@alessiodf/core-chameleon (0.0.1), @arkecosystem/core (>=3.0.0-alpha.0, <=3.13.0) +137 more potentially affected by CVE-2026-59879 via immutable (>=5.0.0, <=5.1.6)

immutable NPM version =5.0.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.6, =3.9.0-rc.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =9.1.1-ruixiang.1, =0.1.0, =1.0.6 and more Source cves: CVE-2026-59879 Source advisory: OSV:GHSA-V56Q-MH7H-F735...

@openinc/parse-server-opendash (>=4.0.0, <=4.1.2) potentially affected by CVE-2026-64627 via parse-server (>=9.6.0-alpha.37, <=9.9.1-alpha.13)

parse-server NPM version =9.6.0-alpha.37, =4.0.0, =4.1.2 Source cves: CVE-2026-64627 Source advisory: SNYK:JS-PARSESERVER-18306801...

Information Exposure

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Information Exposure via the GraphQL API when public introspection is disabled. An attacker can obtain hidden schema...

SUSE CVE-2026-14741

HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parsedate. parsedate matches the date string against a chain of alternative regexes, and str2time delegates to it. Several of these patterns place unbounded quantifiers next to each other before a...

SUSE-SU-2026:3148-1 Security update for wget

This update for wget fixes the following issues: - CVE-2026-15146: unvalidated IP address in an FTP PASV response can lead to server-side request forgery bsc1271320. - CVE-2026-58469: Metalink document containing a whitespace-only URL can cause a heap buffer underread bsc1271033. - CVE-2026-58470...

CVE-2026-64627

Parse Server versions = 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled graphQLPublicIntrospection: false, the default, schema-derived 'Did you mean ...?' suggestions were still...

CVE-2026-64627 Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion

Parse Server versions = 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled graphQLPublicIntrospection: false, the default, schema-derived 'Did you mean ...?' suggestions were still...

CVE-2026-64627 Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion

Parse Server versions = 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled graphQLPublicIntrospection: false, the default, schema-derived 'Did you mean ...?' suggestions were still...

CVE-2026-64627

Parse Server versions = 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled graphQLPublicIntrospection: false, the default, schema-derived 'Did you mean ...?' suggestions were still...

CVE-2026-64627

Parse Server versions 9.0.0–8.6.84/9.0.0–9.10.0-alpha.3 contain a schema disclosure vulnerability where, when GraphQL public introspection is disabled, error messages during variable coercion reveal hidden schema identifiers (e.g., Cloud Code function names, Parse class/field names) to an unauthe...

CVE-2026-64627 Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion

Parse Server versions = 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled graphQLPublicIntrospection: false, the default, schema-derived 'Did you mean ...?' suggestions were still...

EUVD-2026-46180

Parse Server versions = 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled graphQLPublicIntrospection: false, the default, schema-derived 'Did you mean ...?' suggestions were still...

EulerOS Virtualization 2.12.1 (EulerOS-SA-2026-2731)

According to the versions of the packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : In MIT Kerberos 5 aka krb5 before 1.22.3, there is a NULL pointer dereference if an application calls gssacceptseccontext on a system with...

CVE-2026-64627: Generation of Error Message Containing Sensitive Information

Parse Server versions = 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled graphQLPublicIntrospection: false, the default, schema-derived 'Did you mean ...?' suggestions were still...

The vulnerability in the parse_option() function of the if-options.c file of the DHCP server dhcpcd allows a attacker to execute arbitrary code or cause a service failure.

The vulnerability of the parseoption function in the if-options.c file is related to buffer overflows in dynamic memory. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the MediaInfoLib::File_Ogg::Data_Parse() function in the MediaInfoLib/Source/MediaInfo/File__Analyze.cpp library, which is used to parse metadata from MediaInfo files. This vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the MediaInfoLib::FileOgg::DataParse function in the MediaInfoLib/Source/MediaInfo/FileAnalyze.cpp library, which is used to process Ogg-formatted files, is related to buffer overflows in dynamic memory during the processing of specially crafted Ogg files. Exploitation of thi...

The vulnerability of the parse_option() function in the if-options.c file of the DHCP server dhcpcd allows a intruder to trigger a service denial.

The vulnerability of the parseoption function in the if-options.c file of the DHCP server dhcpcd is related to the pointer dereferencing. Exploiting this vulnerability could allow a attacker to trigger a service denial...

GHSA-395F-4HP3-45GV shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)

Summary shell-quote's parse finalizes its token list with a reduce that uses Array.prototype.concat as the accumulator. Each prev.concatarg copies the entire growing array, so parse runs in On² in the number of tokens. An unauthenticated attacker who can submit a string to any code path that call...

GHSA-G796-FGMG-93MV js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml

Impact This is the same report as for v3/v4, but with lower severity, because in v5, merge is off by default When merge keys 1s doc size 100K js import performance from 'node:perfhooks' import Buffer from 'node:buffer' import load, YAML11SCHEMA from 'js-yaml' const n = Numberprocess.argv2 || 4000...

GHSA-52CP-R559-CP3M js-yaml: YAML merge-key chains can force quadratic CPU consumption

Impact js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly. The issue is triggered by a chain of mappings where each mapping merges the previous one: yaml a0: &a0 k0: 0 a1: &a1 1s doc size 100K js import performance from 'node:perfhooks' import Buffer from...