MBed TLS security vulnerabilities

Mbed TLS is an open-source, portable, easy-to-use, readable, and flexible SSL library developed by Mbed. Versions 3.3.0 to 3.6.5, as well as 4.0.0, of Mbed TLS contain security vulnerabilities due to a vulnerability that allows for algorithm downgrading...

Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2026-50171)

The remote Oracle Linux 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-50171 advisory. - macvlan: fix error recovery in macvlancommonnewlink Eric Dumazet Orabug: 39057366 CVE-2026-23209 - netfilter: nftables: fix inverted genmask check in...

CVE-2024-43028

A command injection vulnerability in the component /jmreport/show of jeecg boot v3.0.0 to v3.5.3 allows attackers to execute arbitrary code via a crafted HTTP request...

IBM Aspera Shares security vulnerability

IBM Aspera Shares is a web application developed by IBM. Versions 1.9.9 to 1.11.0 of IBM Aspera Shares contain security vulnerabilities. These vulnerabilities are due to susceptibility to HTML injection attacks, which could allow remote attackers to inject malicious HTML code and execute it in th...

PT-2026-29476

A regression in the way hashes were calculated caused rules containing the address range syntax x.x.x.x - y.y.y.y that only differ in the address ranges involved to be silently dropped as duplicates. Only the first of such rules is actually loaded into pf. Ranges expressed using the...

PT-2026-29615

CVE-2025-13916 IBM Aspera Shares 1.9.9 through 1.11.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information https://t.co/9yjkajA2Sp...

CVE-2026-4748: Use of Incorrect Operator

A regression in the way hashes were calculated caused rules containing the address range syntax x.x.x.x - y.y.y.y that only differ in the address ranges involved to be silently dropped as duplicates. Only the first of such rules is actually loaded into pf. Ranges expressed using the...

Linux kernel RAID Buffer Overflow DoS

The vulnerability of the raidresume function in the drivers/md/dm-raid.c module of the Linux support for multiple device types RAID and LVM is related to the lack of checks to ensure that the value is within the minimum range. Exploiting this vulnerability could allow an attacker to cause a servi...

PT-2026-29611

Name of the Vulnerable Software and Affected Versions Mbed TLS versions 3.5.0 through 4.0.0 Description A security issue was identified that allows client impersonation during TLS 1.3 session resumption. Recommendations Update to a version later than 4.0.0...

@openinc/parse-server-opendash (>=4.0.0, <=4.0.10) potentially affected by CVE-2026-34573 via parse-server (>=9.6.0-alpha.37, <=9.6.1)

parse-server NPM version =9.6.0-alpha.37, =4.0.0, =4.0.10 Source cves: CVE-2026-34573 Source advisory: SNYK:JS-PARSESERVER-15864422...

Improper Authorization

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Improper Authorization via the afterFind process. An attacker can gain unauthorized access to protected files by sending HTT...

4game-support-ckeditor5-custom-build (>=0.0.1, <=0.0.5), 87-midnight-ckeditor5 (>=0.0.3, <=0.0.5) +5867 more potentially affected by CVE-2021-23337 +1 more via lodash-es (>=4.0.0, <=4.18.0)

lodash-es NPM version =4.0.0, =0.0.1, =0.0.3, =0.0.1, =0.0.1-alpha.23, =1.0.0, =1.0.0, =2.14.1, =41.3.1, =2.1.0, =0.3.4, =0.4.5, =0.3.5, =0.3.5, =0.3.5, =0.3.5, =0.5.0 and more Source cves: CVE-2021-23337, CVE-2026-4800 Source advisory: SNYK:JS-LODASHES-15869627...

CVE-2026-34450

The Claude SDK for Python provides access to the Claude API from Python applications. From version 0.86.0 to before version 0.87.0, the local filesystem memory tool in the Anthropic Python SDK created memory files with mode 0o666, leaving them world-readable on systems with a standard umask and...

CVE-2026-34450 Claude SDK for Python: Insecure Default File Permissions in Local Filesystem Memory Tool

The Claude SDK for Python provides access to the Claude API from Python applications. From version 0.86.0 to before version 0.87.0, the local filesystem memory tool in the Anthropic Python SDK created memory files with mode 0o666, leaving them world-readable on systems with a standard umask and...

CVE-2026-34443

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.211, checkIpByMask in app/Misc/Helper.php checks whether the input IP contains a / character. Plain IP addresses never contain /, so the function always returns false without checking any CIDR...

CVE-2026-34784

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.71 and 9.7.1-alpha.1, file downloads via HTTP Range requests bypass the afterFindParse.File trigger and its validators on storage adapters that support streaming e.g. the...

CVE-2026-34784

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.71 and 9.7.1-alpha.1, file downloads via HTTP Range requests bypass the afterFindParse.File trigger and its validators on storage adapters that support streaming e.g. the...

CVE-2026-34784

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.71 and 9.7.1-alpha.1, file downloads via HTTP Range requests bypass the afterFindParse.File trigger and its validators on storage adapters that support streaming e.g. the...

CVE-2026-34784

Parse Server has a vulnerability where file downloads via HTTP Range requests bypass the afterFind(Parse.File) trigger and its validators on streaming storage adapters (e.g., GridFS). This can let an attacker access files that should be protected by authorization logic. The issue is fixed in vers...

CVE-2026-34784 Parse Server: Streaming file download bypasses afterFind file trigger authorization

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.71 and 9.7.1-alpha.1, file downloads via HTTP Range requests bypass the afterFindParse.File trigger and its validators on storage adapters that support streaming e.g. the...