over HTTP/HTTPS without verifying the target hosts or IP addresses. Because it automatically follows redirects and permits requests to local and private networks by default, an attacker can submit a crafted schema to trigger connections to internal subnets, localhost, or cloud metadata endpoints. Retrieved sensitive data is subsequently parsed and reflected in the generated Python model files, resulting in local and private data disclosure.\n\n## TL;DR\nA Server-Side Request Forgery (SSRF) flaw in datamodel-code-generator allows remote attackers to read sensitive internal network and host configurations (such as cloud instance metadata) by submitting schemas containing malicious remote references.\n\n## Technical Details\n\n- **CWE ID**: CWE-918\n- **Attack Vector**: Network\n- **CVSS Base Score**: 8.2 (High)\n- **Exploit Status**: PoC Available\n- **Affected Versions**: >= 0.9.1, < 0.61.0\n- **Mitigation Option**: Upgrade to 0.61.0 or disable remote references\n\n## Affected Systems\n\n- datamodel-code-generator\n\n## Mitigation\n\n- Upgrade datamodel-code-generator to version 0.61.0 or higher to enforce private network validation by default.\n- Disable remote references globally using the CLI flag --no-allow-remote-refs or programmatic parameter allow_remote_refs=False.\n- Apply network-level egress filtering policies to isolate build pipelines and parser hosts from local network services and cloud metadata endpoints.\n\n**Remediation Steps:**\n1. Identify all internal systems and software dependencies using datamodel-code-generator.\n2. Update requirements.txt, poetry.lock, or Pipfile configurations to use datamodel-code-generator>=0.61.0.\n3. Verify that existing programmatic calls do not set allow_private_network=True unless parsing trusted internal schemas.\n4. Deploy container and egress network policies to block traffic to private subnets (RFC 1918) and loopbacks (127.0.0.0/8) from parser runtimes.\n\n## References\n\n- [NVD - CVE-2026-54690](https://nvd.nist.gov/vuln/detail/CVE-2026-54690)\n- [GitHub Security Advisory GHSA-954p-556p-r752](https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-954p-556p-r752)\n- [Fix Commit 5fdba4a09f2d7a9996a504975b7ef7d63e3715bb](https://github.com/koxudaxi/datamodel-code-generator/commit/5fdba4a09f2d7a9996a504975b7ef7d63e3715bb)\n- [datamodel-code-generator v0.61.0 Release Notes](https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.61.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54690) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-29T14:31:27.675189Z"}, {"uuid": "8326e003-3c2f-4deb-bcdb-fde18ede06dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54693", "type": "seen", "source": "https://gist.github.com/alon710/122d827ca97ab8457c12647e94a1482c", "content": "# CVE-2026-54693: CVE-2026-54693: Authorization Bypass in ZITADEL Identity Management Platform\n\n> **CVSS Score:** 8.2\n> **Published:** 2026-07-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54693\n\n## Summary\nA critical authorization bypass vulnerability was identified in the ZITADEL identity management platform, tracked as CVE-2026-54693 (GHSA-jq8w-8q2f-ffm9). Due to incorrect privilege validation in self-service profile modification endpoints, standard authenticated users could obtain plaintext verification codes during email or phone number updates. This allows attackers to claim and verify arbitrary email addresses or phone numbers without controlling the underlying contact methods.\n\n## TL;DR\nZITADEL allowed self-managing users to request plaintext verification OTPs in API responses by setting the returnCode parameter to true. Standard users could exploit this logic flaw to verify arbitrary email addresses and phone numbers without possessing actual access to the targeted out-of-band communication channel.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-863\n- **Attack Vector**: Network\n- **CVSS Score**: 8.2 (High)\n- **Exploit Status**: PoC\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- ZITADEL Identity Platform\n- **ZITADEL**: >= 2.43.0, < 2.71.19 (Fixed in: `2.71.19`)\n- **ZITADEL**: >= 3.0.0-rc.1, < 3.4.11 (Fixed in: `3.4.11`)\n- **ZITADEL**: >= 4.0.0-rc.1, < 4.15.1 (Fixed in: `4.15.1`)\n\n## Mitigation\n\n- Upgrade to a patched version of ZITADEL (v3.4.11 or v4.15.1).\n- Monitor API gateway logs for unauthorized use of the returnCode parameter in self-service endpoints.\n- Audit existing database and event store entries for anomalies in verification speeds.\n\n**Remediation Steps:**\n1. Identify the current running ZITADEL version and branch.\n2. Apply the update to version 3.4.11 (for v3) or 4.15.1 (for v4).\n3. Review the event store for suspicious patterns where email changes and email verifications occur within consecutive seconds.\n\n## References\n\n- [ZITADEL Security Advisory GHSA-jq8w-8q2f-ffm9](https://github.com/zitadel/zitadel/security/advisories/GHSA-jq8w-8q2f-ffm9)\n- [ZITADEL Release v3.4.11](https://github.com/zitadel/zitadel/releases/tag/v3.4.11)\n- [ZITADEL Release v4.15.1](https://github.com/zitadel/zitadel/releases/tag/v4.15.1)\n- [CVE-2026-54693 Record](https://www.cve.org/CVERecord?id=CVE-2026-54693)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54693) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-29T17:31:36.273455Z"}, {"uuid": "0a0cda1f-4a6b-4eac-95f4-5831327acf6a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54690", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mrsjjjptoa27", "content": "CVE-2026-54690 - SSRF in datamodel-code-generator. CVSS 8.2. Attacker-controlled JSON Schema refs can trigger server-side request forgery. No patch available. Mitigate by restricting remote refs. #CVE #infosec #cybersecurity\n\nhttps://www.valtersit.com/cve/CVE-2026-54690/", "creation_timestamp": "2026-07-29T18:10:32.330227Z"}, {"uuid": "1433c546-9c41-451a-a0f9-34932ec667eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54690", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mrsjjki2ag2o", "content": "CVE-2026-54690 - SSRF in datamodel-code-generator. CVSS 8.2. Attacker-controlled JSON Schema refs can trigger server-side request forgery. No patch available. Mitigate by restricting remote refs. #CVE #infosec #potatosecurity\n\nhttps://www.valtersit.com/cve/CVE-2026-54690/", "creation_timestamp": "2026-07-29T18:10:33.135012Z"}, {"uuid": "3ddcc269-c68c-4386-bbec-b3b060dcf2c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54693", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mrsjxpyzb222", "content": "CVE-2026-54693 - ZITADEL Users Can Self-Verify Email/Phone via API\nCVE ID : CVE-2026-54693\n \n Published : July 29, 2026, 5:16 p.m. | 27\u00a0minutes ago\n \n Description : ZITADEL is an open source identity management platform. From 2.43.0 through 2.71.19, from 3.0.0 until 3.4.11, an...", "creation_timestamp": "2026-07-29T18:18:28.546592Z"}]}