CVE-2026-12496

Stored Cross-Site Scripting CWE-79 in the OPC XML-DA server statistics in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator's browser session hijacking,...

SUSE-SU-2026:3245-1 Security update for python3

This update for python3 fixes the following issues: - CVE-2026-7210: insufficient entropy used for Expat hash-flooding protection allows a crafted XML document to trigger hash flooding bsc1264962. - CVE-2026-8328: server-supplied PASV host address is trusted by ftpcp and allows for SSRF bsc126526...

CVE-2026-66009

Parse Server versions = 9.0.0 before 9.10.0-alpha.5 and = 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled graphQLPublicIntrospection: false, the default. A client holding only the public application id ...

CVE-2026-66008

Parse Server versions = 9.0.0 before 9.10.0-alpha.6 and = 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled graphQLPublicIntrospection: false, the default. Because these...

CVE-2026-66009 Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages

Parse Server versions = 9.0.0 before 9.10.0-alpha.5 and = 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled graphQLPublicIntrospection: false, the default. A client holding only the public application id ...

EUVD-2026-48581

Parse Server versions = 9.0.0 before 9.10.0-alpha.5 and = 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled graphQLPublicIntrospection: false, the default. A client holding only the public application id ...

CVE-2026-66009 Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages

Parse Server versions = 9.0.0 before 9.10.0-alpha.5 and = 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled graphQLPublicIntrospection: false, the default. A client holding only the public application id ...

CVE-2026-66009 Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages

Parse Server versions = 9.0.0 before 9.10.0-alpha.5 and = 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled graphQLPublicIntrospection: false, the default. A client holding only the public application id ...

CVE-2026-66009

Parse Server versions = 9.0.0 before 9.10.0-alpha.5 and = 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled graphQLPublicIntrospection: false, the default. A client holding only the public application id ...

CVE-2026-66009

Parse Server versions >= 9.0.0 before 9.10.0-alpha.5 and >= 8.2.2 before 8.6.86 expose GraphQL validation error messages that reveal required custom input field names when public introspection is disabled (graphQLPublicIntrospection: false by default). A client with only the public applicat...

CVE-2026-66008 Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages

Parse Server versions = 9.0.0 before 9.10.0-alpha.6 and = 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled graphQLPublicIntrospection: false, the default. Because these...

EUVD-2026-48580

Parse Server versions = 9.0.0 before 9.10.0-alpha.6 and = 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled graphQLPublicIntrospection: false, the default. Because these...

CVE-2026-66008

Parse Server versions >= 9.0.0 before 9.10.0-alpha.6 and >= 8.2.2 before 8.6.87 expose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled (graphQLPublicIntrospection: false). Since errors are prod...

CVE-2026-66008

Parse Server versions = 9.0.0 before 9.10.0-alpha.6 and = 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled graphQLPublicIntrospection: false, the default. Because these...

CVE-2026-66008 Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages

Parse Server versions = 9.0.0 before 9.10.0-alpha.6 and = 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled graphQLPublicIntrospection: false, the default. Because these...

CVE-2026-66008 Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages

Parse Server versions = 9.0.0 before 9.10.0-alpha.6 and = 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled graphQLPublicIntrospection: false, the default. Because these...

OESA-2026-3152 wget security update

GNU Wget is a free software package for retrieving files using HTTP, HTTPS, FTP and FTPS the most widely-used Internet protocols. It is a non-interactive commandline tool, so it may easily be called from scripts, cron jobs, terminals without X-Windows support, etc. Security Fixes: GNU Wget does n...

OESA-2026-3116 pipewire security update

is a server and user space API to deal with multimedia pipelines,contains command line utilities. Security Fixes: RAOP module accepts unbounded Content-Length values and does not check the pwarrayadd return.CVE-2026-14324...

OESA-2026-3129 389-ds-base security update

389-ds-base is an LDAPv3 compliant server which includes the LDAP server and command line utilities for server administration. Security Fixes: A flaw was found in 389-ds-base. The getldapmessagecontrolsext function in the LDAP server does not enforce an upper bound on the number of controls per...

OESA-2026-3130 389-ds-base security update

389-ds-base is an LDAPv3 compliant server which includes the LDAP server and command line utilities for server administration. Security Fixes: A flaw was found in 389-ds-base. The getldapmessagecontrolsext function in the LDAP server does not enforce an upper bound on the number of controls per...