BIT-PARSE-2026-32742 Parse Server session creation endpoint allows overwriting server-generated session fields

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0 and 8.6.42, an authenticated user can overwrite server-generated session fields sessionToken, expiresAt, createdWith when creating a session object via POST /classes/Session. Thi...

GHSA-VFFH-C9PQ-4CRH

creationtimestamp| type| source ---|---|--- 2026-03-20 11:01:10+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mhieh5zt7i2u 2026-03-20 13:38:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhinb7ryye2y...

CVE-2026-22324

creationtimestamp| type| source ---|---|--- 2026-03-20 10:55:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhie4lol652n 2026-03-20 22:00:50+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhjjcpva442n...

CVE-2026-27625

creationtimestamp| type| source ---|---|--- 2026-03-20 10:50:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhidtnalex2n 2026-03-20 22:01:01+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhjjd2f64525 2026-03-20 22:16:44+00:00| seen|...

CVE-2026-23276

creationtimestamp| type| source ---|---|--- 2026-03-20 09:56:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhiaswp37z2n 2026-05-31 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities20260601...

CVE-2026-23278

creationtimestamp| type| source ---|---|--- 2026-03-20 09:51:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhiajwznmn2k 2026-04-02 11:20:24+00:00| published-proof-of-concept| Telegram/euuTNLHWqQ9WQ8BRrqx3D2j20F4fUhaWZjV5ERyBbML11kM 2026-07-02 05:47:44+00:00| seen|...

CVE-2026-32595

creationtimestamp| type| source ---|---|--- 2026-03-20 09:44:00+00:00| published-proof-of-concept| https://github.com/traefik/traefik/security/advisories/GHSA-g3hg-j4jv-cwfr 2026-03-20 13:05:13+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mhilexmpip2n 2026-03-20 13:58:56+00:00|...

CVE-2026-4458

creationtimestamp| type| source ---|---|--- 2026-03-20 07:22:07+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116260295615191694 2026-03-22 00:02:04+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhmakgu54z26 2026-03-24 01:00:00+00:00| seen|...

CVE-2026-4468

creationtimestamp| type| source ---|---|--- 2026-03-20 06:28:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhhvagjsze2u...

CVE-2026-21992

creationtimestamp| type| source ---|---|--- 2026-03-20 06:01:11+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116259977375105317 2026-03-20 13:05:17+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mhilf4nf2c2s 2026-03-20 13:09:35+00:00| seen|...

CVE-2026-33011

creationtimestamp| type| source ---|---|--- 2026-03-20 05:57:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhhtisoyc42n...

CVE-2026-1264

creationtimestamp| type| source ---|---|--- 2026-03-20 05:20:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mhhrfej2wd2i...

CVE-2026-32711

creationtimestamp| type| source ---|---|--- 2026-03-20 01:13:54+00:00| published-proof-of-concept| https://github.com/pydicom/pydicom/security/advisories/GHSA-v856-2rf8-9f28 2026-03-20 04:43:21+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mhhpdkkvkv2h...

PT-2026-26675

Name of the Vulnerable Software and Affected Versions libfuse versions 3.18.0 through 3.18.1 Description libfuse, the reference implementation of the Linux FUSE, contains a flaw in its io uring subsystem. A use-after-free condition exists from versions 3.18.0 up to, but not including, 3.18.2. Thi...

Statamic 安全漏洞

Statamic is a powerful flat-file CMS built using Laravel by Statamic Inc. It allows all content, templates, assets, and settings to be stored in files rather than in a database. Versions of Statamic 5.73.14 and earlier, as well as 6.7.0, contained security vulnerabilities. These vulnerabilities...

CVE-2026-33236: Improper Limitation of a Pathname to a Restricted Directory

NLTK Natural Language Toolkit is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. In versions 3.9.3 and prior, the NLTK downloader does not validate the subdir and id attributes when processing remote XML index...

CVE-2026-33177: Missing Authorization

Statamic is a Laravel and Git powered content management system CMS. Prior to versions 5.73.14 and 6.7.0, low-privileged Control Panel users could create taxonomy terms by submitting requests to the field action processing endpoint with attacker-controlled field definitions. This bypasses the...

File Thingie 安全漏洞

File Thingie is a file manager personally developed by Frances Leese. Version 2.5.7 of File Thingie has a security vulnerability, which stems from the improper handling of the function for creating folders from URLs. This vulnerability may lead to directory traversal attacks...

CVE-2026-29096

creationtimestamp| type| source ---|---|--- 2026-03-19 23:25:31+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhh5l7fcku2c...

CVE-2026-33289

creationtimestamp| type| source ---|---|--- 2026-03-19 23:16:18+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-33289 2026-03-20 01:54:02+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhhfuscvuj2o 2026-03-23 20:20:09+00:00| seen|...