7570 matches found
Access of Uninitialized Pointer
Overview Affected versions of this package are vulnerable to Access of Uninitialized Pointer in ReadJBIGImage in jbig.c. Remediation A fix was pushed into the master branch but not yet published. References - GitHub Commit Credit: zerojackyi...
Heap-based Buffer Overflow
Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow in WritePCLImage in the PCL encoder. Remediation A fix was pushed into the master branch but not yet published. References - GitHub Commit Credit: zerojackyi...
Stack-based Buffer Overflow
Overview Affected versions of this package are vulnerable to Stack-based Buffer Overflow in ParseKernelArray in morphology.c. An attacker can cause memory corruption by supplying malicious kernel strings. Remediation A fix was pushed into the master branch but not yet published. References - GitH...
Integer Overflow or Wraparound
Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound in the sixeldecode function. An attacker can cause memory corruption or a crash. Remediation A fix was pushed into the master branch but not yet published. References - GitHub Commit...
SQL Injection
Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to SQL Injection via the query field name when using PostgreSQL. An attacker can execute arbitrary SQL commands by injecting...
EUVD-2025-208601
An issue pertaining to CWE-259: Use of Hard-coded Password was discovered in oslabs-beta ThermaKube master...
CVE-2025-70041
An issue pertaining to CWE-259: Use of Hard-coded Password was discovered in oslabs-beta ThermaKube master...
Uncaught Exception
Overview Affected versions of this package are vulnerable to Uncaught Exception in the ClientImpl::openstream function when processing the Content-Length response header in the streaming API. An attacker can cause the client process to crash by sending a malformed or excessively large...
Out-of-bounds Read
Overview Affected versions of this package are vulnerable to Out-of-bounds Read in the vvdecpushdata2 function of the HEIF File Parser component. An attacker can cause an out-of-bounds read by manipulating the size argument during local exploitation. Remediation Upgrade libheif to version 1.23.1 ...
CVE-2026-32234
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.10 and 8.6.36, an attacker with access to the master key can inject malicious SQL via crafted field names used in query constraints when Parse Server is configured with...
CVE-2026-32234
Parse Server vulnerability CVE-2026-32234 affects deployments using PostgreSQL. A crafted field name in a $regex query constraint can be interpolated into SQL when an attacker has master-key access, bypassing the Parse Server layer and enabling database-level SQL injection. Affected versions are ...
CVE-2026-32234 Parse Server has a SQL injection via query field name when using PostgreSQL
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.10 and 8.6.36, an attacker with access to the master key can inject malicious SQL via crafted field names used in query constraints when Parse Server is configured with...
CVE-2026-32234
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.10 and 8.6.36, an attacker with access to the master key can inject malicious SQL via crafted field names used in query constraints when Parse Server is configured with...
CVE-2026-32234 Parse Server has a SQL injection via query field name when using PostgreSQL
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.10 and 8.6.36, an attacker with access to the master key can inject malicious SQL via crafted field names used in query constraints when Parse Server is configured with...
CVE-2026-32234 Parse Server has a SQL injection via query field name when using PostgreSQL
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.10 and 8.6.36, an attacker with access to the master key can inject malicious SQL via crafted field names used in query constraints when Parse Server is configured with...
Use After Free
Overview Affected versions of this package are vulnerable to Use After Free in smb.c, which may reuse already freed memory from a previous SMB connection request. The window of opportunity to exploit this is small, and the region of memory exposed is small and out of the attacker's control...
CVE-2025-62166
FreshRSS is a free, self-hostable RSS aggregator. Prior 1.28.0, a bug in the auth logic related to master authentication tokens, this restriction is bypassed. Usually only the default user's feed should be viewable if anonymous viewing is enabled, and feeds of other users should be private. This...
Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes
Impact The GraphQLConfig and Audience internal classes can be read, modified, and deleted via the generic /classes/GraphQLConfig and /classes/Audience REST API routes without master key authentication. This bypasses the master key enforcement that exists on the dedicated /graphql-config and...