CVE-2026-82874

ToolJet before v3.16.208 suffers from a cross-tenant authorization bypass in its tooljet-db endpoints. The vulnerability stems from a failure to validate that an authenticated user belongs to the organization specified in the organizationId path parameter. This allows any Builder-level user to re...

Arbitrary Code Injection

Overview pimcore/pimcore is a content & product management framework CMS/PIM/E-Commerce. Affected versions of this package are vulnerable to Arbitrary Code Injection via the import process. An attacker can execute arbitrary code on the server and manipulate the database schema by supplying...

CVE-2026-76223 ArcadeDB before 26.8.1 Permission Bypass via DEFINE FUNCTION

ArcadeDB com.arcadedb versions 26.7.3 and earlier fail to enforce the UPDATESCHEMA permission check when a DEFINE FUNCTION statement targets an already-existing function library. A user with only database access can add or overwrite SQL or Cypher functions in an existing library and persist the...

CVE-2026-19333

A vulnerability was detected in NightTrek Supabase-MCP cc994ab2d2a36b0af6ee7c7f3e6ce8e08cda2170/db03237d92f7dc2f0da0d70a87dba84ebcde5b66. Affected by this issue is some unknown functionality of the component generatetypes. The manipulation of the argument schema results in command injection. The...

@bigegg/parse-server-schema-config (>=1.0.5, <=1.0.10), @kontaa/subgraph (>=1.0.1, <=1.2.3) +8 more potentially affected by CVE-2026-34373 via parse-server (>=3.10.0, <=7.5.4)

parse-server NPM version =3.10.0, =1.0.5, =1.0.1, =1.2.1, =2.4.46, =1.0.0, =1.0.1, =1.0.0, =1.0.0, =1.0.0, =1.1.0 - servable-publishable 1.1.0 Source cves: CVE-2026-34373 Source advisory: SNYK:JS-PARSESERVER-15855397...