CVE-2026-30939

CVE-2026-30939 is associated with a vulnerability in Parse Server via a prototype chain resolution issue that enables a DoS. An unauthenticated attacker can crash the server by calling a Cloud Function endpoint with a prototype property name as the function name; other prototype property names by...

CVE-2026-30939

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.13 and 9.5.1-alpha.2, an unauthenticated attacker can crash the Parse Server process by calling a Cloud Function endpoint with a prototype property name as the function name. The...

CVE-2026-30939 Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.13 and 9.5.1-alpha.2, an unauthenticated attacker can crash the Parse Server process by calling a Cloud Function endpoint with a prototype property name as the function name. The...

Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution

Impact An unauthenticated attacker can crash the Parse Server process by calling a Cloud Function endpoint with a prototype property name as the function name. The server recurses infinitely, causing a call stack size error that terminates the process. Other prototype property names bypass Cloud...

PT-2026-24651

Impact An attacker can use a dot-notation field name in combination with the sort query parameter to inject SQL into the PostgreSQL database through an improper escaping of sub-field values in dot-notation queries. The vulnerability may also affect queries that use dot-notation field names with t...

PT-2026-24635

Impact An attacker can use a dot-notation field name in combination with the sort query parameter to inject SQL into the PostgreSQL database through an improper escaping of sub-field values in dot-notation queries. The vulnerability may also affect queries that use dot-notation field names with t...

[SECURITY] Fedora 44 Update: php-zumba-json-serializer-3.2.4-1.fc44

This is a library to serialize PHP variables in JSON format. It is similar of the serialize function in PHP, but the output is a string JSON encoded. You can also unserialize the JSON generated by this tool and have you PHP content back. Autoloader: /usr/share/php/Zumba/JsonSerializer/autoload.ph...

CVE-2026-28501

WWBN AVideo is an open source video platform. Prior to version 24.0, an unauthenticated SQL Injection vulnerability exists in AVideo within the objects/videos.json.php and objects/video.php components. The application fails to properly sanitize the catName parameter when it is supplied via a...

Security Bulletin: A vulnerability in JavaScript qs package affect IBM® Db2® Big SQL on IBM Cloud Pak for Data.

Summary A vulnerability in JavaScript qs package affect IBM® Db2® Big SQL 8.3 on IBM Cloud Pak for Data 5.3 and earlier. Vulnerability Details CVEID:CVE-2025-15284 DESCRIPTION: Improper Input Validation vulnerability in qs parse modules allows HTTP DoS.This issue affects qs: 6.14.1. Summary The...

The vulnerability of the json.Unmarshal() function in the JSON-RPC protocol implementation of the MCP Go SDK allows attackers to bypass existing security mechanisms.

The vulnerability of the json.Unmarshal function in the JSON-RPC protocol implementation of the MCP Go SDK is related to deficiencies in the mechanism for processing register-dependent data. Exploiting this vulnerability allows a malicious actor to bypass existing security measures by sending...

GHSA-9H8M-3FM2-QJRQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-gcp-fips, minio-fips, gatekeeper, gatekeeper-fips, kube-arangodb-fips, ceph-csi-operator-fips, loki, k6-operator-fips, gitlab-cng-fips, headlamp, kube-vip-cloud-provider, apm-server, backup-restore-operator-fips, descheduler-fips,...

CVE-2021-4456

Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impact. The functions addr2cidr and cidrlookup may return leading zeros in a CIDR string, which may in turn be parsed as octal numbers by subsequent users. In some cases an attacker ma...

Interpretation Conflict

Overview Affected versions of this package are vulnerable to Interpretation Conflict in the JSON-RPC and MCP protocol message parsing. An attacker can bypass intermediary inspection or cause cross-implementation inconsistencies by sending protocol messages with non-standard field casing or Unicod...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudformation, cert-manager-cmctl, tfsec, crossplane-provider-azure-sql, helm, ratify, terraform-provider-azuread, gitness, grafana, kyverno-notation-aws, gitsign, crossplane-provider-aws-s3, crossplane-provider-aws-kinesis, guac, kubescape,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudformation, cert-manager-cmctl, tfsec, crossplane-provider-azure-sql, helm, ratify, terraform-provider-azuread, gitness, grafana, kyverno-notation-aws, gitsign, crossplane-provider-aws-s3, crossplane-provider-aws-kinesis, guac, kubescape,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: rclone-fips, argo-workflows, crossplane-provider-azure-authorization, src-fingerprint-fips, flux, crossplane-provider-aws-elasticache-fips, crossplane-provider-aws-ecr, openbao, witness, crossplane-provider-aws-rds, aactl, crossplane-provider-aws-cloudformation-fips,...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in qs-6.13.0.tgz

Summary IBM Watson Discovery Cartridge affected by vulnerability in qs-6.13.0.tgz Vulnerability Details CVEID:CVE-2025-15284 DESCRIPTION: Improper Input Validation vulnerability in qs parse modules allows HTTP DoS.This issue affects qs: 6.14.1. SummaryThe arrayLimit option in qs does not enforce...

CVE-2026-27896 MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity

The Go MCP SDK used Go's standard encoding/json.Unmarshal for JSON-RPC and MCP protocol message parsing in versions prior to 1.3.1. Go's standard library performs case-insensitive matching of JSON keys to struct field tags — a field tagged json:"method" would also match "Method", "METHOD", etc...

[SECURITY] Fedora 42 Update: python-pyasn1-0.6.2-1.fc42

This is an implementation of ASN.1 types and codecs in the Python programming language...

PT-2026-21362

Name of the Vulnerable Software and Affected Versions ASN.1 TypeScript ESM library versions 11.0.5 and below Description The ASN.1 TypeScript ESM library, which includes codecs for Basic Encoding Rules BER and Distinguished Encoding Rules DER, has an issue where decoding an INTEGER could...