Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: fastschema Clear all filters
TI-2026-50842 CVE-2026-72584 · GHSA-qm6j-5qpg-x2x4

fastschema - TOCTOU Race Condition Bypasses OTP Attempt Limit in Account Recovery

Priority LOW 35

A time-of-check/time-of-use (TOCTOU) race condition in fastschema through v0.15.1 allows an unauthenticated remote attacker to bypass the OTP attempt limit on the account recovery flow, enabling brute-force attacks on 6-…

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.0039 Published 2026-08-10 No fix listed CWE-367
TI-2026-50841 CVE-2026-72583 · GHSA-6vrh-w6p3-v6fh

fastschema - Stored Cross-Site Scripting via MIME Type Bypass in File Upload

Priority LOW 24

A stored cross-site scripting (XSS) vulnerability in fastschema through v0.15.1 allows a low-privileged authenticated user to upload an SVG file containing malicious JavaScript by bypassing the MIME type allow-list check…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00255 Published 2026-08-10 No fix listed CWE-79