Parse Server 安全漏洞

Parse Server is an open-source backend developed by the Parse Platform. It can be deployed on any infrastructure that runs Node.js. There were security vulnerabilities in versions of Parse Server prior to 8.6.64 and 9.7.0-alpha.8. These vulnerabilities allowed attackers to send concurrent login...

Parse Server 安全漏洞

Parse Server is an open-source backend developed by the Parse Platform. It can be deployed on any infrastructure that runs Node.js. There were security vulnerabilities in versions of Parse Server prior to 8.6.68 and 9.7.0-alpha.12. These vulnerabilities stemmed from the GraphQL query complexity...

CVE-2026-27508

CVE-2026-27508 affects Smoothwall Express versions prior to 3.1 Update 13. The issue is a reflected XSS in the /redirect.cgi endpoint caused by improper sanitation of the url parameter. Attackers can craft URLs containing javascript: schemes that execute arbitrary JavaScript in a victim’s browser...

CVE-2026-23381 affecting package kernel for versions less than 6.6.130.1-1

CVE-2026-23381 affecting package kernel for versions less than 6.6.130.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-23368 affecting package kernel for versions less than 6.6.130.1-1

CVE-2026-23368 affecting package kernel for versions less than 6.6.130.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-23334 affecting package kernel for versions less than 6.6.130.1-1

CVE-2026-23334 affecting package kernel for versions less than 6.6.130.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-4645 affecting package terraform for versions less than 1.3.2-30

CVE-2026-4645 affecting package terraform for versions less than 1.3.2-30. A patched version of the package is available...

CVE-2026-27651 affecting package nginx for versions less than 1.22.1-16

CVE-2026-27651 affecting package nginx for versions less than 1.22.1-16. A patched version of the package is available...

WordPress Responsive Plus plugin < 3.4.3 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Alex Tselevich nos3curity in WordPress Plugin Responsive Plus versions 3.4.3...

Broadcom Symantec Data Loss Prevention Windows Endpoint 安全漏洞

Broadcom Symantec Data Loss Prevention Windows Endpoint is a terminal data leakage prevention security software developed by Broadcom Corporation. There is a security vulnerability in Broadcom Symantec Data Loss Prevention Windows Endpoint, which stems from an privilege escalation vulnerability...

Linux Distros Unpatched Vulnerability : CVE-2025-12697

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.5 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowe...

CVE-2026-27309 Substance3D - Stager | Use After Free (CWE-416)

Substance3D - Stager versions 3.1.7 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-33887 Statamic allows unauthorized content access through missing authorization in its revision controllers

Statamic is a Laravel and Git powered content management system CMS. Prior to versions 5.73.16 and 6.7.2, authenticated Control Panel users could view entry revisions for any collection with revisions enabled, regardless of whether they had the required collection permissions. This bypasses the...

GHSA-44F4-GVWJ-6QG3 Spring AI Redis Store has TAG Field Query Injection Through Improper Neutralization of Special Characters

In RedisFilterExpressionConverter of spring-ai-redis-store, when a user-controlled string is passed as a filter value for a TAG field, stringValue inserts the value directly into the @field:VALUE RediSearch TAG block without escaping characters. This issue affects Spring AI: from 1.0.0 before...

vLLM 安全漏洞

vLLM is an open-source LLM-based inference and service engine that features high throughput and efficient memory usage. Versions of vLLM prior to 0.10.1 to 0.18.0 contained a security vulnerability. This vulnerability stemmed from the hardcoding of trustremotecode=True in two model implementation...

PT-2026-28567

Name of the Vulnerable Software and Affected Versions MyTube versions prior to 1.8.72 Description MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.8.72, an unauthenticated attacker can lock out administrator and visitor accounts from password-based...

PT-2026-28630

Name of the Vulnerable Software and Affected Versions Fleet versions prior to 4.81.0 Description Fleet, an open source device management software, had a flaw in how user invitations were handled. Specifically, the email address entered when accepting an invitation wasn’t checked against the email...

EUVD-2026-16393

Cross-Site Request Forgery CSRF vulnerability in Drupal Automated Logout allows Cross Site Request Forgery.This issue affects Automated Logout: from 0.0.0 before 1.7.0, from 2.0.0 before 2.0.2...

EUVD-2026-16389

Improper Handling of Case Sensitivity vulnerability in Drupal OpenID Connect / OAuth client allows Privilege Escalation.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0...

CVE-2026-3527

Missing Authentication for Critical Function vulnerability in Drupal AJAX Dashboard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AJAX Dashboard: from 0.0.0 before 3.1.0...