D-Link多款产品 访问控制错误漏洞

D-Link DNS-320, etc., are products of D-Link Corporation from China. The D-Link DNS-320 is a NAS Network Attached Storage device. The D-Link DNS-325 is also a NAS device. The D-Link DNS-120 is a network storage adapter. Several D-Link products have vulnerabilities related to access control, which...

D-Link多款产品 命令注入漏洞

D-Link DNS-320, etc., are products of D-Link Corporation from China. The D-Link DNS-320 is a NAS Network Attached Storage device. The D-Link DNS-120 is a network storage adapter. The D-Link DNS-315L is a network attached storage device. Several D-Link products have command injection...

Lean 4 VS Code Extension 安全漏洞

Lean 4 VS Code Extension is an open-source extension for VS Code. Versions of Lean 4 VS Code Extension 0.1.9 and earlier contain security vulnerabilities. These vulnerabilities stem from the @leanprover/unicode-input-component component reinserting text from input elements as unescaped HTML, whic...

[SECURITY] Fedora 43 Update: easyrpg-player-0.8.1.1-4.fc43

EasyRPG Player is a game interpreter for RPG Maker 2000/2003 and EasyRPG game s. To play a game, run the "easyrpg-player" executable inside a RPG Maker 2000/2003 game project folder same place as RPGRT.exe...

TencentOS Server 4: java-11-konajdk (TSSA-2026:0143)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0143 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

EUVD-2026-10866

Parse Server vulnerable to stored cross-site scripting XSS via SVG file upload...

CVE-2025-4207 affecting package rust for versions less than 1.90.0-4

CVE-2025-4207 affecting package rust for versions less than 1.90.0-4. A patched version of the package is available...

CVE-2025-58190 affecting package cri-tools for versions less than 1.32.0-4

CVE-2025-58190 affecting package cri-tools for versions less than 1.32.0-4. A patched version of the package is available...

CVE-2025-55159 affecting package rust for versions less than 1.90.0-4

CVE-2025-55159 affecting package rust for versions less than 1.90.0-4. A patched version of the package is available...

CVE-2025-58160 affecting package rust for versions less than 1.90.0-4

CVE-2025-58160 affecting package rust for versions less than 1.90.0-4. A patched version of the package is available...

CVE-2026-24116 affecting package rust for versions less than 1.90.0-4

CVE-2026-24116 affecting package rust for versions less than 1.90.0-4. A patched version of the package is available...

CVE-2025-68114 affecting package rust for versions less than 1.90.0-4

CVE-2025-68114 affecting package rust for versions less than 1.90.0-4. A patched version of the package is available...

CVE-2025-67873 affecting package rust for versions less than 1.90.0-4

CVE-2025-67873 affecting package rust for versions less than 1.90.0-4. A patched version of the package is available...

PT-2026-24426

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 9.5.2-alpha.4 Parse Server versions prior to 8.6.17 Description Parse Server, an open source backend deployable on Node.js infrastructures, contains a stored cross-site scripting XSS issue. Authenticated users ca...

CVE-2026-30229 Parse Server: Endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.6 and 9.5.0-alpha.4, the readOnlyMasterKey can call POST /loginAs to obtain a valid session token for any user. This allows a read-only credential to impersonate arbitrary...

CVE-2026-30229 Parse Server: Endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.6 and 9.5.0-alpha.4, the readOnlyMasterKey can call POST /loginAs to obtain a valid session token for any user. This allows a read-only credential to impersonate arbitrary...

Incorrect Authorization

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Incorrect Authorization via the /loginAs endpoint when using the readOnlyMasterKey credential. An attacker can impersonate...

PT-2026-23753

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.6 Parse Server versions prior to 9.5.0-alpha.4 Description Parse Server is an open-source backend deployable on Node.js infrastructures. A read-only master key can be used to call the POST /loginAs API...

The vulnerability of the pgAdmin 4 database management tool, related to access control errors, allows attackers to execute arbitrary commands.

The vulnerability of the pgAdmin 4 database management tool is related to access control errors. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

TencentOS Server 4: python-jwt (TSSA-2026:0119)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0119 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...