Insufficiently Protected Credentials

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the OAuth2 authentication process when the useridField option is not set. An attacke...

Oracle Linux 9 : python3.12 (ELSA-2026-4165)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-4165 advisory. 3.12.12-4.0.1.el97.1 - Remove upstream URL reference 3.12.12-4.1 - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299...

AlmaLinux 9 : python3.12 (ALSA-2026:4165)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:4165 advisory. cpython: IMAP command injection in user-controlled commands CVE-2025-15366 cpython: POP3 command injection in user-controlled commands CVE-2025-15367...

AlmaLinux 9 : postgresql:15 (ALSA-2026:3896)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:3896 advisory. postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code CVE-2026-2006 postgresql: PostgreSQL intarray missing...

AlmaLinux 9 : nginx:1.26 (ALSA-2026:4235)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:4235 advisory. nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections CVE-2026-1642 Tenable has extracted the preceding description block directly...

AlmaLinux 9 : kernel (ALSA-2026:3966)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:3966 advisory. kernel: Linux kernel iouring: Local privilege escalation, information disclosure, or denial of service via use-after-free CVE-2025-38106 kernel: macvlan:...

RockyLinux 9 : opentelemetry-collector (RLSA-2026:4177)

The remote RockyLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2026:4177 advisory. golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61726 crypto/tls: Unexpected session resumption in crypto/tls...

AlmaLinux 9 : gimp (ALSA-2026:4173)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:4173 advisory. gimp: GIMP: Remote code execution via heap-based buffer overflow in ICNS file parsing CVE-2026-2047 gimp: GIMP: Remote Code Execution via uninitialized...

CVE-2025-11065 affecting package vitess for versions less than 19.0.4-9

CVE-2025-11065 affecting package vitess for versions less than 19.0.4-9. A patched version of the package is available...

CVE-2025-8732 affecting package libxml2 for versions less than 2.11.5-9

CVE-2025-8732 affecting package libxml2 for versions less than 2.11.5-9. A patched version of the package is available...

CVE-2026-0990 affecting package libxml2 for versions less than 2.11.5-9

CVE-2026-0990 affecting package libxml2 for versions less than 2.11.5-9. A patched version of the package is available...

CVE-2026-0992 affecting package libxml2 for versions less than 2.11.5-9

CVE-2026-0992 affecting package libxml2 for versions less than 2.11.5-9. A patched version of the package is available...

postgresql:16 security update

An update is available for pgrepack, module.pgvector, pgaudit, module.postgis, postgis, pgvector, module.postgres-decoderbufs, module.pgaudit, postgresql, module.pgrepack, postgres-decoderbufs, module.postgresql. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base...

RockyLinux 9 : nfs-utils (RLSA-2026:3940)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:3940 advisory. nfs-utils: rpc.mountd in the nfs-utils privilege escalation CVE-2025-12801 Tenable has extracted the preceding description block directly from the RockyLinux...

Oracle Linux 9 : postgresql:16 (ELSA-2026-4110)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-4110 advisory. pgaudit 16.0-1 - Update to 16.0 - Support postgresql 16 - Initial import for PG 16 module - Resolves: RHEL-3635 pgrepack 1.5.1-1 - Update to v1.5.1...

EUVD-2026-10170

Parse Server: File metadata endpoint bypasses beforeFind / afterFind trigger authorization...

Security Risk Advisors Releases “The Purple Perspective 2026” Report

Philadelphia, PA, United States, 9th March 2026, CyberNewswire...

CVE-2026-30850

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.9 and 9.5.0-alpha.9, the file metadata endpoint GET /files/:appId/metadata/:filename does not enforce beforeFind / afterFind file triggers. When these triggers are used as...

CVE-2025-70033

creationtimestamp| type| source ---|---|--- 2026-03-09 05:39:42+00:00| seen| https://gist.github.com/zcxlighthouse/5036e0ea5a40146fb5051d7a94252857...

Oracle Linux 9 : postgresql:15 (ELSA-2026-3896)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-3896 advisory. pgaudit 1.7.0-1 - Initial import for postgresql 15 module - Update to 1.7.0 - Support postgresql 15 - Related: 2128410 pgrepack 1.4.8-2 - Add new build...