4177 matches found
Parse Server 授权问题漏洞
Parse Server is an open-source backend developed by the Parse Platform. It can be deployed on any infrastructure that runs Node.js. Versions of Parse Server prior to 9.5.2-alpha.9 and 8.6.22 contain authorization vulnerabilities. This vulnerability stems from the OAuth2 authentication adapter not...
PT-2026-24458
Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 9.5.2-alpha.9 Parse Server versions prior to 8.6.22 Description Parse Server, an open-source backend deployable on Node.js infrastructures, contains a flaw in its OAuth2 authentication adapter. When configured...
PT-2026-24427
Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 9.5.2-alpha.5 Parse Server versions prior to 8.6.18 Description Parse Server, an open source backend deployable on Node.js infrastructures, contains a flaw in its Keycloak authentication adapter. Specifically, th...
PT-2026-24632
Socket.IO clients can send arbitrary JavaScript objects as the id argument to any service method get, patch, update, remove. The transport layer performs no type checking on this argument. When the service uses the MongoDB adapter, these objects pass through getObjectId and land directly in the...
Feathers 安全漏洞
Feathers is a lightweight web framework developed by Feathers OpenSource. It is used to create APIs and real-time applications using TypeScript or JavaScript. There were security vulnerabilities in versions of Feathers 5.0.0 to 5.0.42. These vulnerabilities stemmed from the lack of type checking ...
Parse Server 授权问题漏洞
Parse Server is an open-source backend developed by the Parse Platform. It can be deployed on any infrastructure that runs Node.js. Versions of Parse Server prior to 9.5.2-alpha.5 and 8.6.18 have vulnerabilities related to authorization. These vulnerabilities stem from the Keycloak authentication...
The vulnerability of the ath11k_qmi_m3_load() function in the drivers/net/wireless/ath/ath11k/qmi.c file of the Atheros/Qualcomm wireless communication adapter driver for the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.
The vulnerability of the ath11kqmim3load function in the drivers/net/wireless/ath/ath11k/qmi.c module of the Atheros/Qualcomm wireless communication adapter driver for the Linux operating system is related to the assignment of the NULL pointer. Exploiting this vulnerability could allow an attacke...
CVE-2025-47911 affecting package prometheus-adapter for versions less than 0.10.0-19
CVE-2025-47911 affecting package prometheus-adapter for versions less than 0.10.0-19. A patched version of the package is available...
CVE-2026-30241
Mercurius is a GraphQL adapter for Fastify. Prior to version 16.8.0, Mercurius fails to enforce the configured queryDepth limit on GraphQL subscription queries received over WebSocket connections. The depth check is correctly applied to HTTP queries and mutations, but subscription queries are...
Uncontrolled Recursion
Overview mercurius is a GraphQL adapter for Fastify Affected versions of this package are vulnerable to Uncontrolled Recursion in the subscription queries received over WebSocket connections. An attacker can bypass intended query depth restrictions by submitting deeply nested subscription queries...
Node.js Adapter for Hono 安全漏洞
The Node.js Adapter for Hono is an open-source tool developed by Hono, designed to run Hono applications on Node.js. Versions of the Node.js Adapter for Hono prior to 1.19.10 contained a security vulnerability. This vulnerability stemmed from inconsistent URL decoding, which could allow access to...
CVE-2025-64166
Mercurius is a GraphQL adapter for Fastify. Prior to version 16.4.0, a cross-site request forgery CSRF vulnerability was identified. The issue arises from incorrect parsing of the Content-Type header in requests. Specifically, requests with Content-Type values such as...
CVE-2025-64166 Mercurius: Incorrect Content-Type parsing can lead to CSRF attack
Mercurius is a GraphQL adapter for Fastify. Prior to version 16.4.0, a cross-site request forgery CSRF vulnerability was identified. The issue arises from incorrect parsing of the Content-Type header in requests. Specifically, requests with Content-Type values such as...
CVE-2025-64166
Mercurius (GraphQL adapter for Fastify) has a CSRF flaw prior to v16.4.0 caused by incorrect parsing of Content-Type headers. Requests with Content-Type like application/x-www-form-urlencoded, multipart/form-data, or text/plain could be misinterpreted as application/json, bypassing fetch() prefli...
Mercurius 安全漏洞
Mercurius is an open-source GraphQL adapter developed by mercurius-js. Versions of Mercurius prior to 16.4.0 contained a security vulnerability, which was caused by incorrect parsing of the Content-Type header. This vulnerability could lead to Cross-Site Request Forgery attacks...
Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005476)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005476 advisory. In the Linux kernel, the following vulnerability has been resolved: drm: bridge: adv7511: unregister cec i2c device after cec adapter cecunregisteradapter assumes th...
Unity Linux 20.1070a Security Update: kernel (UTSA-2026-005638)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005638 advisory. In the Linux kernel, the following vulnerability has been resolved: cxl: fix possible null-ptr-deref in cxlguestinitafu|adapter If deviceregister fails in...
Nest has a Fastify URL Encoding Middleware Bypass
Impact What kind of vulnerability is it? Who is impacted? A NestJS application using @nestjs/platform-fastify can allow bypass of any middleware when Fastify path-normalization options e.g., ignoreTrailingSlash, ignoreDuplicateSlashes, useSemicolonDelimiter are enabled. In affected route-scoped...
GHSA-R4WM-X892-VJMX Nest has a Fastify URL Encoding Middleware Bypass
Impact What kind of vulnerability is it? Who is impacted? A NestJS application using @nestjs/platform-fastify can allow bypass of any middleware when Fastify path-normalization options e.g., ignoreTrailingSlash, ignoreDuplicateSlashes, useSemicolonDelimiter are enabled. In affected route-scoped...
