CVE-2026-116165 Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB

Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on MongoDB deployments that lets clients without the master key delete the stored schema of any class. Unauthenticated attackers can send REST API delete requests targeting the internal SCHE...

CVE-2026-116165 Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB

Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on MongoDB deployments that lets clients without the master key delete the stored schema of any class. Unauthenticated attackers can send REST API delete requests targeting the internal SCHE...

Malicious code in fontus (PyPI)

Source: kam193 2a8fcff0fd4d827c6f174318ee41ea82eb2667c6d65349a01ca2215aa2f4dd5e The package most likely performs fingerprinting by exfiltrating basic information and available fonts, with no other functionality. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but...

Malicious code in fontus (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb5b8b4484126f787f9917d91b6815927146a308f64bfb852c57f5d60bf4bfbb Analysis of fontus 0.0.3 on PyPI did not identify any code paths that exfiltrate installer data, execute attacker-controlled payloads at install or...

Exploit for CVE-2026-115560

Check · Exploit · Detection · Impact · Write-up --- Discl...

CVE-2022-28986

CVE-2022-28986 A Insecure direct object references IDOR vulnerability in "Simple 2FA Plugin for Moodle" by LMS Doctor Vulnerability Details Risk : Critical Vendor: LMS Doctor - Simple 2 Factor Authentication Plugin For Moodle Disclosed by: Flaviu Popescu Description: Insecure direct object...

vLLM server request forgery vulnerability

Versions prior to vLLM 0.24.0, specifically version 0.9.2, contain a server-side request forgery vulnerability. This vulnerability arises from embedding a decoding address within the X-Request-Id header, enabling server-side request forgery. Attackers can pre-populate the P2pNcclConnector with...

SymLift: Neural Semantic Lifting for Compile-Free Vulnerability Detection in Context-Incomplete Code Fragments

Missing project context can prevent build-dependent analyzers from constructing program relations required for vulnerability detection, while neural predictions alone do not establish auditable derivations. We present SymLift, a compile-free framework centered on Vulnerability-Oriented Neural...

Amazon Linux 2023 : nginx-mod-njs (ALAS2023-2026-3300)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3300 advisory. DescriptionNGINX JavaScript njs has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and...

PT-2026-123048

Name of the Vulnerable Software and Affected Versions YesWiki versions 4.6.0 through 4.6.x YesWiki versions 5.0.0-alpha1 through 5.0.0-alpha3 Description An unauthenticated SQL injection exists in the SearchManager::prepareSearchRequest function. The issue occurs because field names from the quer...

Grokability Snipe-IT encryption issue vulnerability

Versions of Grokability Snipe-IT prior to 8.7.0 contain an encryption-related vulnerability. This flaw stems from a lack of encryption in Api\AssetsController::store. When callers lack the “assets.view.encryptedcustomfields” permission, they write plaintext data into the column marked as encrypte...

SPIP 4.4.16 SQL Injection / SSRF

SPIP version 4.4.16 and earlier contain an unauthenticated blind SQL injection in the sitemap endpoint and an authenticated SSRF issue caused by unvalidated HTTP redirect targets. Proof of concept material is included for both vulnerabilities. https://packetstorm.news/download/237466...

YesWiki SQL injection vulnerability

Versions prior to YesWiki 4.7.0, specifically 4.6.0 and versions prior to 5.0.0-alpha1 in 5.0.0-alpha4, contain an SQL injection vulnerability. This vulnerability stems from unauthenticated SQL injection within SearchManager::prepareSearchRequest. In the query and searchfields parameters of the...

Parse Platform Parse Server authorization issue vulnerability

Versions prior to Parse Platform Parse Server 8.6.101 and versions from 9.0.0 up to 9.10.4-alpha.4 contain an authorization issue vulnerability. This vulnerability stems from missing authorization checks in MongoDB deployments. Unauthenticated attackers can send delete requests to the internal...

PT-2026-123006

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.101 Parse Server versions 9.0.0 through 9.10.4-alpha.3 Description On MongoDB deployments, a missing authorization issue allows clients without the master key to delete the stored schema of any class...

Amazon Linux 2023 : nginx, nginx-all-modules, nginx-core (ALAS2023-2026-3263)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3263 advisory. A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the...

MiracleLinux 9 : cockpit-machines-348.1-1.el9_8 (AXSA:2026-2146:02)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-2146:02 advisory. cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments CVE-2026-92768 cockpit-machines: cockpit-machines: Sensitive...

Amazon Linux 2023 : heif-pixbuf-loader, libheif, libheif-devel (ALAS2023-2026-3314)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3314 advisory. Fix GHSA-w7mc-p8jc-p853: heap OOB read / info disclosure OpYCbCr420toRRGGBBaa Fix GHSA-9rj8-5mp5-26c9: Out-of-bounds read in RGBYCbCr identity-matrix colour conversion with mismatched...

vLLM resource management error vulnerability

Versions vLLM 0.19.0 through 0.24.0 contain a resource management error vulnerability. This vulnerability arises because the AudioMediaIO multimodal path fails to set a maxdurations limit for decoding duration when calling loadaudio. Authenticated attackers can exploit this by submitting small...

ALPINE-CVE-2026-114820

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle Graal...