github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers

A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service DoS by sending oversized or invalid baggage headers. The Parse function, in affected versions, failed to reject raw-length inputs, leading to excessive processing and error logging when...

smol-toml: Denial of Service via malformed TOML documents

Summary parse can be forced into an infinite loop when a value inside an array or inline table is followed by a comment that has no trailing newline i.e. the comment "ends" the document. The library fails to exit an internal loop when attempting to find the end of the structure, resetting its...

Improper Authentication

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Improper Authentication in the LDAP authentication process. An attacker can gain unauthorized access to user accounts by...

CVE-2026-87806

Parse Server versions = 9.0.0 9.10.1-alpha.7 contain an authentication bypass in the built-in LDAP authentication adapter. The adapter forwarded the client-supplied password to the directory without verifying that a password had been supplied, and treated any non-error response from the directory...

CVE-2026-87806 Parse Server 9.0.0 Authentication Bypass via LDAP Empty Password

Parse Server versions = 9.0.0 9.10.1-alpha.7 contain an authentication bypass in the built-in LDAP authentication adapter. The adapter forwarded the client-supplied password to the directory without verifying that a password had been supplied, and treated any non-error response from the directory...

CVE-2026-87806 Parse Server 9.0.0 Authentication Bypass via LDAP Empty Password

Parse Server versions = 9.0.0 9.10.1-alpha.7 contain an authentication bypass in the built-in LDAP authentication adapter. The adapter forwarded the client-supplied password to the directory without verifying that a password had been supplied, and treated any non-error response from the directory...

EUVD-2026-74832

Parse Server versions = 9.0.0 9.10.1-alpha.7 contain an authentication bypass in the built-in LDAP authentication adapter. The adapter forwarded the client-supplied password to the directory without verifying that a password had been supplied, and treated any non-error response from the directory...

CVE-2026-87806

Parse Server versions = 9.0.0

CVE-2026-87806 Parse Server 9.0.0 Authentication Bypass via LDAP Empty Password

Parse Server versions = 9.0.0 9.10.1-alpha.7 contain an authentication bypass in the built-in LDAP authentication adapter. The adapter forwarded the client-supplied password to the directory without verifying that a password had been supplied, and treated any non-error response from the directory...

PT-2026-88944

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.88 Parse Server versions 9.0.0 through 9.10.1-alpha.6 Description An authentication bypass exists in the built-in LDAP authentication adapter. The adapter forwards the client-supplied password to the director...

CVE-2026-87806: Improper Authentication

Parse Server versions = 9.0.0 9.10.1-alpha.7 contain an authentication bypass in the built-in LDAP authentication adapter. The adapter forwarded the client-supplied password to the directory without verifying that a password had been supplied, and treated any non-error response from the directory...

EUVD-2026-70737

node-csv: Prototype replacement still reachable via columns path...

NPM: node-csv: Prototype replacement still reachable via columns path

NPM: node-csv: Prototype replacement still reachable via columns path vulnerability discovered by ? in WordPress Npm csv-parse versions 7.0.2...

@accounter/client (>=0.0.12-alpha-20260616111400-042980593a256ba48203b66c0e7e022e45b91fbd, <=0.1.0-alpha-20260806092250-bc394b1d7590fd72a701aba3bdd0e263201e18ab), @blinkk/root-cms (>=3.4.1, <=3.4.10) +35 more potentially affected by CVE-2026-85063 via csv-parse (>=7.0.0, <=7.0.1)

csv-parse NPM version =7.0.0, =0.0.12-alpha-20260616111400-042980593a256ba48203b66c0e7e022e45b91fbd, =3.4.1, =0.1.4, =0.1.0, =0.1.0, =0.1.0, =0.53.29, =20260617.1750.25, =20260617.1750.26, =0.15.2, =0.13.1, =0.13.1, =0.11.1, =0.11.1, =0.11.3 and more Source cves: CVE-2026-85063 Source advisory:...

github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers

A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service DoS by sending oversized or invalid baggage headers. The Parse function, in affected versions, failed to reject raw-length inputs, leading to excessive processing and error logging when...

github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers

A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service DoS by sending oversized or invalid baggage headers. The Parse function, in affected versions, failed to reject raw-length inputs, leading to excessive processing and error logging when...

Aurelia-Path < 1.1.7 - Prototype Pollution

Aurelia-path before 1.1.7 contains a prototype pollution caused by parsing malicious URL parameters, letting attackers modify Object.prototype, exploit requires the application to parse user-controlled URLs. id: CVE-2021-41097 info: name: Aurelia-Path 1.1.7 - Prototype Pollution author: 0xAkoko...

github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers

A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service DoS by sending oversized or invalid baggage headers. The Parse function, in affected versions, failed to reject raw-length inputs, leading to excessive processing and error logging when...

The vulnerability of the GitHub CI workflow server for syntax analysis, Parse Server, allows a perpetrator to gain unauthorized access to protected information and enhance their privileges.

The vulnerability of the GitHub CI workflow server for syntax analysis in Parse Server is related to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information and enhance their privileges...

CVE-2026-16649

Gravity Forms for WordPress (all versions up to and including 2.10.5 ) is vulnerable to unauthenticated Stored Cross-Site Scripting via the Post Body Field Value. The root cause is insufficient input sanitization and output escaping: wp_kses_post permits the required HTML tags and attributes, whi...