Python's ssl module has been updated to include a denylist of known compromised intermediate certificates. This enhancement ensures that these certificates are automatically rejected, improving security even if certificate revocation is not configured. The vulnerability affects multiple Python versions prior to their respective fixed releases.
Parse Server versions before 8.6.101 and from 9.0.0 up to but not including 9.10.4 have a missing authorization vulnerability affecting MongoDB deployments. This flaw allows unauthenticated attackers to delete the stored schema of any class by sending REST API delete requests to the internal _SCHEMA collection. Such unauthorized deletions can remove field definitions, class-level permissions, and protected fields, potentially exposing data to unauthorized reads and modifications. The issue is fixed in versions 8.6.101 and 9.10.4.
Parse Server versions before 8.6.100 and from 9.0.0 up to but not including 9.10.4 allow clients to write reserved internal field names in object writes. This vulnerability enables attackers to disrupt object reads on MongoDB by injecting reserved fields, affecting all users querying that class. Additionally, attackers can clear their own account lockout state and password history, bypassing lockout and password policies.
Parse Server versions before 8.6.102 and from 9.0.0 up to but not including 9.10.5 contain an authentication bypass vulnerability. This occurs because custom AuthAdapter subclasses do not have their validateSetUp, validateLogin, and validateUpdate methods called, causing the system to fall back to a default that accepts any authentication data. This flaw allows attackers to supply arbitrary authentication data to sign up, link identities, log in as existing users, or bypass additional authentication factors.
Parse Server versions before 8.6.104 and 9.0.0 before 9.10.5 contain a privilege escalation vulnerability in the SMS multi-factor authentication (MFA) login process. The server saves the entire login request with master privileges when issuing an SMS MFA verification code. This allows an SMS MFA-enrolled user to modify master-key-restricted fields on their own account, such as the email-verification flag or values protected by beforeSave triggers.
Parse Server versions before 8.6.103 and from 9.0.0 up to but not including 9.10.5 contain an information disclosure vulnerability in the LiveQuery feature. The issue arises because the subscription hash omits constraints adjacent to a $or operator, causing distinct subscriptions to be grouped incorrectly. This allows authenticated clients using $or queries to receive events intended for other users, including session tokens that could be used for impersonation.
A vulnerability in Python's tarfile module allows crafted tar archives with specially crafted symlink entries to bypass the tar_filter mechanism. This can cause tarfile.extractall() with filter="tar" to write files outside the intended extraction directory, potentially overwriting or creating files elsewhere on the filesystem, depending on the extracting process's permissions. This issue affects multiple Python versions prior to fixed releases and is related to a similar flaw in tarfile.data_filter (CVE-2026-7774).
MLflow versions from 3.12.0 up to but not including 3.17.0 contain a server-side request forgery (SSRF) vulnerability in the scorer invoke, register, and GenAI evaluate endpoints. This vulnerability allows unauthenticated attackers to send crafted requests that cause the server to make outbound HTTP requests to attacker-controlled or internal hosts. The issue arises from insecure deserialization of third-party scorer data that is resolved using a module-path allowlist but does not restrict constructor arguments. The vulnerability is fixed in version 3.17.0.
An incorrect authorization vulnerability in GitLab EE versions from 12.0 up to but not including 19.3.6, 19.4 up to 19.4.3, and 19.5 up to 19.5.1 allowed authenticated users to grant or accept project and group memberships outside the identity provider's control when the instance-wide SAML or LDAP membership lock was enabled. This was due to incomplete enforcement of the membership lock on requests created before the lock was enabled. The issue has been fixed in versions 19.3.6, 19.4.3, and 19.5.1.
GitLab versions from 10.1 up to but not including 19.3.6, 19.4 up to 19.4.3, and 19.5 up to 19.5.1 contain an LDAP injection vulnerability. This flaw occurs when OmniAuth SAML and LDAP auto-linking are both enabled, allowing an authenticated user to take over an existing LDAP-backed account without interaction from the targeted user due to improper input sanitization in the LDAP email lookup during OmniAuth identity linking. The issue has been fixed in GitLab versions 19.3.6, 19.4.3, and 19.5.1.
A vulnerability in GitLab Enterprise Edition versions from 17.4 up to but not including 19.3.6, 19.4 up to but not including 19.4.3, and 19.5 up to but not including 19.5.1 could allow an authenticated user to bypass a required merge request approval policy on a protected branch. This occurs due to improper access control during approval rule synchronization. The issue has been fixed in versions 19.3.6, 19.4.3, and 19.5.1.
A vulnerability in GitLab CE/EE versions from 15.10 up to but not including 19.3.6, 19.4 up to 19.4.3, and 19.5 up to 19.5.1 allows an authenticated user to bypass authorization checks and read milestone metadata from arbitrary private projects without membership. The flaw is due to missing authorization on a user-controlled project filter parameter in the group milestones API. This issue has been fixed in versions 19.3.6, 19.4.3, and 19.5.1.
GitLab CE/EE versions from 18.2 up to but not including 19.3.6, 19.4 up to 19.4.3, and 19.5 up to 19.5.1 contain an authorization flaw. An authenticated user with a read_api-scoped token could bypass token restrictions to retrieve a project's incoming email address and create work items due to insufficient scope enforcement on a GraphQL field. This issue has been fixed in versions 19.3.6, 19.4.3, and 19.5.1.
A vulnerability in GitLab Enterprise Edition versions from 17.8 up to but not including 19.3.6, 19.4 up to but not including 19.4.3, and 19.5 up to but not including 19.5.1 allowed authenticated users to access paid AI features without a valid subscription. This was due to insufficient server-side validation in billing eligibility checks. The issue has been fixed in versions 19.3.6, 19.4.3, and 19.5.1.
An issue in GitLab EE versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 allowed authenticated users with read-only permissions to permanently delete existing vulnerability records due to improper cleanup logic during error handling. This flaw has been remediated in versions 19.3.6, 19.4.3, and 19.5.1.
GitLab versions from 18.3 up to but not including 19.3.6, 19.4 up to 19.4.3, and 19.5 up to 19.5.1 contain a vulnerability where an unauthenticated user could poison a shared cache's OAuth/OIDC discovery document. This occurs due to improper trust of user-supplied values when constructing endpoint URLs in cached discovery responses, potentially redirecting flows to an attacker-controlled server. The issue has been fixed in versions 19.3.6, 19.4.3, and 19.5.1.
A critical integer overflow vulnerability exists in GitLab CE/EE versions from 7.0 up to certain patched releases before 18.11.13 and 19.x series before specific patch versions. This flaw could allow an unauthenticated attacker to execute arbitrary code on the GitLab server by exploiting an integer overflow during the compilation of a specially crafted regular expression.
A vulnerability in GitLab CE/EE versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 allowed an unauthenticated user to retrieve sensitive internal server credentials due to improper filtering of internal response headers. This issue has been fixed in versions 19.3.6, 19.4.3, and 19.5.1.