PT-2026-102505

The Apache XmlSchema walker xmlschema-walker doesn't detect cycles in type derivation, substitution groups, model groups or attribute groups. A malicious schema with such a cycle can make the walker recurse until the stack overflows, causing a denial of service. Users are recommended to upgrade t...

Never Emitted: Reporter Attribution in GitHub’s Machine-Readable Vulnerability Records

The CVE record format defines a credits container that names who found or reported a vulnerability, with a typed role per entry. The OSV schema defines an equivalent field. GitHub, which assigns CVE identifiers for advisories in its ecosystems, collects this information from reporters, requires...

CVE-2026-33639

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane interpolates the administrator-controlled taxratedecimalplaces setting into an ALTER TABLE statement for iptaxrates in Settings::index without strict integer validation...

CVE-2026-33639 InvoicePlane permits DDL injection through tax_rate_decimal_places

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane interpolates the administrator-controlled taxratedecimalplaces setting into an ALTER TABLE statement for iptaxrates in Settings::index without strict integer validation...

EUVD-2026-87131

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane interpolates the administrator-controlled taxratedecimalplaces setting into an ALTER TABLE statement for iptaxrates in Settings::index without strict integer validation...

CVE-2026-33639 InvoicePlane permits DDL injection through tax_rate_decimal_places

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane interpolates the administrator-controlled taxratedecimalplaces setting into an ALTER TABLE statement for iptaxrates in Settings::index without strict integer validation...

CVE-2026-33639 InvoicePlane permits DDL injection through tax_rate_decimal_places

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane interpolates the administrator-controlled taxratedecimalplaces setting into an ALTER TABLE statement for iptaxrates in Settings::index without strict integer validation...

CVE-2026-33639

Versions of InvoicePlane prior to 1.7.2 are vulnerable to DDL injection due to a lack of strict integer validation in the Settings::index() function. The application interpolates the administrator-controlled tax_rate_decimal_places setting directly into an ALTER TABLE statement for ip_tax_rates. ...

BIT-PARSE-2026-64627 Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion

Parse Server versions = 9.0.0 before 9.10.0 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled graphQLPublicIntrospection: false, the default, schema-derived 'Did you mean ...?' suggestions were still returned i...

CVE-2026-97228 Rapid7 Bulk Export MCP — GraphQL Query Injection in Export Status Lookup

Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component getexportstatus in src/exportmanager.py, whereby the exportid value — an unvalidated MCP tool argument reaching the function via the checkrapid7exportstatus and...

CVE-2026-97228 Rapid7 Bulk Export MCP — GraphQL Query Injection in Export Status Lookup

Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component getexportstatus in src/exportmanager.py, whereby the exportid value — an unvalidated MCP tool argument reaching the function via the checkrapid7exportstatus and...

CVE-2026-97228

Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 are vulnerable to a GraphQL query injection in the export-status component. Specifically, the get_export_status function in src/export_manager.py fails to validate the export_id argument, which is received via the check_rapid7_export_status and ...

CVE-2026-54790: Improper Neutralization of Special Elements used in an SQL Command

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane stores an administrator-controlled customfieldtable value without validating it against the allowed custom-field table names. Mdlcustomfields::used later concatenates...

CVE-2026-33639: Improper Neutralization of Special Elements used in an SQL Command

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane interpolates the administrator-controlled taxratedecimalplaces setting into an ALTER TABLE statement for iptaxrates in Settings::index without strict integer validation...

PT-2026-99009

Parse Server versions = 9.0.0 before 9.10.0 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled graphQLPublicIntrospection: false, the default, schema-derived 'Did you mean ...?' suggestions were still returned i...

PT-2026-98461

Name of the Vulnerable Software and Affected Versions Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 Description A GraphQL query injection issue exists in the export-status component within the get export status function in src/export manager.py. The export id variable, which is an unvalidat...

PT-2026-98881

Name of the Vulnerable Software and Affected Versions InvoicePlane versions prior to 1.7.2 Description InvoicePlane stores an administrator-controlled custom field table value without validating it against allowed table names. The Mdl custom fields::used function later concatenates this stored...

PT-2026-99010

Parse Server versions = 9.0.0 before 9.10.0 and = 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled graphQLPublicIntrospection: false, the default. Because these errors are...

MongoDB Collection Schema Unauthorized Access

The vulnerability of the journal message formation mechanism, when checking the schema of the MongoDB database management system’s collection, is related to the disclosure of information through registration files. Exploiting this vulnerability can allow an attacker, operating remotely, to gain...

CVE-2026-71461

HostList.list catches bare Exception and returns stre verbatim. Via hostfilter, any authenticated user triggers Django FieldError leaking complete Host model relation graph including internal reverse accessors or PostgreSQL DataError leaking raw database error strings. Two primitives:...