CVE-2026-32248 Parse Server: Account takeover via operator injection in authentication data identifier

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.12 and 8.6.38, an unauthenticated attacker can take over any user account that was created with an authentication provider that does not validate the format of the user...

EUVD-2026-11597

A vulnerability allowing a Backup Viewer to perform remote code execution RCE as the postgres user...

CVE-2026-21708

A vulnerability allowing a Backup Viewer to perform remote code execution RCE as the postgres user...

CVE-2026-21708

A vulnerability allowing a Backup Viewer to perform remote code execution RCE as the postgres user...

CVE-2026-21708

Veeam Backup and Replication versions prior to 12.3.2.4465 and prior to 13.0.1.2067 are vulnerable to a critical flaw (CVE-2026-21708) allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user. This issue is identified as an improper neutralization of special elements u...

CVE-2026-21708

A vulnerability allowing a Backup Viewer to perform remote code execution RCE as the postgres user...

CVE-2026-21708

A vulnerability allowing a Backup Viewer to perform remote code execution RCE as the postgres user...

Vulnerabilities fixed in Veeam Backup & Replication

Veeam has fixed vulnerabilities in Veeam Backup & Replication. The vulnerabilities allow an authenticated domain user to remotely execute code on the backup server, which can lead to unauthorized control of backup operations. This issue is present in the backup server environment and can be...

CVE-2026-21708: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability allowing a Backup Viewer to perform remote code execution RCE as the postgres user...

Veeam Backup And Replication 安全漏洞

Veeam Backup and Replication is a backup and replication software developed by the American company Veeam. There is a security vulnerability in Veeam Backup and Replication, which stems from allowing backup administrators to execute remote code as the postgres user...

PT-2026-25006

Name of the Vulnerable Software and Affected Versions Veeam Backup and Recovery affected versions not specified Description A flaw exists that allows a Backup Viewer to execute code remotely as the postgres user. This issue has a CVSS score of 10.0 and is considered critical. The vulnerability...

CVE-2026-31871 Parse Server has a SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.5 and 8.6.31, a SQL injection vulnerability exists in the PostgreSQL storage adapter when processing Increment operations on nested object fields using dot notation e.g.,...

SQL Injection

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to SQL Injection in the PostgreSQL storage adapter when processing Increment operations on nested object fields using dot...

GHSA-J3GX-2473-5FP8 vulnerabilities

Vulnerabilities for packages: promxy, cert-manager-cmctl, flux-source-controller, http-echo, flux-notification-controller, docker-compose, steampipe, kubernetes-csi-driver-nfs, tailscale, coredns, newrelic-nri-statsd, step-ca, kaf, nri-mongodb, cilium-envoy, kyverno-policy-reporter-kyverno-plugin...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: promxy, cert-manager-cmctl, flux-source-controller, http-echo, flux-notification-controller, docker-compose, steampipe, kubernetes-csi-driver-nfs, tailscale, coredns, newrelic-nri-statsd, step-ca, kaf, nri-mongodb, cilium-envoy, kyverno-policy-reporter-kyverno-plugin...

GHSA-RV83-G57W-FR8J vulnerabilities

Vulnerabilities for packages: promxy, cert-manager-cmctl, flux-source-controller, http-echo, flux-notification-controller, docker-compose, steampipe, kubernetes-csi-driver-nfs, tailscale, coredns, newrelic-nri-statsd, step-ca, kaf, nri-mongodb, cilium-envoy, kyverno-policy-reporter-kyverno-plugin...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: libnvidia-container-fips, prometheus-adapter, mongodb-k8s-operator-version-upgrade-post-start-hook-fips, nri-postgresql, conftest, ory-kratos-fips, kube-fluentd-operator, tailscale, kubernetes-dns-node-cache, lvm-driver, openfga, hydra-fips, nri-kubernetes-fips,...

GHSA-RV83-G57W-FR8J vulnerabilities

Vulnerabilities for packages: libnvidia-container-fips, prometheus-adapter, mongodb-k8s-operator-version-upgrade-post-start-hook-fips, nri-postgresql, conftest, ory-kratos-fips, kube-fluentd-operator, tailscale, kubernetes-dns-node-cache, lvm-driver, openfga, hydra-fips, nri-kubernetes-fips,...

Oracle Linux 9 : postgresql:16 (ELSA-2026-4110)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-4110 advisory. pgaudit 16.0-1 - Update to 16.0 - Support postgresql 16 - Initial import for PG 16 module - Resolves: RHEL-3635 pgrepack 1.5.1-1 - Update to v1.5.1...

CVE-2026-25041 Budibase has a Command Injection in PostgreSQL Dump Command

Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.23.22 and earlier, the PostgreSQL integration constructs shell commands using user-controlled configuration values database name, host, password, etc. without proper sanitization. The password and other...