Parse Server is an open-source backend server. In versions >= 9.0.0 < 9.10.1-alpha.10 and >= 8.0...
CVE-2026-101042
Parse Server is an open-source backend server. In versions >= 9.0.0 = 8.0.2 < 8.6.91, the code-based authentication adap
#advisory
共收录 23312 条相关情报。
← 返回所有主题pacquet, the Rust package-manager component shipped in the pnpm npm package versions >=12.0.0...
CVE-2026-101044
pacquet, the Rust package-manager component shipped in the pnpm npm package versions >=12.0.0-alpha.0 and <12.0.0-alpha.
pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} environment-variable...
CVE-2026-101043
pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} environment-variable placeholders in the htt
Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook...
CVE-2026-101050
Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credent
Heym before 0.0.53 fails to verify Slack request signatures when trigger nodes lack credential...
CVE-2026-101049
Heym before 0.0.53 fails to verify Slack request signatures when trigger nodes lack credential IDs or have empty signing
Cloudreve before 4.16.1 Authentication Bypass via Cached Context Hint
CVE-2026-101056
Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a context_hint UUID.
Cloudreve before 4.16.1 Path Traversal via Remote Download
CVE-2026-101051
Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated use
Cloudreve before 4.17.0 SSRF via Admin.Read OAuth scope
CVE-2026-101048
Cloudreve before 4.17.0 registers the administrative node test endpoints (POST /api/v4/admin/node/test and POST /api/v4/
Fleet before 4.87.0 Unauthenticated iOS App Download via Predictable URLs
CVE-2026-101047
Fleet before 4.87.0 does not protect the two endpoints that serve in-house iOS application packages and manifests (enter
Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endpoints
CVE-2026-101046
Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints (GET /api/v1/fleet/activities
pnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy Settings
CVE-2026-101043
pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} environment-variable placeholders in the htt
Heym before 0.0.53 Authentication Bypass via Telegram Webhook
CVE-2026-100865 · CVE-2026-101049 · CVE-2026-101050
Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credent
Heym before 0.0.53 Slack Webhook Signature Verification Bypass
CVE-2026-100865 · CVE-2026-101050 · CVE-2026-101049
Heym before 0.0.53 fails to verify Slack request signatures when trigger nodes lack credential IDs or have empty signing
Parse Server 9.0.0 Authentication Bypass via Unverified Provider Identity
CVE-2026-101042
Parse Server is an open-source backend server. In versions >= 9.0.0 = 8.0.2 < 8.6.91, the code-based authentication adap
The account recovery (password reset) functionality in the vulnerability-lookup web application...
CVE-2026-101041
The account recovery (password reset) functionality in the vulnerability-lookup web application contains a time-of-check
Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall...
CVE-2026-100871
Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT token
Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API...
CVE-2026-100869
Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing cust
Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart...
CVE-2026-100872
Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthentic
Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces...
CVE-2026-100868
Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in si
KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in...
CVE-2026-101033
KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operati