CVE-2026-109302 Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Schema Disclosure via Persisted Queries

Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 applies its GraphQL introspection control only to operation text sent directly with a request, not to operations resolved from Apollo Server's automatic persisted query cache. Unauthenticated attackers holding the public Applicatio...

CVE-2026-92681

The @neo4j/graphql library (versions up to and including 7.6.3 ) contains a vulnerability where @authentication directives applied at the schema level or on Query/Mutation types are ignored for top-level fields annotated with @cypher . This occurs because only directives placed directly on indivi...

CVE-2026-108810

A security flaw has been discovered in tsi-coop tsi-dpdp-cms 0.5.0/0.5.1/0.5.2. Impacted is an unknown function of the component JSON Schema Validation. The manipulation of the argument func results in information disclosure. The attack can be executed remotely. The exploit has been released to t...

CVE-2026-108810

The tsi-coop tsi-dpdp-cms software (versions 0.5.0 , 0.5.1 , and 0.5.2 ) is vulnerable to an information disclosure flaw within the JSON Schema Validation component. The root cause is the improper handling of the _func argument, which allows an unauthenticated remote attacker to execute the attac...

CVE-2026-108810 tsi-coop tsi-dpdp-cms JSON Schema Validation information disclosure

A security flaw has been discovered in tsi-coop tsi-dpdp-cms 0.5.0/0.5.1/0.5.2. Impacted is an unknown function of the component JSON Schema Validation. The manipulation of the argument func results in information disclosure. The attack can be executed remotely. The exploit has been released to t...

EUVD-2026-97283

A security flaw has been discovered in tsi-coop tsi-dpdp-cms 0.5.0/0.5.1/0.5.2. Impacted is an unknown function of the component JSON Schema Validation. The manipulation of the argument func results in information disclosure. The attack can be executed remotely. The exploit has been released to t...

CVE-2026-108810 tsi-coop tsi-dpdp-cms JSON Schema Validation information disclosure

A security flaw has been discovered in tsi-coop tsi-dpdp-cms 0.5.0/0.5.1/0.5.2. Impacted is an unknown function of the component JSON Schema Validation. The manipulation of the argument func results in information disclosure. The attack can be executed remotely. The exploit has been released to t...

PT-2026-110494

Name of the Vulnerable Software and Affected Versions tsi-coop tsi-dpdp-cms versions 0.5.0 through 0.5.2 Description A flaw in the JSON Schema Validation component allows remote information disclosure. This occurs through the manipulation of the func argument. Recommendations Upgrade tsi-coop...

CVE-2026-108810: Exposure of Sensitive Information to an Unauthorized Actor

A security flaw has been discovered in tsi-coop tsi-dpdp-cms 0.5.0/0.5.1/0.5.2. Impacted is an unknown function of the component JSON Schema Validation. The manipulation of the argument func results in information disclosure. The attack can be executed remotely. The exploit has been released to t...

CVE-2026-18513: Improper Privilege Management

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom Resource Definition...

CVE-2025-54554

CVE-2025-54554 CVE-2025-54554 – Unauthenticated Access in tiaudit REST API leading to Sensitive Information Disclosure Discoverer: Amanpreet Parmar | Sr. Security Engineer @Harvard Medical School Summary: CVE-2025-54554 identifies a vulnerability in the tiaudit component of the ticrypt platform,...

CVE-2025-27407

CVE-2025-27407 GitLab Podman Lab Minimal local-only lab for proving the GitLab Direct Transfer HTTP path reaches the vulnerable graphql-ruby introspection schema loader. The lab runs one vulnerable GitLab CE container; the PoC script starts its fake GitLab source server in-process only while...

pbtk

pbtk - Ingeniería inversa de aplicaciones Protobuf Protobuf es un formato de serialización desarrollado por Google y utilizado en un número creciente de aplicaciones Android, web, de escritorio y más. Consiste en un lenguaje para declarar estructuras de datos , que luego se compila a código u otr...

airflowscan

airflowscan Lista de verificación y herramientas para aumentar la seguridad de Apache Airflow. AVISO Este proyecto NO ESTÁ AFILIADO con la Apache Foundation ni con el proyecto Airflow, y no cuenta con su respaldo. Contenido El propósito de este proyecto es proporcionar herramientas para aumentar ...

graphicator

Graphicator Graphicator es un "scraper" / extractor de GraphQL. La herramienta itera sobre el documento de introspection devuelto por el endpoint de GraphQL objetivo, y luego reestructura el esquema en una forma interna para poder recrear las consultas soportadas. Cuando se crean dichas consultas...

CVE-2026-52130

A flaw was found in llama.cpp. This vulnerability, caused by uncontrolled recursion in the common/json-schema-to-grammar.cpp component, allows an attacker to trigger a denial of service. This can lead to the affected system becoming unresponsive or unavailable. Mitigation Restrict or disable API...

PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface

Summary PraisonAI's MCP HTTP-stream server authenticates requests only when an API key is configured; the CLI defaults --api-key to None, so praisonai mcp serve --transport http-stream exposes the full MCP surface unauthenticated. A request with no Authorization and no Origin can initialize and...

GHSA-HC5V-GXVJ-58WH PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface

Summary PraisonAI's MCP HTTP-stream server authenticates requests only when an API key is configured; the CLI defaults --api-key to None, so praisonai mcp serve --transport http-stream exposes the full MCP surface unauthenticated. A request with no Authorization and no Origin can initialize and...

CVE-2026-88257: Improper Input Validation

Improper Input Validation vulnerability in BeamMCP.Schema in ScriptKittyOS beammcp allows an MCP client to reach a tool's dispatch function with arguments that violate the input schema the server advertised. BeamMCP.Schema.validate/2 checked type, required, additionalProperties, enum and numeric...

PT-2026-108715

Name of the Vulnerable Software and Affected Versions praisonai version 4.6.63 Description The MCP HTTP-stream server fails to enforce authentication by default because the --api-key CLI argument defaults to None. This allows unauthenticated requests to the /mcp endpoint, enabling attackers to...