CVE-2026-121415 Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 Field Corruption via Null Dot Notation Key

Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 on MongoDB skips field type validation for null-valued dot notation keys, allowing sub-documents to be written beneath Pointer, Number, String, Date, or Boolean fields. Any client with write access, including unauthenticated clients wher...

CVE-2026-119674: MongoDB Database Tools: MongoDB Database Tools mongorestore incorrectly URL-decodes an original collection name read from metadata when the…

MongoDB Database Tools mongorestore incorrectly URL-decodes an original collection name read from metadata when the corresponding dump filename has been truncated. A database user who can create and populate a suitably encoded collection can cause a later authorized directory restore to write tho...

CVE-2026-121415: parse-community parse-server: Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 on MongoDB skips field type validation for null-valued dot…

Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 on MongoDB skips field type validation for null-valued dot notation keys, allowing sub-documents to be written beneath Pointer, Number, String, Date, or Boolean fields. Any client with write access, including unauthenticated clients wher...

Important: Red Hat Security Advisory: flatpak security update

An update for flatpak is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

PT-2026-135825

Name of the Vulnerable Software and Affected Versions AWS Serverless MCP Server versions prior to 0.2.1 Description Improper limitation of a pathname to a restricted directory in the deployment status component allows an actor who can influence the MCP agent to perform directory traversal. By...

CVE-2026-117677

When parsing an uploaded Helm chart, Gitea decompressed the archive and read every tar entry while looking for Chart.yaml without limiting the decompressed size, and did so before the package size quota was checked; the quota only considers the compressed upload size. A user with package write...

CVE-2026-117677 Gitea Helm chart upload decompression denial of service

When parsing an uploaded Helm chart, Gitea decompressed the archive and read every tar entry while looking for Chart.yaml without limiting the decompressed size, and did so before the package size quota was checked; the quota only considers the compressed upload size. A user with package write...

EUVD-2026-114800

When parsing an uploaded Helm chart, Gitea decompressed the archive and read every tar entry while looking for Chart.yaml without limiting the decompressed size, and did so before the package size quota was checked; the quota only considers the compressed upload size. A user with package write...

CVE-2026-117677 Gitea Helm chart upload decompression denial of service

When parsing an uploaded Helm chart, Gitea decompressed the archive and read every tar entry while looking for Chart.yaml without limiting the decompressed size, and did so before the package size quota was checked; the quota only considers the compressed upload size. A user with package write...

CVE-2026-117677

The Gitea platform is vulnerable to a denial of service (DoS) attack during the parsing of uploaded Helm charts . The root cause is that the application decompresses the archive and reads every tar entry to locate Chart.yaml without enforcing a limit on the decompressed size, performing this acti...

EUVD-2026-114795

The API routes for releases, release assets, milestones and repository labels did not reject changes to archived repositories. A user with write access to an archived repository, or a holder of such a user's write-scoped token, could replace or delete release assets while keeping their download...

CVE-2026-116296

In Gitea , certain API routes for releases, release assets, milestones, and repository labels failed to reject modifications to archived repositories. An attacker with write access to an archived repository, or a holder of a write-scoped token, could replace or delete release assets (preserving d...

CVE-2026-116296 Gitea archived repository release, milestone and label modification

The API routes for releases, release assets, milestones and repository labels did not reject changes to archived repositories. A user with write access to an archived repository, or a holder of such a user's write-scoped token, could replace or delete release assets while keeping their download...

CVE-2026-116296 Gitea archived repository release, milestone and label modification

The API routes for releases, release assets, milestones and repository labels did not reject changes to archived repositories. A user with write access to an archived repository, or a holder of such a user's write-scoped token, could replace or delete release assets while keeping their download...

CVE-2026-118386 Gitea Actions fork workflow trust through pull request review commit

Workflows triggered by a pull request review were read from the commit named in the review's commitid, while the fork restrictions were decided by the reviewed pull request, and the commit was not checked to belong to that pull request. A user with read access to a repository could place a commit...

EUVD-2026-114789

Workflows triggered by a pull request review were read from the commit named in the review's commitid, while the fork restrictions were decided by the reviewed pull request, and the commit was not checked to belong to that pull request. A user with read access to a repository could place a commit...

CVE-2022-22063

CVE-2022-22063 CVE-2022-22063 is a security issue in the hypervisor firmware of some older Qualcomm chipsets. An unprotected hardware component the "boot remapper" can be abused to gain full read/write access to the hypervisor from a modified operating system privilege escalation. Exploiting the...

CVE-2026-116296: Gitea: The API routes for releases, release assets, milestones and repository labels did not reject changes to archived…

The API routes for releases, release assets, milestones and repository labels did not reject changes to archived repositories. A user with write access to an archived repository, or a holder of such a user's write-scoped token, could replace or delete release assets while keeping their download...

PT-2026-134876

When parsing an uploaded Helm chart, Gitea decompressed the archive and read every tar entry while looking for Chart.yaml without limiting the decompressed size, and did so before the package size quota was checked; the quota only considers the compressed upload size. A user with package write...

CVE-2022-22948

CVE-2022-22948 Information Disclosure in VMWare vCenter Pentera’s research group discovered a vulnerability in VMWare’s vCenter Server program affecting VMWare’s software installed in 500,000 organizations worldwide responsible to manage their most critical systems Our findings were proactively...