34126 matches found
create-momentum-app (>=0.1.2, <=0.5.0) potentially affected by CVE-2026-27738 via @angular/ssr (21.1.2)
@angular/ssr NPM version 21.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/ssr and may be impacted: - create-momentum-app =0.1.2, =0.5.0 Source cves: CVE-2026-27738 Source advisory: SNYK:JS-ANGULARSSR-15357598...
create-momentum-app (>=0.1.2, <=0.5.0) potentially affected by CVE-2026-27738 +1 more via @angular/ssr (21.1.2)
@angular/ssr NPM version 21.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/ssr and may be impacted: - create-momentum-app =0.1.2, =0.5.0 Source cves: CVE-2026-27738, CVE-2026-33397 Source advisory: OSV:GHSA-XH43-G2FQ-WJRJ...
UBUNTU-CVE-2026-26986
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, railwindowfree dereferences a freed xfAppWindow pointer during HashTableFree cleanup because xfrailwindowcommon calls freeappWindow on title allocation failure without first removing the entry from the...
CVE-2026-25952
creationtimestamp| type| source ---|---|--- 2026-02-25 21:21:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfpmfuj7wc24 2026-02-28 12:00:41+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mfw6h5vgvv2x...
UBUNTU-CVE-2026-25955
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, xfAppUpdateWindowFromSurface reuses a cached XImage whose data pointer references a freed RDPGFX surface buffer, because gdiDeleteSurface frees surface-data without invalidating the appWindow-image that...
CVE-2026-26986
CVE-2026-26986 affects FreeRDP prior to version 3.23.0. The root cause is a use-after-free: during HashTable_Free cleanup, xf_rail_window_common frees appWindow without first removing the corresponding entry from the railWindows hash table, leaving a dangling pointer that is freed again on discon...
CVE-2026-25955
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, xfAppUpdateWindowFromSurface reuses a cached XImage whose data pointer references a freed RDPGFX surface buffer, because gdiDeleteSurface frees surface-data without invalidating the appWindow-image that...
CVE-2026-25955 FreeRDP has heap-use-after-free in xf_AppUpdateWindowFromSurface (stale XImage)
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, xfAppUpdateWindowFromSurface reuses a cached XImage whose data pointer references a freed RDPGFX surface buffer, because gdiDeleteSurface frees surface-data without invalidating the appWindow-image that...
CVE-2026-25954
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, xfrailserverlocalmovesize dereferences a freed xfAppWindow pointer because xfrailgetwindow returns an unprotected pointer from the railWindows hash table, and the main thread can concurrently delete the wind...
CVE-2026-25954
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, xfrailserverlocalmovesize dereferences a freed xfAppWindow pointer because xfrailgetwindow returns an unprotected pointer from the railWindows hash table, and the main thread can concurrently delete the wind...
CVE-2026-25953 FreeRDP has heap-use-after-free in xf_AppUpdateWindowFromSurface (freed appWindow)
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, xfAppUpdateWindowFromSurface reads from a freed xfAppWindow because the RDPGFX DVC thread obtains a bare pointer via xfrailgetwindow without any lifetime protection, while the main thread can concurrently...
EUVD-2026-8733
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, xfAppUpdateWindowFromSurface reads from a freed xfAppWindow because the RDPGFX DVC thread obtains a bare pointer via xfrailgetwindow without any lifetime protection, while the main thread can concurrently...
CVE-2026-25476
creationtimestamp| type| source ---|---|--- 2026-02-25 19:57:00+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mfpho3teuk2f 2026-02-28 05:40:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mfvj6pl2zk2x...
CVE-2026-27966
creationtimestamp| type| source ---|---|--- 2026-02-25 19:06:33+00:00| published-proof-of-concept| https://github.com/langflow-ai/langflow/security/advisories/GHSA-3645-fxcv-hqr4 2026-02-26 03:00:32+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mfq7dgl2ih2o 2026-02-26...
Missing Authorization
Overview parse-dashboard is a The Parse Dashboard for Parse Server Affected versions of this package are vulnerable to Missing Authorization via the agent endpoint. An attacker can gain unauthorized access to other applications' agent endpoints and escalate privileges by modifying the app ID in t...
Parse Dashboard is Missing Authorization for its Agent Endpoint
Impact The AI Agent API endpoint POST /apps/:appId/agent does not enforce authorization. Authenticated users scoped to specific apps can access any other app's agent endpoint by changing the app ID in the URL. Read-only users are given the full master key instead of the read-only master key and c...
EUVD-2026-8591
Parse Dashboard is Missing Authorization for its Agent Endpoint...
GHSA-CVWJ-6C9H-JG6V Parse Dashboard is Missing Authorization for its Agent Endpoint
Impact The AI Agent API endpoint POST /apps/:appId/agent does not enforce authorization. Authenticated users scoped to specific apps can access any other app's agent endpoint by changing the app ID in the URL. Read-only users are given the full master key instead of the read-only master key and c...