GO-2026-6079 Gitea: OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation) in gitea.dev

Gitea: OAuth token introspection returns metadata of tokens issued to other clients RFC 7662 section 4 violation in gitea.dev...

Information Exposure

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Information Exposure via error messages generated during GraphQL validation and input-coercion. An attacker can obtain...

CVE-2026-66009

Parse Server versions = 9.0.0 before 9.10.0-alpha.5 and = 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled graphQLPublicIntrospection: false, the default. A client holding only the public application id ...

CVE-2026-66008

Parse Server versions = 9.0.0 before 9.10.0-alpha.6 and = 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled graphQLPublicIntrospection: false, the default. Because these...

SUSE-SU-2026:3236-1 Security update for glib2

This update for glib2 fixes the following issues: - CVE-2026-58010: error during gvstupleisnormal alignment validation could cause a 1-byte out-of-bounds read bsc1270009. - CVE-2026-58011: invalid GDateTime in gdatetimegetymd could trigger a 2-byte out-of-bounds read bsc1270010. - CVE-2026-58012:...

SUSE-SU-2026:3235-1 Security update for glib2

This update for glib2 fixes the following issues: - CVE-2026-58010: error during gvstupleisnormal alignment validation could cause a 1-byte out-of-bounds read bsc1270009. - CVE-2026-58011: invalid GDateTime in gdatetimegetymd could trigger a 2-byte out-of-bounds read bsc1270010. - CVE-2026-58012:...

CVE-2026-66009 Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages

Parse Server versions = 9.0.0 before 9.10.0-alpha.5 and = 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled graphQLPublicIntrospection: false, the default. A client holding only the public application id ...

EUVD-2026-48581

Parse Server versions = 9.0.0 before 9.10.0-alpha.5 and = 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled graphQLPublicIntrospection: false, the default. A client holding only the public application id ...

CVE-2026-66009 Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages

Parse Server versions = 9.0.0 before 9.10.0-alpha.5 and = 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled graphQLPublicIntrospection: false, the default. A client holding only the public application id ...

CVE-2026-66009 Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages

Parse Server versions = 9.0.0 before 9.10.0-alpha.5 and = 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled graphQLPublicIntrospection: false, the default. A client holding only the public application id ...

CVE-2026-66009

Parse Server versions = 9.0.0 before 9.10.0-alpha.5 and = 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled graphQLPublicIntrospection: false, the default. A client holding only the public application id ...

CVE-2026-66009

Parse Server versions >= 9.0.0 before 9.10.0-alpha.5 and >= 8.2.2 before 8.6.86 expose GraphQL validation error messages that reveal required custom input field names when public introspection is disabled (graphQLPublicIntrospection: false by default). A client with only the public applicat...

CVE-2026-66008 Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages

Parse Server versions = 9.0.0 before 9.10.0-alpha.6 and = 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled graphQLPublicIntrospection: false, the default. Because these...

EUVD-2026-48580

Parse Server versions = 9.0.0 before 9.10.0-alpha.6 and = 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled graphQLPublicIntrospection: false, the default. Because these...

CVE-2026-66008

Parse Server versions >= 9.0.0 before 9.10.0-alpha.6 and >= 8.2.2 before 8.6.87 expose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled (graphQLPublicIntrospection: false). Since errors are prod...

CVE-2026-66008

Parse Server versions = 9.0.0 before 9.10.0-alpha.6 and = 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled graphQLPublicIntrospection: false, the default. Because these...

CVE-2026-66008 Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages

Parse Server versions = 9.0.0 before 9.10.0-alpha.6 and = 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled graphQLPublicIntrospection: false, the default. Because these...

CVE-2026-66008 Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages

Parse Server versions = 9.0.0 before 9.10.0-alpha.6 and = 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled graphQLPublicIntrospection: false, the default. Because these...

PT-2026-64285

Name of the Vulnerable Software and Affected Versions Parse Server versions 9.0.0 through 9.10.0-alpha.5 Parse Server versions 8.2.2 through 8.6.86 Description An issue exists where Pointer and Relation target class names are disclosed through GraphQL validation and input-coercion error messages...

PT-2026-64286

Name of the Vulnerable Software and Affected Versions Parse Server versions 9.0.0 through 9.10.0-alpha.4 Parse Server versions 8.2.2 through 8.6.85 Description GraphQL validation error messages reveal the names of required custom input fields even when public introspection is disabled via the...