tag
Orm
Critical
Django QuerySet/Q Object SQL Injection via `_connector` Kwarg (CVE-2025-64459)
CVE-2025-64459·
Django ORM (QuerySet.filter() / Q object construction)
patched
High
Sequelize ORM JSON Cast SQL Injection — CVE-2026-30951
CVE-2026-30951·
Sequelize ORM v6 (Node.js)
patched
Critical
Ormar ORM SQL Injection via min()/max() Aggregate Methods (CVE-2026-26198)
CVE-2026-26198 (GHSA-xxh2-68g9-8jqr)·
Ormar (async Python ORM, commonly used with FastAPI/Starlette)
patched
High
MikroORM Custom Type Raw SQL Injection (CVE-2026-34220)
CVE-2026-34220·
MikroORM (Node.js/TypeScript ORM)
patched