Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
8.2 HIGH
CVE-2026-30230 — Flare: Password‑Protected Thumbnail Bypass

Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Prior to version 1.7.2, the thumbnail endpoint does not validate the password for password‑protect…

Remote | Authorization
Mar 06, 2026 Mar 06, 2026
Mar 06, 2026
Mar 06, 2026
8.5 HIGH
CVE-2026-30229 — Parse Server: Endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write …

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.6 and 9.5.0-alpha.4, the readOnlyMasterKey can call POST /loginAs to obta…

Remote | Authentication
Mar 06, 2026 Mar 06, 2026
Mar 06, 2026
Mar 06, 2026
6.9 MEDIUM
CVE-2026-30228 — Parse Server: File creation and deletion bypasses `readOnlyMasterKey` write restriction

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.5 and 9.5.0-alpha.3, the readOnlyMasterKey can be used to create and dele…

Remote | Authorization
Mar 06, 2026 Mar 06, 2026
Mar 06, 2026
Mar 06, 2026
6.9 MEDIUM
CVE-2026-30227 — MimeKit: CRLF Injection in Quoted Local-Part Enables SMTP Command Injection and Email For…

MimeKit is a C# library which may be used for the creation and parsing of messages using the Multipurpose Internet Mail Extension (MIME), as defined by numerous IETF specifications. Prior to version …

Remote | Injection
Mar 06, 2026 Mar 06, 2026
Mar 06, 2026
Mar 06, 2026
5.3 MEDIUM
CVE-2026-30225 — OliveTin: RestartAction always runs actions as guest

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authentication context confusion vulnerability in RestartAction allows a low‑privileged authent…

Remote | Authentication
Mar 06, 2026 Mar 06, 2026
Mar 06, 2026
Mar 06, 2026
5.4 MEDIUM
CVE-2026-30224 — OliveTin: Session Fixation - Logout Fails to Invalidate Server-Side Session

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, OliveTin does not revoke server-side sessions when a user logs out. Although the browser cookie is…

Remote | Authentication
Mar 06, 2026 Mar 06, 2026
Mar 06, 2026
Mar 06, 2026
8.8 HIGH
CVE-2026-30223 — OliveTin: JWT Audience Validation Bypass in Local Key and HMAC Modes

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, when JWT authentication is configured using either "authJwtPubKeyPath" (local RSA public key) or "…

Remote | Authentication
Mar 06, 2026 Mar 06, 2026
Mar 06, 2026
Mar 06, 2026
4.0 MEDIUM
CVE-2026-29795 — stellar-xdr: `StringM::from_str` bypasses max length validation

stellar-xdr is a library and CLI containing types and functionality for working with Stellar XDR. Prior to version 25.0.1, StringM::from_str does not validate that the input length is within the decl…

| Misconfiguration
Mar 06, 2026 Mar 06, 2026
Mar 06, 2026
Mar 06, 2026
4.9 MEDIUM
CVE-2026-29791 — Agentgateway: Missing parameter sanitization in MCP to OpenAPI conversion

Agentgateway is an open source data plane for agentic AI connectivity within or across any agent framework or environment. Prior to version 0.12.0, when converting MCP tools/call request to OpenAPI r…

Remote | Injection
Mar 06, 2026 Mar 06, 2026
Mar 06, 2026
Mar 06, 2026
2.0 LOW
CVE-2026-29790 — dbt-common: commonprefix() doesn't protect against path traversal

dbt-common is the shared common utilities for dbt-core and adapter implementations use. Prior to versions 1.34.2 and 1.37.3, a path traversal vulnerability exists in dbt-common's safe_extract() funct…

Remote | Path Traversal
Mar 06, 2026 Mar 06, 2026
Mar 06, 2026
Mar 06, 2026
9.9 CRITICAL
CVE-2026-29789 — Vito: Cross-project privilege escalation in workflow site-creation actions allows unautho…

Vito is a self-hosted web application that helps manage servers and deploy PHP applications into production servers. Prior to version 3.20.3, a missing authorization check in workflow site-creation a…

Remote | Authorization
Mar 06, 2026 Mar 06, 2026
Mar 06, 2026
Mar 06, 2026
8.4 HIGH
CVE-2026-29788 — TSPortal: Anyone can forge self-deletion requests of any user

TSPortal is the WikiTide Foundation’s in-house platform used by the Trust and Safety team to manage reports, investigations, appeals, and transparency work. Prior to version 30, conversion of empty s…

Remote | Misconfiguration
Mar 06, 2026 Mar 06, 2026
Mar 06, 2026
Mar 06, 2026
8.6 HIGH
CVE-2026-29182 — Parse Server: Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restriction

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.4 and 9.4.1-alpha.3, Parse Server's readOnlyMasterKey option allows acces…

parse-server | Remote | Authorization
Mar 06, 2026 Mar 06, 2026
Mar 06, 2026
Mar 06, 2026
9.3 CRITICAL
CVE-2026-30847 — Wekan Credential Leak via notificationUsers Publication Exposes Password Hashes and Sessi…

Wekan is an open source kanban tool built with Meteor. In versions 8.31.0 through 8.33, the notificationUsers publication in Wekan publishes user documents with no field filtering, causing the Reacti…

Remote | Information Disclosure
Mar 06, 2026 Mar 06, 2026
Mar 06, 2026
Mar 06, 2026
8.7 HIGH
CVE-2026-30846 — Wekan Exposes All Global Webhook Integrations through globalwebhooks Publication

Wekan is an open source kanban tool built with Meteor. In versions 8.31.0 through 8.33, the globalwebhooks publication exposes all global webhook integrations—including sensitive url and token fields…

Remote | Information Disclosure
Mar 06, 2026 Mar 06, 2026
Mar 06, 2026
Mar 06, 2026
6.9 MEDIUM
CVE-2026-30845 — Wekan Exposes Sensitive Data through Lack of Field Filtering During Board Publication

Wekan is an open source kanban tool built with Meteor. In versions 8.31.0 through 8.33, the board composite publication in Wekan publishes all integration data for a board without any field filtering…

Remote | Information Disclosure
Mar 06, 2026 Mar 06, 2026
Mar 06, 2026
Mar 06, 2026
9.3 CRITICAL
CVE-2026-30844 — Wekan Vulnerable to SSRF through Lack of Validation or Filtering in Attachment URL Loading

Wekan is an open source kanban tool built with Meteor. Versions 8.32 and 8.33 are vulnerable to Server-Side Request Forgery (SSRF) via attachment URL loading. During board import in Wekan, attachment…

Remote | Server-Side Request Forgery
Mar 06, 2026 Mar 06, 2026
Mar 06, 2026
Mar 06, 2026
9.3 CRITICAL
CVE-2026-30843 — Wekan has Cross-Board IDOR in Custom Fields Update Endpoints

Wekan is an open source kanban tool built with Meteor. Versions 8.32 and 8.33 have a critical Insecure Direct Object Reference (IDOR) issue which could allow unauthorized users to modify custom field…

Remote | Authorization
Mar 06, 2026 Mar 06, 2026
Mar 06, 2026
Mar 06, 2026
0.0 NA
CVE-2025-69654 — QuickJS Denial of Service (DoS) Vulnerability

A crafted JavaScript input executed with the QuickJS release 2025-09-13, fixed in commit fcd33c1afa7b3028531f53cd1190a3877454f6b3 (2025-12-11),`qjs` interpreter using the `-m` option and a low memory…

| Denial of Service
Mar 06, 2026 Mar 06, 2026
Mar 06, 2026
Mar 06, 2026
8.7 HIGH
CVE-2026-29063 — Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototy…

Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(),…

Remote | Misconfiguration
Mar 06, 2026 Mar 06, 2026
Mar 06, 2026
Mar 06, 2026
Showing 20 of 5096 Results