Recent Advisories

Severity ID Title Vendor Product Date Type
MEDIUM 4.3 CVE-2026-44169

MariaDB: Authorization bypass in role-based routine-level privilege check exposes stored routine definitions_CVE-2026-44169

MariaDB server is a community developed fork of MySQL server. From versions 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, a user g...

MariaDB server >= 11.4.1, < 11.4.11 CVE
MEDIUM 6.9 CVE-2026-53726

Parse Server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL_CVE-2026-53726

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.80 and 9.9.1-alpha.6,...

parse-community parse-server < 8.6.80 CVE
MEDIUM 5.9 CVE-2026-53725

Parse Server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied_CVE-2026-53725

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.8.0 to before version 9.9.1-...

parse-community parse-server >= 9.8.0, < 9.9.1-alpha.5 CVE
MEDIUM 6.9 CVE-2026-50244

Naxclow IoT Platform Missing Authorization_CVE-2026-50244

The Naxclow platform exposes a registration endpoint that accepts signed requests containing a batch prefix and an arbitrary caller-supplied accoun...

Naxclow Smart Doorbell X3 All CVE
MEDIUM 5.1 CVE-2026-50099

Naxclow IoT Platform Insertion of sensitive information into Externally-Accessible file or directory_CVE-2026-50099

During WiFi association, Naxclow device firmware prints the host network’s SSID, PSK, and negotiated WPA keys in cleartext to an exposed UART conso...

Naxclow Smart Doorbell X3 All CVE
MEDIUM 6.9 CVE-2026-50008

Parse Server: Server option routeAllowList is bypassable through batch sub-requests_CVE-2026-50008

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.8.0 to before version 9.9.1-...

parse-community parse-server >= 9.8.0, < 9.9.1-alpha.3 CVE
MEDIUM 6.9 CVE-2026-47248

Parse Server: GraphQL “Did you mean” validation suggestions disclose schema to unauthenticated callers_CVE-2026-47248

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.78 and 9.9.1-alpha.2,...

parse-community parse-server < 8.6.78 CVE
MEDIUM 4.3 CVE-2026-47236

Solidtime team page exposes pending invitation and member emails to employees who lack invitations:view/members:view permission_CVE-2026-47236

Solidtime is an open-source time-tracking app. Prior to version 0.12.2, Solidtime defines an explicit invitations:view and members:view permissions...

solidtime-io solidtime < 0.12.2 CVE
MEDIUM 6.9 CVE-2026-42932

Naxclow IoT Platform Generation of Predictable Numbers or Identifiers_CVE-2026-42932

Naxclow device identifiers use fixed manufacturing prefixes combined with sequential counters, producing a fully predictable and enumerable identif...

Naxclow Smart Doorbell X3 All CVE
MEDIUM 6.1 CVE-2026-41568

Moby: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap_CVE-2026-41568

Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prio...

moby moby github.com/docker/docker/daemon <= 28.5.2 CVE