Parse Server 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12 contains an information disclosure vulnerability in which GraphQL validation error messages reveal hidden class names when public introspection is disabled. Unauthenticated attackers holding only the public Application Id can send crafted operations triggering unknown-argument or invalid enum value errors to learn pointer and relation target classes.
Improper Input Validation vulnerability in BeamMCP.Schema in ScriptKittyOS beam_mcp allows an MCP client to reach a tool's dispatch function with arguments that violate the input schema the server advertised. BeamMCP.Schema.validate/2 checked type, required, additionalProperties, enum and numeric bounds on the top-level arguments object only. Constraints inside nested objects and on array items (items, minItems, maxItems, minLength, maxLength, pattern, nested required, enum and additionalProperties: false) were advertised by tools/list and never checked at tools/call or prompts/get, and keywords outside the enforced subset (oneOf, anyOf, $ref) were advertised and ignored.
A host whose dispatch code relies on the schema it declared receives values the schema forbids, such as an out-of-range number or an undeclared key inside a nested object. What the host does with such a value decides the impact.
This issue affects beam_mcp: from 0.1.0 before 0.10.1.
Incorrect permission assignment in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to read or overwrite the inter-process communication handles used between the TightVNC service and its desktop server process. The named shared memory segment in the Global\ namespace that carries the pipe HANDLE values is created with a NULL DACL, and its name is derived from a time-seeded srand(time(0)) value that is predictable to one-second granularity. A low-privileged local process can open the mapping and tamper with the IPC channel of a service running as SYSTEM, potentially leading to disclosure of session data, privilege escalation, or denial of service.
Jonathan Spalletta was convicted for hacking the decentralized crypto exchange Uranium Finance twice in April 2021, stealing over $53 million. He exploited two separate smart contract vulnerabilities to withdraw funds without proper authorization, causing the exchange to shut down. He laundered the stolen cryptocurrency through mixers and decentralized exchanges and used some proceeds to purchase high-value collectibles. Law enforcement recovered about $31 million in assets. Spalletta faces significant prison time for computer fraud and money laundering.
Inefficient algorithmic complexity in the decoding of message header fields in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make the IMAP, SMTP and POP3 services, or the webmail, unavailable by sending a message. The server unfolded a decoded header value by finding each line break from the end of the value and removing it, moving the rest of the value each time, so its work grew with the square of the number of line breaks, and an RFC 2047 encoded word may decode to any number of them. A received message whose Subject or other header field holds such a value keeps a worker thread busy for minutes or longer each time the value is read: when the recipient's IMAP client searches, sorts or threads the folder by a header, when the webmail lists the folder, and, where configured, when a rule tests a header, a spam tag is added to the Subject or an abuse report is read during delivery. The IMAP worker threads are shared with SMTP and POP3, so a few such messages stop those services responding. The server's reading of a message header from its file also searched everything read so far after each 4,000 bytes, costing seconds for a header of tens of megabytes.
Inefficient algorithmic complexity and a non-terminating loop in the MIME processing of received messages in Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a remote unauthenticated attacker to make the mail services unavailable by sending a message. Removing a MIME header parameter whose value is empty and directly followed by a semicolon (for example a Content-Disposition with 'filename=a.bat; filename=;') entered a loop that never terminates, holding a worker thread at full load until the server is restarted; this is reached when the attachment blocker renames a blocked attachment or a filename is set over the REST API. Separately, decoding a header field that holds many RFC 2047 encoded words of an encoding other than base64 or quoted-printable, removing a parameter with many RFC 2231 continuations, and deleting many header fields of one name each took time growing with the square of the message, on the small thread pools that serve IMAP, SMTP and POP3 connections, delivery and the REST API.
Inefficient complexity in the Sieve filter evaluation of Progressive Robot hMailServer 6.2.24 through 6.3.5 allows an authenticated account holder to make the mail services unavailable with their own filter. A ':matches' pattern was matched by a backtracking descent whose time grew with the matched value's length raised to the number of wildcards, so a pattern such as '*a*a*a*b' over 800 characters took 44 seconds; and 'deleteheader' erased the fields it removed one at a time, so removing many fields of one name over a message's header cost O(N^2) (80,000 fields took 18.8 seconds). Sieve filters run on the small, shared delivery thread pool, so an account holder whose active script does this, fed a few messages they can send themselves, empties the pool and stops delivery for the whole server. The script is the account holder's own and cannot be set for another user.
Red Hat issued a security advisory for nodejs:22 module addressing two denial of service vulnerabilities. The first vulnerability (CVE-2026-9496) involves the pacote package where a crafted spec.rawSpec value in the addGitSha function can cause a denial of service. The second vulnerability (CVE-2026-19534) affects the undici package, allowing denial of service via an unrequested WebSocket subprotocol. These issues impact Red Hat Enterprise Linux 9 and related variants. The advisory rates the severity as Important (high) and provides updated packages to remediate the vulnerabilities.
The Booking Calendar WordPress plugin before 11.8 does not generate its per-booking access hashes with sufficient entropy, deriving each from a low-entropy time-seeded value, which can allow unauthenticated attackers who are able to determine a booking's creation time to predict the hash and then read that booking's personal data or modify the booking in place.
A vulnerability in the PostgreSQL JDBC Driver (pgjdbc) versions 42.7.4 through 42.7.13 causes padding of values shorter than their declared length with leftover bytes from the driver's send buffer instead of zeros. These leftover bytes include SQL text and parameter values from previous statements on the same connection, potentially exposing sensitive data from other requests. This occurs when applications use certain methods to set data with declared lengths larger than the actual data. Versions 42.7.3 and earlier do not exhibit this behavior.
GnuTLS version 3.8.13 improperly handles the keyUsage extension in certificates when the extension's value is an ASN.1 NULL instead of the expected BIT STRING. This improper certificate validation does not cause rejection of such certificates. The supplier does not consider this an actionable security vulnerability due to their threat model excluding attacks that require modification within the trust boundary.
GnuTLS versions prior to 3.8.13 may improperly validate certificates by trusting the Common Name field when the Subject Alternative Name includes an SRV otherName with an OCTET STRING value. The supplier does not consider this a security vulnerability under their threat model, which excludes attacks requiring modification within the trust boundary. A fix is available in version 3.8.13.
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, a proxied ws request is carried through CONNECT, but NettyRequestFactory.newNettyRequest and requestUri decide whether to attach proxy authentication and an absolute-form target only from whether the URI is secure. Because ws is not marked secure, the tunneled WebSocket upgrade sent to the origin includes the proxy's Proxy-Authorization value. Basic credentials are directly recoverable and Digest responses can be replayed or cracked offline. This issue is fixed in versions 3.0.12 and 2.16.1.
CVE-2026-76280 affects certain versions of Splunk Enterprise and Splunk Secure Gateway. It allows authenticated users without admin roles to modify alert and mobile-device recipient data stored in App Key Value Store collections. This occurs because these collections improperly allow unrestricted write access instead of restricting it to authorized workflows. The vulnerability impacts versions prior to specific fixed releases in both Splunk Enterprise and Splunk Secure Gateway.
CVE-2026-76278 is a medium-severity vulnerability in Splunk Enterprise that affects certain versions before 10.4.3, 10.2.7, and 10.0.10. It allows users with the edit_spl2_module_permissions capability to access SPL2 module permission grants for modules they should not be authorized to view. This occurs because the affected REST API does not verify if the user has read access to the requested app before returning permission data. Versions 9.4.x are not affected.
CVE-2026-76269 is a vulnerability in Splunk Enterprise versions prior to 10.4.3, 10.2.7, 10.0.10, and 9.4.15 that allows non-admin and non-power users to access other users' search job information via a REST API. This occurs because the API does not properly validate job ownership before returning data. The exposed information includes search query text, job metadata, results, and preview results. The vulnerability has a medium severity rating with a CVSS score of 6.5.
traverse (npm) versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through 0.5.2, and 0.6.0 through 0.6.11 allow prototype pollution through set(). When the path passed to set() crosses a primitive value, the next path segment is resolved on that primitive's built-in prototype, so an application that passes an untrusted path to set() lets an attacker add or overwrite properties of String.prototype, Number.prototype, or Boolean.prototype using plain JSON data, for example traverse({ name: 'bob' }).set(['name', '__proto__', 'polluted'], 'yes'). Object.prototype was reachable only with a non-data path segment, such as an object whose toString returns a different value on each call, or through a Proxy that accepts an assignment without storing it. This is fixed in 0.3.10, 0.4.7, 0.5.3, and 0.6.12.
CVE-2026-107223 is a high-severity vulnerability in the qax-os excelize Go library for handling Microsoft Excel spreadsheets. Versions from 2.1.0 through 2.11.0 are affected. The flaw arises because the library's flatCols function expands column ranges without validating the Min and Max column indices against the worksheet's column limit. An attacker can craft a worksheet with an excessively large column max attribute, causing the library to allocate excessive memory and CPU during column mutation operations, potentially leading to out-of-memory conditions. No official fix or patch is currently available.
CVE-2026-107215 is a high-severity vulnerability in the qax-os excelize Go library for Microsoft Excel spreadsheets. Versions from 2.3.1 up to and including 2.11.0 improperly allocate memory based on attacker-controlled size values from OLE compound file streams without proper validation. This can lead to excessive memory allocation or negative length allocations, causing process crashes or memory exhaustion. No patch or fixed version is currently available.