829 matches found
Server-side Request Forgery (SSRF)
Overview @frontmcp/adapters is an Adapters for the FrontMCP framework Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the initialize process. An attacker can access internal network resources or sensitive local files by submitting a crafted OpenAPI...
@frontmcp/adapters (>=0.5.0, <=1.0.3), frontmcp (0.5.0) potentially affected by CVE-2026-39885 via mcp-from-openapi (>=2.0.0, <=2.1.2)
mcp-from-openapi NPM version =2.0.0, =0.5.0, =1.0.3 - frontmcp 0.5.0 Source cves: CVE-2026-39885 Source advisory: OSV:GHSA-V6PH-XCQ9-QXXJ...
BIT-PARSE-2026-35200 Parse Server has a file upload Content-Type override via extension mismatch
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.73 and 9.7.1, a file can be uploaded with a filename extension that passes the file extension allowlist e.g., .txt but with a Content-Type header that differs from the extension...
Content-Type Override
Parse Server is vulnerable to Content-Type Override. The vulnerability is due to missing consistency validation between the file extension and the provided Content-Type header, where the Content-Type is passed unchanged to storage adapters that serve files based on this header, allowing an attack...
CVE-2026-35200
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.73 and 9.7.1-alpha.4, a file can be uploaded with a filename extension that passes the file extension allowlist e.g., .txt but with a Content-Type header that differs from the...
aaa-ml-datasets-course (1.0.0), adapters (>=0.2.0, <=0.2.1) +53 more potentially affected by CVE-2026-1839 via transformers (4.39.3)
transformers PYPI version 4.39.3 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - aaa-ml-datasets-course 1.0.0 - adapters =0.2.0, =0.1.0, =0.7.44, =0.1.0, =0.2.1, =0.3.0, =0.1.0, =0.0.5, =0.0.1a0, =0.1.40a0, =0.1.43 -...
CVE-2026-35200
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.73 and 9.7.1-alpha.4, a file can be uploaded with a filename extension that passes the file extension allowlist e.g., .txt but with a Content-Type header that differs from the...
CVE-2026-35200
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.73 and 9.7.1-alpha.4, a file can be uploaded with a filename extension that passes the file extension allowlist e.g., .txt but with a Content-Type header that differs from the...
CVE-2026-35200 Parse Server has a file upload Content-Type override via extension mismatch
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.73 and 9.7.1-alpha.4, a file can be uploaded with a filename extension that passes the file extension allowlist e.g., .txt but with a Content-Type header that differs from the...
Parse Server 安全漏洞
Parse Server is an open-source backend developed by the Parse Platform. It can be deployed on any infrastructure that supports Node.js. There were security vulnerabilities in versions of Parse Server prior to 8.6.73 and 9.7.1-alpha.4. These vulnerabilities stemmed from a lack of consistency...
Parse Server: File upload Content-Type override via extension mismatch
Impact A file can be uploaded with a filename extension that passes the file extension allowlist e.g., .txt but with a Content-Type header that differs from the extension e.g., text/html. The Content-Type is passed to the storage adapter without consistency validation. Storage adapters that store...
CVE-2026-34750
Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2, and @payloadcms/storage-s3, the client-upload signed-URL endpoints for S3, GCS, Azure, and R2 did not properly sanitize...
Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints
Impact The client-upload signed-URL endpoints for S3, GCS, Azure, and R2 did not properly sanitize filenames. An attacker could craft filenames to escape the intended storage location. Consumers are affected if ALL of these are true: - Payload version v3.78.0 - Using client-upload signed-URL...
GHSA-FRQ9-7J6G-V74X Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints
Impact The client-upload signed-URL endpoints for S3, GCS, Azure, and R2 did not properly sanitize filenames. An attacker could craft filenames to escape the intended storage location. Consumers are affected if ALL of these are true: - Payload version v3.78.0 - Using client-upload signed-URL...
JesterSploit
JesterSploit – Advanced WiFi Penetration Testing Framework !...
org.keycloak:keycloak-saml-adapter-api-public (4.0.0.final), org.keycloak:keycloak-saml-adapter-core (4.0.0.final) +25 more potentially affected by CVE-2026-2575 via org.keycloak:keycloak-saml-core (4.0.0.final)
org.keycloak:keycloak-saml-core MAVEN version 4.0.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-saml-core and may be impacted: - org.keycloak:keycloak-saml-adapter-api-public 4.0.0.final -...
CVE-2026-30863
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.10 and 9.5.0-alpha.11, the Google, Apple, and Facebook authentication adapters use JWT verification to validate identity tokens. When the adapter's audience configuration...
acdc-aws-etl-pipeline (>=0.1.7, <=0.5.9), balto-core (>=0.1.5, <=0.1.7) +47 more potentially affected by CVE-2026-29790 via dbt-common (>=1.0.0b2, <=1.33.0)
dbt-common PYPI version =1.0.0b2, =0.1.7, =0.1.5, =0.21.7, =0.0.1rc1, =0.1.0a1, =1.0.9, =1.8.0, =1.8.0b2, =1.8.0, =1.8.0rc1, =2.0.0rc1 - dbt-docs-mcp 0.0.1 and more Source cves: CVE-2026-29790 Source advisory: OSV:GHSA-W75W-9QV4-J5XJ...
PT-2026-23000
Name of the Vulnerable Software and Affected Versions orpc versions prior to 1.13.6 @orpc/client versions prior to 1.13.6 Description A critical prototype pollution issue exists in the RPC JSON deserializer of the @orpc/client package. This allows unauthenticated, remote attackers to inject...