RLSA-2026:42063 Important: glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fixes: glib: integer underflow in...

SUSE-SU-2026:22846-1 Security update for glib2

This update for glib2 fixes the following issues: - CVE-2026-58010: error during gvstupleisnormal alignment validation could cause a 1-byte out-of-bounds read bsc1270009. - CVE-2026-58011: invalid GDateTime in gdatetimegetymd could trigger a 2-byte out-of-bounds read bsc1270010. - CVE-2026-58012:...

SUSE-SU-2026:22928-1 Security update for glib2

This update for glib2 fixes the following issues: - CVE-2026-58010: error during gvstupleisnormal alignment validation could cause a 1-byte out-of-bounds read bsc1270009. - CVE-2026-58011: invalid GDateTime in gdatetimegetymd could trigger a 2-byte out-of-bounds read bsc1270010. - CVE-2026-58012:...

RockyLinux 9 : glib2 (RLSA-2026:42089)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:42089 advisory. glib: integer underflow in gio/gdbusintrospection.c via gdbusnodeinfonewforxml CVE-2026-58016 Tenable has extracted the preceding description block directly from...

Gitea: OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

Live reproduction against Gitea 1.26.1 Setup: Gitea 1.26.1 docker stack with two users admin and victim and two OAuth applications owned by different users: Client A: id=5dda747d-7fdd-4694-85ff-ce4f893ce51e owner=admin Client B: id=588f778f-4a41-4914-ae01-85d776c369db owner=victim admin runs an...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the IntrospectOAuth process. An attacker can access sensitive metadata about tokens issued to other clients by submitting a valid token to the introspection endpoint using their own OAuth application's...

GHSA-VXV2-8J6R-PCPG Gitea: OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

Live reproduction against Gitea 1.26.1 Setup: Gitea 1.26.1 docker stack with two users admin and victim and two OAuth applications owned by different users: Client A: id=5dda747d-7fdd-4694-85ff-ce4f893ce51e owner=admin Client B: id=588f778f-4a41-4914-ae01-85d776c369db owner=victim admin runs an...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the IntrospectOAuth process. An attacker can access sensitive metadata about tokens issued to other clients by submitting a valid token to the introspection endpoint using their own OAuth application's...

Information Exposure

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Information Exposure via the GraphQL API when public introspection is disabled. An attacker can obtain hidden schema...

CVE-2026-64627

Parse Server versions = 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled graphQLPublicIntrospection: false, the default, schema-derived 'Did you mean ...?' suggestions were still...

CVE-2026-64627

Parse Server versions = 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled graphQLPublicIntrospection: false, the default, schema-derived 'Did you mean ...?' suggestions were still...

EUVD-2026-46180

Parse Server versions = 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled graphQLPublicIntrospection: false, the default, schema-derived 'Did you mean ...?' suggestions were still...

CVE-2026-64627 Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion

Parse Server versions = 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled graphQLPublicIntrospection: false, the default, schema-derived 'Did you mean ...?' suggestions were still...

CVE-2026-64627

Parse Server versions 9.0.0–8.6.84/9.0.0–9.10.0-alpha.3 contain a schema disclosure vulnerability where, when GraphQL public introspection is disabled, error messages during variable coercion reveal hidden schema identifiers (e.g., Cloud Code function names, Parse class/field names) to an unauthe...

RHEL 9 : glib2 (RHSA-2026:42089)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:42089 advisory. GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, th...

PT-2026-63294

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.26.2 Description An issue exists where the OAuth token introspection endpoint allows any authenticated OAuth client to retrieve metadata for tokens issued to other clients, violating RFC 7662 section 4. The server fai...

PT-2026-61927

Parse Server versions = 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled graphQLPublicIntrospection: false, the default, schema-derived 'Did you mean ...?' suggestions were still...

RockyLinux 8 : glib2 (RLSA-2026:42090)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:42090 advisory. glib: integer underflow in gio/gdbusintrospection.c via gdbusnodeinfonewforxml CVE-2026-58016 Tenable has extracted the preceding description block directly from...

Oracle Linux 10 : glib2 (ELSA-2026-42063)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-42063 advisory. - Fix CVE-2026-58016: D-Bus introspection XML node nesting validation Tenable has extracted the preceding description block directly from the Oracle Linux...

AlmaLinux 8 : glib2 (ALSA-2026:42090)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:42090 advisory. glib: integer underflow in gio/gdbusintrospection.c via gdbusnodeinfonewforxml CVE-2026-58016 Tenable has extracted the preceding description block directly from...