The vulnerability of the MP4Box packaging module of the GPAC multimedia platform, related to the execution of operations beyond the buffer boundaries in memory, allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the MP4Box packaging module of the GPAC multimedia platform is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected...

The vulnerability of the MongoDB database management system, related to deficiencies in authentication procedures, allows attackers to gain unauthorized access to protected information.

The vulnerability of the MongoDB database management system is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the cs35l41_volatile_reg() function in the include/sound/cs35l41.h module of the Linux kernel allows a hacker to access protected information or cause a service failure.

The vulnerability of the cs35l41volatilereg function in the include/sound/cs35l41.h module of the Linux kernel is related to reading beyond the buffer boundaries. Exploiting this vulnerability could allow an attacker to access protected information or cause service failures...

The vulnerability of the perl-Crypt-Urandom-Token module, related to insufficient entropy, allows attackers to gain unauthorized access to protected information.

The vulnerability of the perl-Crypt-Urandom-Token module is related to insufficient entropy. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

CVE-2026-33429

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.54 and 9.6.0-alpha.43, an attacker can subscribe to LiveQuery with a watch parameter targeting a protected field. Although the protected field value is properly stripped...

CVE-2026-33326

Keystone is a content management system for Node.js. Prior to version 6.5.2, field.isFilterable access control can be bypassed in findMany queries by passing a cursor. This can be used to confirm the existence of records by protected field values. The fix for CVE-2025-46720 field-level isFilterab...

CVE-2026-33326 @keystone-6/core: `isFilterable` bypass via `cursor` parameter in findMany

Keystone is a content management system for Node.js. Prior to version 6.5.2, field.isFilterable access control can be bypassed in findMany queries by passing a cursor. This can be used to confirm the existence of records by protected field values. The fix for CVE-2025-46720 field-level isFilterab...

CVE-2026-33429 Parse Server: Protected field change detection oracle via LiveQuery watch parameter

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.54 and 9.6.0-alpha.43, an attacker can subscribe to LiveQuery with a watch parameter targeting a protected field. Although the protected field value is properly stripped...

CVE-2026-33429 Parse Server: Protected field change detection oracle via LiveQuery watch parameter

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.54 and 9.6.0-alpha.43, an attacker can subscribe to LiveQuery with a watch parameter targeting a protected field. Although the protected field value is properly stripped...

CVE-2026-33429

Parse Server exposes a protected-field information leak via LiveQuery watch parameter. Prior to versions 8.6.54 and 9.6.0-alpha.43, an attacker can subscribe with watch targeting a protected field; while the field value is stripped from payloads, the presence or absence of update events creates a...

CVE-2026-33429

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.54 and 9.6.0-alpha.43, an attacker can subscribe to LiveQuery with a watch parameter targeting a protected field. Although the protected field value is properly stripped...

CVE-2026-33429 Parse Server: Protected field change detection oracle via LiveQuery watch parameter

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.54 and 9.6.0-alpha.43, an attacker can subscribe to LiveQuery with a watch parameter targeting a protected field. Although the protected field value is properly stripped...

PT-2026-27608

Name of the Vulnerable Software and Affected Versions macOS Sequoia versions prior to 15.7.5 macOS Sonoma versions prior to 14.8.5 macOS Tahoe versions prior to 26.4 Description An issue existed where an application could potentially modify protected areas of the file system. The problem was...

PT-2026-27576

Name of the Vulnerable Software and Affected Versions macOS versions prior to 26.4 Description An issue involving file access was identified and resolved through enhanced input validation. An attacker could potentially gain access to protected areas of the file system. Recommendations Update to...

PT-2026-27546

Name of the Vulnerable Software and Affected Versions macOS Sequoia version 15.7.5 macOS Sonoma versions 14.8.5 macOS Tahoe version 26.4 Description An attacker with root privileges may be able to delete protected system files. The issue was addressed through improved state management...

PT-2026-27561

Name of the Vulnerable Software and Affected Versions macOS versions prior to 15.7.5 macOS versions prior to 14.8.5 macOS versions prior to 26.4 Description An issue involving an out-of-bounds write was identified and addressed through improved bounds checking. This flaw could potentially allow a...

PT-2026-27559

Name of the Vulnerable Software and Affected Versions macOS versions prior to 26.4 Description A path handling issue existed with inadequate validation. This allowed an application with root privileges to potentially delete protected system files. Recommendations Update to macOS version 26.4...

The vulnerability of the CI/CD system’s continuous integration and delivery capabilities in JetBrains TeamCity, related to incomplete cleanup of temporary or auxiliary resources, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Continuous Integration and Application Delivery system CI/CD of TeamCity by JetBrains is related to incomplete cleaning of temporary or auxiliary resources. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information...

PT-2026-27565

Name of the Vulnerable Software and Affected Versions macOS Sequoia versions 15.7.5 macOS Sonoma versions 14.8.5 macOS Tahoe version 26.4 Description An application may be able to modify protected parts of the file system due to a permissions issue. Additional restrictions have been implemented t...

PT-2026-27611

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.4 iPadOS versions prior to 26.4 Description A security issue exists where an attacker with physical access to an iOS device with Stolen Device Protection enabled may be able to access biometrics-gated Protected Apps wi...