23 matches found
CVE-2026-119571
Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an authorization flaw that applies Installation updates addressed by object ID to the installation named in the X-Parse-Installation-Id header. When protectedFieldsTriggerExempt is enabled, attackers knowing another installation's object ID...
EUVD-2026-113925
Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an authorization flaw that applies Installation updates addressed by object ID to the installation named in the X-Parse-Installation-Id header. When protectedFieldsTriggerExempt is enabled, attackers knowing another installation's object ID...
CVE-2026-119571 Parse Server 9.7.0 before 9.10.5-alpha.10 Installation Update Misdirection via Installation ID
Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an authorization flaw that applies Installation updates addressed by object ID to the installation named in the X-Parse-Installation-Id header. When protectedFieldsTriggerExempt is enabled, attackers knowing another installation's object ID...
CVE-2026-119571
Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an authorization flaw that applies Installation updates addressed by object ID to the installation named in the X-Parse-Installation-Id header. When protectedFieldsTriggerExempt is enabled, attackers knowing another installation's object ID...
CVE-2026-119571
Parse Server versions 9.7.0 before 9.10.5-alpha.10 are vulnerable to an authorization flaw involving installation update misdirection. The issue occurs because updates addressed by an object ID are applied to the installation specified in the X-Parse-Installation-Id header. If protectedFieldsTrig...
CVE-2026-119571 Parse Server 9.7.0 before 9.10.5-alpha.10 Installation Update Misdirection via Installation ID
Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an authorization flaw that applies Installation updates addressed by object ID to the installation named in the X-Parse-Installation-Id header. When protectedFieldsTriggerExempt is enabled, attackers knowing another installation's object ID...
CVE-2026-119571: parse-community parse-server: Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an authorization flaw that applies _Installation updates…
Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an authorization flaw that applies Installation updates addressed by object ID to the installation named in the X-Parse-Installation-Id header. When protectedFieldsTriggerExempt is enabled, attackers knowing another installation's object ID...
Parse Platform parse-server authorization issue vulnerability
In versions 9.7.0 through 9.10.5-alpha.10 of the Parse Platform’s parse-server, there is an authorization issue vulnerability stemming from improper authorization checks. This vulnerability allows unauthorized access to protected fields by enabling the Installation update applied to the...
PT-2026-133540
Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an authorization flaw that applies Installation updates addressed by object ID to the installation named in the X-Parse-Installation-Id header. When protectedFieldsTriggerExempt is enabled, attackers knowing another installation's object ID...
CVE-2026-59185
identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes. Prior to 1.0.2, the default-on POST /v1/workspaces/:workspaceid/projects/:projectid/github/connect/complete endpoint in internal/api/router.go accepts installationid from the request body or...
CVE-2026-59185
The identrail machine identity security platform is vulnerable to a cross-tenant Insecure Direct Object Reference (IDOR) before version 1.0.2 . The POST /v1/workspaces/:workspace_id/projects/:project_id/github/connect/complete endpoint (handled in internal/api/router.go) fails to verify that a pr...
CVE-2026-47364
In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no user-facing opt-out. Impact: The Datadog user UUID and crash data are visible within Firebase Crashlytics. This UUID is not identifying outside Datadog's own...
CVE-2026-66006
lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...
CVE-2026-66006 lakeFS Unauthenticated Operator Metadata Overwrite via setup_comm_prefs
lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...
EUVD-2026-48612
lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...
CVE-2026-30920
OneUptime is a solution for monitoring and managing online services. Prior to 10.0.19, OneUptime's GitHub App callback trusts attacker-controlled state and installationid values and updates Project.gitHubAppInstallationId with isRoot: true without validating that the caller is authorized for the...
OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding
Summary OneUptime's GitHub App callback trusts attacker-controlled state and installationid values and updates Project.gitHubAppInstallationId with isRoot: true without validating that the caller is authorized for the target project. This allows an attacker to overwrite another project's GitHub A...
GHSA-656W-6F6C-M9R6 OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding
Summary OneUptime's GitHub App callback trusts attacker-controlled state and installationid values and updates Project.gitHubAppInstallationId with isRoot: true without validating that the caller is authorized for the target project. This allows an attacker to overwrite another project's GitHub A...
CVE-2025-67844
The GitHub Integration API in Mintlify Platform before 2025-11-15 allows remote attackers to obtain sensitive repository metadata via the repository owner and name fields. It fails to validate that the repository owner and name fields provided during configuration belong to the specific GitHub Ap...
CVE-2025-67844: Direct Request
The GitHub Integration API in Mintlify Platform before 2025-11-15 allows remote attackers to obtain sensitive repository metadata via the repository owner and name fields. It fails to validate that the repository owner and name fields provided during configuration belong to the specific GitHub Ap...