Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-c6vm-cher-akb3
Vulnerability ID VCID-c6vm-cher-akb3
Aliases CVE-2026-27953
GHSA-f964-whrq-44h8
Summary
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-20 Improper Input Validation
CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00489 https://api.first.org/data/v1/epss?cve=CVE-2026-27953
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-f964-whrq-44h8
cvssv3.1 7.1 https://github.com/ormar-orm/ormar
generic_textual HIGH https://github.com/ormar-orm/ormar
cvssv3.1 7.1 https://github.com/ormar-orm/ormar/blob/master/examples/fastapi_quick_start.py#L55
generic_textual HIGH https://github.com/ormar-orm/ormar/blob/master/examples/fastapi_quick_start.py#L55
ssvc Track https://github.com/ormar-orm/ormar/blob/master/examples/fastapi_quick_start.py#L55
cvssv3.1 7.1 https://github.com/ormar-orm/ormar/blob/master/ormar/fields/foreign_key.py#L41
generic_textual HIGH https://github.com/ormar-orm/ormar/blob/master/ormar/fields/foreign_key.py#L41
ssvc Track https://github.com/ormar-orm/ormar/blob/master/ormar/fields/foreign_key.py#L41
cvssv3.1 7.1 https://github.com/ormar-orm/ormar/blob/master/ormar/models/helpers/pydantic.py#L108
generic_textual HIGH https://github.com/ormar-orm/ormar/blob/master/ormar/models/helpers/pydantic.py#L108
ssvc Track https://github.com/ormar-orm/ormar/blob/master/ormar/models/helpers/pydantic.py#L108
cvssv3.1 7.1 https://github.com/ormar-orm/ormar/blob/master/ormar/models/model.py#L89
generic_textual HIGH https://github.com/ormar-orm/ormar/blob/master/ormar/models/model.py#L89
ssvc Track https://github.com/ormar-orm/ormar/blob/master/ormar/models/model.py#L89
cvssv3.1 7.1 https://github.com/ormar-orm/ormar/blob/master/ormar/models/newbasemodel.py#L128
generic_textual HIGH https://github.com/ormar-orm/ormar/blob/master/ormar/models/newbasemodel.py#L128
ssvc Track https://github.com/ormar-orm/ormar/blob/master/ormar/models/newbasemodel.py#L128
cvssv3.1 7.1 https://github.com/ormar-orm/ormar/blob/master/ormar/models/newbasemodel.py#L292
generic_textual HIGH https://github.com/ormar-orm/ormar/blob/master/ormar/models/newbasemodel.py#L292
ssvc Track https://github.com/ormar-orm/ormar/blob/master/ormar/models/newbasemodel.py#L292
cvssv3.1 7.1 https://github.com/ormar-orm/ormar/commit/7f22aa21a7614b993970345b392dabb0ccde0ab3
generic_textual HIGH https://github.com/ormar-orm/ormar/commit/7f22aa21a7614b993970345b392dabb0ccde0ab3
ssvc Track https://github.com/ormar-orm/ormar/commit/7f22aa21a7614b993970345b392dabb0ccde0ab3
cvssv3.1 7.1 https://github.com/ormar-orm/ormar/releases/tag/0.23.1
generic_textual HIGH https://github.com/ormar-orm/ormar/releases/tag/0.23.1
ssvc Track https://github.com/ormar-orm/ormar/releases/tag/0.23.1
cvssv3.1 7.1 https://github.com/ormar-orm/ormar/security/advisories/GHSA-f964-whrq-44h8
cvssv3.1_qr HIGH https://github.com/ormar-orm/ormar/security/advisories/GHSA-f964-whrq-44h8
generic_textual HIGH https://github.com/ormar-orm/ormar/security/advisories/GHSA-f964-whrq-44h8
ssvc Track https://github.com/ormar-orm/ormar/security/advisories/GHSA-f964-whrq-44h8
cvssv3.1 7.1 https://nvd.nist.gov/vuln/detail/CVE-2026-27953
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2026-27953
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-27953
https://github.com/ormar-orm/ormar
https://github.com/ormar-orm/ormar/blob/master/examples/fastapi_quick_start.py#L55
https://github.com/ormar-orm/ormar/blob/master/ormar/fields/foreign_key.py#L41
https://github.com/ormar-orm/ormar/blob/master/ormar/models/helpers/pydantic.py#L108
https://github.com/ormar-orm/ormar/blob/master/ormar/models/model.py#L89
https://github.com/ormar-orm/ormar/blob/master/ormar/models/newbasemodel.py#L128
https://github.com/ormar-orm/ormar/blob/master/ormar/models/newbasemodel.py#L292
https://github.com/ormar-orm/ormar/commit/7f22aa21a7614b993970345b392dabb0ccde0ab3
https://github.com/ormar-orm/ormar/releases/tag/0.23.1
https://github.com/ormar-orm/ormar/security/advisories/GHSA-f964-whrq-44h8
https://nvd.nist.gov/vuln/detail/CVE-2026-27953
1131494 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1131494
GHSA-f964-whrq-44h8 https://github.com/advisories/GHSA-f964-whrq-44h8
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L Found at https://github.com/ormar-orm/ormar
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L Found at https://github.com/ormar-orm/ormar/blob/master/examples/fastapi_quick_start.py#L55
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-20T17:04:35Z/ Found at https://github.com/ormar-orm/ormar/blob/master/examples/fastapi_quick_start.py#L55
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L Found at https://github.com/ormar-orm/ormar/blob/master/ormar/fields/foreign_key.py#L41
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-20T17:04:35Z/ Found at https://github.com/ormar-orm/ormar/blob/master/ormar/fields/foreign_key.py#L41
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L Found at https://github.com/ormar-orm/ormar/blob/master/ormar/models/helpers/pydantic.py#L108
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-20T17:04:35Z/ Found at https://github.com/ormar-orm/ormar/blob/master/ormar/models/helpers/pydantic.py#L108
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L Found at https://github.com/ormar-orm/ormar/blob/master/ormar/models/model.py#L89
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-20T17:04:35Z/ Found at https://github.com/ormar-orm/ormar/blob/master/ormar/models/model.py#L89
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L Found at https://github.com/ormar-orm/ormar/blob/master/ormar/models/newbasemodel.py#L128
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-20T17:04:35Z/ Found at https://github.com/ormar-orm/ormar/blob/master/ormar/models/newbasemodel.py#L128
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L Found at https://github.com/ormar-orm/ormar/blob/master/ormar/models/newbasemodel.py#L292
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-20T17:04:35Z/ Found at https://github.com/ormar-orm/ormar/blob/master/ormar/models/newbasemodel.py#L292
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L Found at https://github.com/ormar-orm/ormar/commit/7f22aa21a7614b993970345b392dabb0ccde0ab3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-20T17:04:35Z/ Found at https://github.com/ormar-orm/ormar/commit/7f22aa21a7614b993970345b392dabb0ccde0ab3
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L Found at https://github.com/ormar-orm/ormar/releases/tag/0.23.1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-20T17:04:35Z/ Found at https://github.com/ormar-orm/ormar/releases/tag/0.23.1
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L Found at https://github.com/ormar-orm/ormar/security/advisories/GHSA-f964-whrq-44h8
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-20T17:04:35Z/ Found at https://github.com/ormar-orm/ormar/security/advisories/GHSA-f964-whrq-44h8
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L Found at https://nvd.nist.gov/vuln/detail/CVE-2026-27953
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.658
EPSS Score 0.00489
Published At May 30, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-30T23:06:45.706721+00:00 EPSS Importer Import https://epss.cyentia.com/epss_scores-current.csv.gz 38.6.0