EUVD-2026-36539

parse-server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist...

CVE-2026-47248 Parse Server: GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callers

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.78 and 9.9.1-alpha.2, Parse Server's GraphQL endpoint discloses schema metadata to unauthenticated callers through Did you mean ...? suggestions embedded in GraphQL...

CVE-2025-64197

CVE-2025-64197 concerns the WordPress theme REHub. The vulnerability is a Stored XSS caused by improper input neutralization during web page generation, affecting Rehub-theme versions before 19.9.9.1 (reported by Red Hat, NVD, ENISA EUVD, CVE lists, and Patchstack). The Red Hat and NVD entries de...

CVE-2025-55201

Copier library and CLI app for rendering project templates. Prior to 9.9.1, a safe template can currently read and write arbitrary files because Copier exposes a few pathlib.Path objects in the Jinja context which have unconstrained I/O methods. This effectively renders the security model w.r.t...

PT-2025-33667

Name of the Vulnerable Software and Affected Versions: Copier versions prior to 9.9.1 Description: Copier exposes pathlib.Path objects in the Jinja context with unconstrained I/O methods, allowing a safe template to read and write arbitrary files. This renders the security model regarding...

CVE-2022-0991

creationtimestamp| type| source ---|---|--- 2022-03-19 11:23:03+00:00| seen| https://t.me/cibsecurity/39291...