parse-hipaa-dashboard (>=1.5.0, <=2.0.5) potentially affected by CVE-2026-27608 via parse-dashboard (>=7.3.0, <=8.5.0)

parse-dashboard NPM version =7.3.0, =1.5.0, =2.0.5 Source cves: CVE-2026-27608 Source advisory: OSV:GHSA-CVWJ-6C9H-JG6V...

GHSA-CVWJ-6C9H-JG6V Parse Dashboard is Missing Authorization for its Agent Endpoint

Impact The AI Agent API endpoint POST /apps/:appId/agent does not enforce authorization. Authenticated users scoped to specific apps can access any other app's agent endpoint by changing the app ID in the URL. Read-only users are given the full master key instead of the read-only master key and c...

parse-hipaa-dashboard (>=1.5.0, <=2.0.5) potentially affected by CVE-2026-27608 via parse-dashboard (>=7.3.0, <=8.5.0)

parse-dashboard NPM version =7.3.0, =1.5.0, =2.0.5 Source cves: CVE-2026-27608 Source advisory: SNYK:JS-PARSEDASHBOARD-15366642...

Missing Authorization

Overview parse-dashboard is a The Parse Dashboard for Parse Server Affected versions of this package are vulnerable to Missing Authorization via the agent endpoint. An attacker can gain unauthorized access to other applications' agent endpoints and escalate privileges by modifying the app ID in t...

EUVD-2026-8591

Parse Dashboard is Missing Authorization for its Agent Endpoint...

Parse Dashboard has incomplete authentication on AI Agent endpoint

Impact The AI Agent API endpoint POST /apps/:appId/agent lacks authentication. Unauthenticated remote attackers can send requests to the endpoint and perform arbitrary database operations against any connected Parse Server using the master key. Patches The fix adds authentication middleware to th...

Missing Authentication for Critical Function

Overview parse-dashboard is a The Parse Dashboard for Parse Server Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the agent endpoint. An attacker can perform arbitrary database operations against any connected server instance by sending...

parse-hipaa-dashboard (>=1.5.0, <=2.0.5) potentially affected by CVE-2026-27595 via parse-dashboard (>=7.3.0, <=8.5.0)

parse-dashboard NPM version =7.3.0, =1.5.0, =2.0.5 Source cves: CVE-2026-27595 Source advisory: SNYK:JS-PARSEDASHBOARD-15366641...

EUVD-2026-8595

Parse Dashboard has incomplete authentication on AI Agent endpoint...

parse-hipaa-dashboard (>=1.5.0, <=2.0.5) potentially affected by CVE-2026-27595 via parse-dashboard (>=7.3.0, <=8.5.0)

parse-dashboard NPM version =7.3.0, =1.5.0, =2.0.5 Source cves: CVE-2026-27595 Source advisory: OSV:GHSA-QWC3-H9MG-4582...

GHSA-QWC3-H9MG-4582 Parse Dashboard has incomplete authentication on AI Agent endpoint

Impact The AI Agent API endpoint POST /apps/:appId/agent lacks authentication. Unauthenticated remote attackers can send requests to the endpoint and perform arbitrary database operations against any connected Parse Server using the master key. Patches The fix adds authentication middleware to th...

gai-common (>=0.1.2, <=0.86.0), gai-lib (0.120.0) +4 more potentially affected by CVE-2026-27628 via pypdf (4.3.0)

pypdf PYPI version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - gai-common =0.1.2, =1.1.3, =0.3.1, =5.3.8, =0.6.6, =0.7.0 Source cves: CVE-2026-27628 Source advisory: OSV:GHSA-2RW7-X74F-JG35...

USN-8063-1 protobuf vulnerability

It was discovered that Protocol Buffers incorrectly handled recursion when the Python google.protobuf.jsonformat.ParseDict function is being used. An attacker could possibly use this issue to cause Protocol Buffers to consume resources, resulting in a denial of service...

golang: net/url: Memory exhaustion in query parameter parsing in net/url

A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted...

golang: net/url: Memory exhaustion in query parameter parsing in net/url

A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted...

golang: net/url: Memory exhaustion in query parameter parsing in net/url

A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted...

golang: net/url: Memory exhaustion in query parameter parsing in net/url

A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted...

CVE-2026-27609

Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint POST /apps/:appId/agent lacks CSRF protection. An attacker can craft a malicious page that, when visited by an authenticated dashboard user, submit...

CVE-2026-27610

Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the ConfigKeyCache uses the same cache key for both master key and read-only master key when resolving function-typed keys. Under specific timing conditions, a read-only use...

CVE-2026-27595

Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint POST /apps/:appId/agent has multiple security vulnerabilities that, when chained, allow unauthenticated remote attackers to perform arbitrary read...