{"items":[{"id":"CVE-2026-53507","published":"2026-08-31T18:57:41.097Z","updated":"2026-09-01T14:46:09.533Z","title":"oasdiff actions resolve external $refs by default, enabling SSRF and disclosure of structured files on pull-request runs","severity":"HIGH","score":8.3,"vendor":"oasdiff","product":"oasdiff-action","kev":false,"epss":0.00496,"kevAdded":null,"exploit":false},{"id":"CVE-2026-53508","published":"2026-08-31T18:52:12.213Z","updated":"2026-08-31T18:58:08.849Z","title":"oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read)","severity":"MEDIUM","score":6,"vendor":"oasdiff","product":"oasdiff","kev":false,"epss":0.005,"kevAdded":null,"exploit":false}]}