GHSA-4263-JGMP-7PF4 Parse Server's Cloud function dispatch crashes server via prototype chain traversal

Impact Remote clients can crash the Parse Server process by calling a cloud function endpoint with a crafted function name that traverses the JavaScript prototype chain of a registered cloud function handler, causing a stack overflow. Patches The fix restricts property lookups during cloud functi...

@firedesktop/react-portal-base (2.1.2), @imaginario27/air-ui-utils (>=1.0.8, <=1.0.9) +9 more potentially affected by CVE-2026-31898 via jspdf (>=4.0.0, <=4.2.0)

jspdf NPM version =4.0.0, =1.0.8, =1.4.0-I18n-QM, =0.5.129, =0.112.0-79, =0.111.0-7, =0.111.0-7, =0.111.0-7, =4.4.0, =4.4.3 - svgedit 7.4.1 Source cves: CVE-2026-31898 Source advisory: SNYK:JS-JSPDF-15677842...

9remote (>=0.1.0, <=0.1.8), @0xchain/auth (>=1.1.0-beta.8, <=1.1.0-beta.18) +362 more potentially affected by CVE-2026-27979 via next (>=16.1.0, <=16.1.6)

next NPM version =16.1.0, =0.1.0, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.18 and more Source cves: CVE-2026-27979...

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +512 more potentially affected by CVE-2026-27978 via next (>=16.0.1, <=16.1.6)

next NPM version =16.0.1, =0.1.0, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.18 and more Source cves: CVE-2026-27978 Source advisory:...

aicerberus

AICerberus 🐺 AI supply chain security scanner — one comma...

ale_python_parser (0.1.0), anni-repo (>=0.2.0, <=0.4.1) +105 more potentially affected by CVE-2026-32829 via lz4_flex (>=0.7.5, <=0.10.0)

lz4flex CARGO version =0.7.5, =0.2.0, =0.1.0, =0.0.1, =0.1.3, =0.0.1, =0.2.0, =0.4.0, =0.12.1, =1.0.0-beta.1, =0.2.5, =0.2.7 - dekoder 0.1.0 - diamond-types 1.0.0 and more Source cves: CVE-2026-32829 Source advisory: OSV:RUSTSEC-2026-0041...

PT-2026-25986

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.24 and 8.6.47, remote clients can crash the Parse Server process by calling a cloud function endpoint with a crafted function name that traverses the JavaScript prototype...

PT-2026-25998

Summary /objects/encryptPass.json.php exposes the application's password hashing algorithm to any unauthenticated user. An attacker can submit arbitrary passwords and receive their hashed equivalents, enabling offline password cracking against leaked database hashes. Details File:...

Hacked sites deliver Vidar infostealer to Windows users

In recent years, ClickFix and fake CAPTCHA techniques have become a popular way for cybercriminals to distribute malware. Instead of exploiting a technical vulnerability, these attacks rely on convincing people to run malicious commands themselves. Our researchers have recently detected a campaig...

ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack

What's the issue Passing silent=True to onnx.hub.load kills all trust warnings and user prompts. This means a model can be downloaded from any unverified GitHub repo with zero user awareness. python if not verifyreporefrepo and not silent: completely skipped when silent=True print"The model repo...

GHSA-HQMJ-H5C6-369M ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack

What's the issue Passing silent=True to onnx.hub.load kills all trust warnings and user prompts. This means a model can be downloaded from any unverified GitHub repo with zero user awareness. python if not verifyreporefrepo and not silent: completely skipped when silent=True print"The model repo...

Malicious code in supply-hx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 731dffe7bbd70b529730211e15a152420c28b79f76935d387ccff327ef587a5e The package supply-hx was found to contain malicious code. Source: ghsa-malware 0429944ee7a172b223c738e5da756b2a0713f9dc076dd13047a5726ee2528bb0 Any...

EulerOS Virtualization 2.12.1 : python-urllib3 (EulerOS-SA-2026-1459)

According to the versions of the python-urllib3 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links ...

PT-2026-25841

Name of the Vulnerable Software and Affected Versions Open Neural Network Exchange ONNX versions through 1.20.1 Description ONNX is an open standard for machine learning interoperability. A security control bypass exists in the onnx.hub.load function due to flawed repository trust verification...

Exploit for Improper Input Validation in Typo3

TYPO3 CVE-2020-15099 — Unauthenticated RCE PHP Object Injecti...

GlassWorm Supply-Chain Attack Abuses 72 Open VSX Extensions to Target Developers

Cybersecurity researchers have flagged a new iteration of the GlassWorm campaign that they say represents a "significant escalation" in how it propagates through the Open VSX registry. "Instead of requiring every malicious listing to embed the loader directly, the threat actor is now abusing...

Mining the YARA Ecosystem: From Ad-Hoc Sharing to Data-Driven Threat Intelligence

YARA has established itself as the de facto standard for "Detection as Code," enabling analysts and DevSecOps practitioners to define signatures for malware identification across the software supply chain. Despite its pervasive use, the open-source YARA ecosystem remains characterized by ad-hoc...

@lenne.tech/nest-server (>=10.8.3, <=11.1.13), @pothos-examples/federation (3.1.13) +1 more potentially affected by CVE-2026-32621 via @apollo/gateway (>=2.10.0, <=2.10.2)

@apollo/gateway NPM version =2.10.0, =10.8.3, =11.1.13 - @pothos-examples/federation 3.1.13 - @pothos-examples/prisma-federation 3.1.24 Source cves: CVE-2026-32621 Source advisory: SNYK:JS-APOLLOGATEWAY-15612461...

0utmailauth (1.0.0), @1023-ventures/ursa-core (>=0.5.2, <=0.5.3) +2059 more potentially affected by CVE-2026-2229 via undici (>=6.0.0, <=6.23.0)

undici NPM version =6.0.0, =0.5.2, =0.5.2, =0.4.2, =0.5.116, =1.3.7-canary.36.1, =1.3.7-canary.36.1, =1.3.7-canary.36.1, =4.5.8, =4.5.8, =4.5.8, =4.5.8, =4.3.3, =1.0.0, =1.0.1 and more Source cves: CVE-2026-2229 Source advisory: OSV:GHSA-V9P9-HFJ2-HCW8...

0utmailauth (1.0.0), @1023-ventures/ursa-core (>=0.5.2, <=0.5.3) +2059 more potentially affected by CVE-2026-1527 via undici (>=6.0.0, <=6.23.0)

undici NPM version =6.0.0, =0.5.2, =0.5.2, =0.4.2, =0.5.116, =1.3.7-canary.36.1, =1.3.7-canary.36.1, =1.3.7-canary.36.1, =4.5.8, =4.5.8, =4.5.8, =4.5.8, =4.3.3, =1.0.0, =1.0.1 and more Source cves: CVE-2026-1527 Source advisory: OSV:GHSA-4992-7RV2-5PVQ...