CVE-2026-5380: Incorrect Authorization

An issue that could allow an authorized user to view the clear-text secrets for a subset of credential types and fields has been resolved. This is an instance of CWE-522: Insufficiently Protected Credentials, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N 5.3...

PT-2026-30875

An issue that could allow an authorized user to view the clear-text secrets for a subset of credential types and fields has been resolved. This is an instance of CWE-522: Insufficiently Protected Credentials, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N 5.3...

Parse Server 安全漏洞

Parse Server is an open-source backend developed by the Parse Platform. It can be deployed on any infrastructure that supports Node.js. There were security vulnerabilities in versions of Parse Server prior to 9.8.0-alpha.7 and 8.6.75. These vulnerabilities stemmed from the GET /sessions/me endpoi...

PT-2026-31008

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 9.8.0-alpha.7 and prior to 8.6.75 Description Parse Server, an open-source backend deployable on Node.js infrastructures, is affected by an issue where the GET /sessions/me API endpoint improperly returns protect...

Linux Distros Unpatched Vulnerability : CVE-2026-23425

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: arm64: Fix ID register initialization for non-protected pKVM guests In protected mode, the hypervisor maintains a separate instance of the kvm structure fo...

BIT-PARSE-2026-34595 Parse Server: LiveQuery protected-field guard bypass via array-like logical operator value

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.70 and 9.7.0, an authenticated user with find class-level permission can bypass the protectedFields class-level permission setting on LiveQuery subscriptions. By sending a...

BIT-PARSE-2026-34363 Parse Server: LiveQuery protected field leak via shared mutable state across concurrent subscribers

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.65 and 9.7.0, when multiple clients subscribe to the same class via LiveQuery, the event handlers process each subscriber concurrently using shared mutable objects. The...

BIT-GRAFANA-2026-21724 Missing Protected-field Authorization in Provisioning Contact Points API

A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission...

The vulnerability of the Music component in macOS operating systems allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Music component in macOS operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker, working remotely, to gain unauthorized access to protected information...

The vulnerability of AppleScript components in macOS operating systems allows attackers to compromise the integrity of protected information.

The vulnerability of AppleScript components in macOS operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to compromise the integrity of protected information...

The vulnerability of the Messages component in macOS operating systems allows attackers to gain unauthorized access to protected information.

The vulnerability of the Messages component in macOS operating systems is related to insecure temporary files. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

Vulnerabilities of the kerberos_AcceptSecurityContext() and kerberos_InitializeSecurityContextA() functions in the FreeRDP client, allowing attackers to compromise the accessibility of protected information

The vulnerabilities of the kerberosAcceptSecurityContext and kerberosInitializeSecurityContextA functions in the FreeRDP client are related to a memory reclamation error. Exploiting these vulnerabilities could allow an attacker to compromise the accessibility of protected information...

The vulnerability of the configd daemon in operating systems running macOS, which allows a perpetrator to compromise the accessibility of protected information

The vulnerability of the configd daemon in macOS operating systems is related to integer overflow. Exploiting this vulnerability allows a remote attacker to compromise the accessibility of protected information...

The vulnerability of the AppleEvents component in macOS operating systems allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the AppleEvents component in macOS operating systems is related to state management errors. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

The vulnerability of the persistent_cache_read_entry_v3() function in the RDP client FreeRDP allows a attacker to compromise the integrity and accessibility of protected information.

The vulnerability of the persistentcachereadentryv3 function in the RDP client FreeRDP is related to buffer overflow in dynamic memory. Exploiting this vulnerability could allow an attacker to compromise the integrity and accessibility of protected information...

The vulnerability of the RDP client FreeRDP, related to reading beyond the buffer in memory, allows attackers to compromise the confidentiality and accessibility of protected information.

The vulnerability of the RDP client FreeRDP relates to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to compromise the confidentiality and accessibility of protected information...

The vulnerability of the FreeBSD operating system’s kernel, related to the use of an erroneous operator, allows a hacker to gain unauthorized access to protected information.

The vulnerability of the FreeBSD operating system’s kernel is related to the use of an erroneous operator. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...

The vulnerability of the Git-based software platform for collaborative code development on GitLab arises from improper encoding or filtering of output data, allowing an intruder to gain unauthorized access to protected information.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to incorrect encoding or filtering of output data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the Next.js software platform for creating web applications, related to deficiencies in HTTP request processing, allows attackers to compromise the privacy and integrity of the protected information.

The vulnerability of the Next.js web application development software platform is related to shortcomings in HTTP request processing. Exploiting this vulnerability allows an attacker to compromise the confidentiality and integrity of the protected information...

The vulnerability of the Shortcuts component in macOS operating systems allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Shortcuts component in macOS operating systems is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...