CVE-2026-2571

creationtimestamp| type| source ---|---|--- 2026-03-19 08:09:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhfkg25aqi2e...

CVE-2025-5391

creationtimestamp| type| source ---|---|--- 2026-03-19 04:02:40+00:00| published-proof-of-concept| https://t.me/liwaamohammad/5085...

CVE-2026-32778

creationtimestamp| type| source ---|---|--- 2026-03-19 02:01:18+00:00| seen| https://bsky.app/profile/slackers.it/post/3mhevsumzjw2d 2026-04-01 18:20:07+00:00| seen| https://bsky.app/profile/knaepp.bsky.social/post/3mihcl3smmw26 2026-05-13 20:31:22+00:00| seen|...

IBM QRadar SIEM 跨站脚本漏洞

IBM QRadar SIEM is a solution developed by the American multinational company IBM, designed to protect assets and information from advanced threats using security intelligence. This solution provides features such as monitoring across the entire IT infrastructure and generating detailed reports o...

CVE-2025-69648

creationtimestamp| type| source ---|---|--- 2026-03-19 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/...

Apache Spark Deserialization Vulnerability

Apache Spark is a large-scale data processing engine that supports acyclic data streaming and in-memory computing from the Apache Foundation. Apache Spark suffers from a deserialization vulnerability. The vulnerability stems from the Spark History Web UI's overly lax Jackson deserialization of...

CVE-2021-0172

creationtimestamp| type| source ---|---|--- 2026-03-19 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/...

PT-2026-26444

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to versions 7.15.1 and 8.9.3, the value of the return id request parameter is copied into the value of an HTML tag attribute which is an event handler and is encapsulated in double...

CVE-2026-32703

creationtimestamp| type| source ---|---|--- 2026-03-18 22:47:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhekyphicz2c 2026-03-19 01:30:32+00:00| seen| https://infosec.exchange/users/offseq/statuses/116253250682364300 2026-03-19 01:47:03+00:00| seen|...

CVE-2026-33163

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.35 and 8.6.50, when a Parse.Cloud.afterLiveQueryEvent trigger is registered for a class, the LiveQuery server leaks protected fields and authData to all subscribers of that...

CVE-2026-33163 Parse Server leaks protected fields via LiveQuery afterEvent trigger

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.35 and 8.6.50, when a Parse.Cloud.afterLiveQueryEvent trigger is registered for a class, the LiveQuery server leaks protected fields and authData to all subscribers of that...

CVE-2026-33163 Parse Server leaks protected fields via LiveQuery afterEvent trigger

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.35 and 8.6.50, when a Parse.Cloud.afterLiveQueryEvent trigger is registered for a class, the LiveQuery server leaks protected fields and authData to all subscribers of that...

CVE-2026-33163 Parse Server leaks protected fields via LiveQuery afterEvent trigger

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.35 and 8.6.50, when a Parse.Cloud.afterLiveQueryEvent trigger is registered for a class, the LiveQuery server leaks protected fields and authData to all subscribers of that...

CVE-2026-32321

creationtimestamp| type| source ---|---|--- 2026-03-18 21:36:01+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhegyiozqm2f 2026-03-19 21:20:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mhgwl2rbgw2a 2026-03-31 21:00:05+00:00| published-proof-of-concept|...

CVE-2026-29056

creationtimestamp| type| source ---|---|--- 2026-03-18 20:01:31+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhebpj5yha2d...

EUVD-2026-12994

Parse Server leaks protected fields via LiveQuery afterEvent trigger...

Information Exposure

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Information Exposure via the afterLiveQueryEvent trigger. An attacker can access sensitive protected fields and authenticati...

EUVD-2026-12841

The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eventtype’ parameter in all versions up to, and including, 3.8.0 due to insufficient input sanitization and...

GHSA-22CC-P3C6-WPVM h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields

Summary createEventStream in h3 is vulnerable to Server-Sent Events SSE injection due to missing newline sanitization in formatEventStreamMessage and formatEventStreamComment. An attacker who controls any part of an SSE message field id, event, data, or comment can inject arbitrary SSE events to...

h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields

Summary createEventStream in h3 is vulnerable to Server-Sent Events SSE injection due to missing newline sanitization in formatEventStreamMessage and formatEventStreamComment. An attacker who controls any part of an SSE message field id, event, data, or comment can inject arbitrary SSE events to...