Lean 4 VS Code Extension 安全漏洞

Lean 4 VS Code Extension is an open-source extension for VS Code. Versions of Lean 4 VS Code Extension 0.1.9 and earlier contain security vulnerabilities. These vulnerabilities stem from the @leanprover/unicode-input-component component reinserting text from input elements as unescaped HTML, whic...

CVE-2026-32732: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Lean 4 VS Code Extension is a Visual Studio Code extension for the Lean 4 proof assistant. Projects that use @leanprover/unicode-input-component are vulnerable to an XSS exploit in 0.1.9 of the package and lower. The component re-inserted text in the input element back into the input element as...

[SECURITY] Fedora 43 Update: easyrpg-player-0.8.1.1-4.fc43

EasyRPG Player is a game interpreter for RPG Maker 2000/2003 and EasyRPG game s. To play a game, run the "easyrpg-player" executable inside a RPG Maker 2000/2003 game project folder same place as RPGRT.exe...

TencentOS Server 4: java-11-konajdk (TSSA-2026:0143)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0143 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

EUVD-2026-10866

Parse Server vulnerable to stored cross-site scripting XSS via SVG file upload...

CVE-2025-4207 affecting package rust for versions less than 1.90.0-4

CVE-2025-4207 affecting package rust for versions less than 1.90.0-4. A patched version of the package is available...

CVE-2025-58160 affecting package rust for versions less than 1.90.0-4

CVE-2025-58160 affecting package rust for versions less than 1.90.0-4. A patched version of the package is available...

CVE-2026-24116 affecting package rust for versions less than 1.90.0-4

CVE-2026-24116 affecting package rust for versions less than 1.90.0-4. A patched version of the package is available...

CVE-2025-58190 affecting package cri-tools for versions less than 1.32.0-4

CVE-2025-58190 affecting package cri-tools for versions less than 1.32.0-4. A patched version of the package is available...

CVE-2025-67873 affecting package rust for versions less than 1.90.0-4

CVE-2025-67873 affecting package rust for versions less than 1.90.0-4. A patched version of the package is available...

CVE-2025-68114 affecting package rust for versions less than 1.90.0-4

CVE-2025-68114 affecting package rust for versions less than 1.90.0-4. A patched version of the package is available...

CVE-2025-55159 affecting package rust for versions less than 1.90.0-4

CVE-2025-55159 affecting package rust for versions less than 1.90.0-4. A patched version of the package is available...

CVE-2026-30928: Exposure of Sensitive Information to an Unauthorized Actor

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, the /api/4/config REST API endpoint returns the entire parsed Glances configuration file glances.conf via self.config.asdict with no filtering of sensitive values. The configuration file contains credentials for all...

PT-2026-24426

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 9.5.2-alpha.4 Parse Server versions prior to 8.6.17 Description Parse Server, an open source backend deployable on Node.js infrastructures, contains a stored cross-site scripting XSS issue. Authenticated users ca...

CVE-2025-15547: Improper Privilege Management

By default, jailed processes cannot mount filesystems, including nullfs4. However, the allow.mount.nullfs option enables mounting nullfs filesystems, subject to privilege checks. If a privileged user within a jail is able to nullfs-mount directories, a limitation of the kernel's path lookup logic...

CVE-2026-30229 Parse Server: Endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.6 and 9.5.0-alpha.4, the readOnlyMasterKey can call POST /loginAs to obtain a valid session token for any user. This allows a read-only credential to impersonate arbitrary...

CVE-2026-30229 Parse Server: Endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.6 and 9.5.0-alpha.4, the readOnlyMasterKey can call POST /loginAs to obtain a valid session token for any user. This allows a read-only credential to impersonate arbitrary...

Incorrect Authorization

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Incorrect Authorization via the /loginAs endpoint when using the readOnlyMasterKey credential. An attacker can impersonate...

TencentOS Server 4: python-jwt (TSSA-2026:0119)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0119 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

PT-2026-23753

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.6 Parse Server versions prior to 9.5.0-alpha.4 Description Parse Server is an open-source backend deployable on Node.js infrastructures. A read-only master key can be used to call the POST /loginAs API...