CVE-2026-66009

Parse Server versions = 9.0.0 before 9.10.0-alpha.5 and = 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled graphQLPublicIntrospection: false, the default. A client holding only the public application id ...

CVE-2026-12981

creationtimestamp| type| source ---|---|--- 2026-07-24 07:30:27+00:00| seen| https://infosec.exchange/users/offseq/statuses/116973779458861264 2026-07-24 07:30:29+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mretgfvnq42h 2026-07-24 21:52:27+00:00| seen|...

PT-2026-64316

Name of the Vulnerable Software and Affected Versions Azure App Service affected versions not specified Description Improper access control allows an unauthorized attacker to elevate privileges over a network. Recommendations At the moment, there is no information about a newer version that...

PT-2026-64286

Name of the Vulnerable Software and Affected Versions Parse Server versions 9.0.0 through 9.10.0-alpha.4 Parse Server versions 8.2.2 through 8.6.85 Description GraphQL validation error messages reveal the names of required custom input fields even when public introspection is disabled via the...

labymod-poc

Security Audit Report — Laby Launcher 3.0.11 Target: Laby Launch...

CVE-2025-71389

creationtimestamp| type| source ---|---|--- 2026-07-23 22:22:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrdurrtxmt2v 2026-07-23 23:01:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrdwyjh62x2a 2026-07-28 20:00:07+00:00| seen|...

Security Bulletin: Multiple vulnerabilities in IBM Desktop App

Summary Multiple vulnerabilities were addressed in IBM Aspera Desktop App v1.1.0. Vulnerability Details CVEID:CVE-2026-11980 DESCRIPTION: IBM Aspera Desktop App can allow arbitrary code execution by loading DLL files at start-up. CWE:CWE-242: Use of Inherently Dangerous Function CVSS Source: IBM...

CVE-2026-59886 vulnerabilities

Vulnerabilities for packages: kubeflow-jupyter-web-app, superset, kserve, mitmproxy, py3-cassandra-medusa, datadog-agent, kubeflow-pipelines-visualization-server, mlflow, k8s-sidecar, airflow, kubeflow-volumes-web-app, kubeflow-pipelines...

GHSA-8PPF-4F7H-5PPJ vulnerabilities

Vulnerabilities for packages: kubeflow-jupyter-web-app, superset, kserve, mitmproxy, py3-cassandra-medusa, datadog-agent, kubeflow-pipelines-visualization-server, mlflow, k8s-sidecar, airflow, kubeflow-volumes-web-app, kubeflow-pipelines...

GHSA-H35F-9H28-MQ5C vulnerabilities

Vulnerabilities for packages: kubeflow-jupyter-web-app, py3-setuptools, superset, pypy-3.10, datadog-agent, py3-pipenv, mlflow, kubeflow-volumes-web-app, httpie, kubeflow-katib, airflow...

GHSA-HM4W-WWCW-MR6R vulnerabilities

Vulnerabilities for packages: kubeflow-jupyter-web-app, superset, kserve, mitmproxy, py3-cassandra-medusa, datadog-agent, kubeflow-pipelines-visualization-server, mlflow, k8s-sidecar, airflow, kubeflow-volumes-web-app, kubeflow-pipelines...

CVE-2026-59890 vulnerabilities

Vulnerabilities for packages: kubeflow-jupyter-web-app, py3-setuptools, superset, pypy-3.10, datadog-agent, py3-pipenv, mlflow, kubeflow-volumes-web-app, httpie, kubeflow-katib, airflow...

Azure App Service on Azure Stack Hub Elevation of Privilege Vulnerability

Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-61000

creationtimestamp| type| source ---|---|--- 2026-07-23 11:55:25+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrcrraokts2b 2026-07-23 17:50:35+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

CVE-2026-47054

creationtimestamp| type| source ---|---|--- 2026-07-23 11:55:18+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrcrqzxkqk2j 2026-07-23 16:46:40+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

PYSEC-2026-3497 plone.app.textfield: Stored XSS by spoofing mime type

Impact A stored XSS affecting RichText fields. RichTextValue.output returns the raw, unsanitized stored value whenever the stored mimeType equals the outputMimeType. Because the safe-HTML output type text/x-html-safe is the type that signifies "already sanitized", any value whose stored mimeType...

PYSEC-2026-3465 FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data

Impact The FiftyOne App/API server fiftyone/server/app.py and the /media route fiftyone/server/routes/media.py unconditionally set a permissive CORS header Access-Control-Allow-Origin: on their responses. Because the embedded App server runs locally and is unauthenticated, this allows any website...

PYSEC-2026-3518 PraisonAI Slack app_mention bypasses configured user/channel authorization

PraisonAI Slack appmention bypasses configured user/channel authorization Summary PraisonAI's Slack bot applies its configured allowedusers, allowedchannels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent Slack appmention event handler. A Slack...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple Node.js modules

Summary IBM App Connect Enterprise runtime, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise Connector Discovery and OpenAPI Editor are vulnerable to multiple vulnerabilities due to Node.js modules multer, form-data, protobufjs and tar. Vulnerability Details...

Security Bulletin: IBM App Connect Enterprise is vulnerable to Confidentiality disclosure on Discovery Connector nodes (CVE-2026-12947)

Summary IBM App Connect Enterprise Discovery Connector nodes users are vulnerable to Confidentiality disclosure on Discovery Connector nodes. Vulnerability Details CVEID:CVE-2026-12947 DESCRIPTION: IBM App Connect Enterprise stores potentially sensitive information in log files that could be read...