Security advisories

critical2026-03-11

CVE-2026-31862-@siteboon/claude-code-ui is Vulnerable to Command Injection via Multiple Parameters

siteboon/claudecodeui · GHSA-f2fc-vc88-6w7q

medium2026-03-11

CVE-2026-31832-Umbraco Backoffice API Allows Unauthorized Modification of Domain Data

umbraco/umbraco-cms · GHSA-fpvf-fvp5-996r

high2026-03-11

CVE-2026-31830-sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest

sigstore/sigstore-ruby · GHSA-mhg6-2q2v-9h2c

high2026-03-11

CVE-2026-31829-Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access

flowiseai/flowise · GHSA-fvcw-9w9r-pxc7

medium2026-03-11

CVE-2026-31828-Parse Server vulnerable to LDAP injection via unsanitized user input in DN and group filter construction

parse-community/parse-server · GHSA-7m6r-fhh7-r47c

high2026-03-11

CVE-2026-31800-Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes

parse-community/parse-server · GHSA-7xg7-rqf6-pw6c

medium2026-03-11

CVE-2026-30973-@appium/support has a Zip Slip arbitrary file write in its ZIP extraction

appium/appium · GHSA-rfx7-4xw3-gh4m

medium2026-03-11

CVE-2026-30972-Parse Server has a rate limit bypass via batch request endpoint

parse-community/parse-server · GHSA-775h-3xrc-c228

high2026-03-11

CVE-2026-30967-Parse Server OAuth2 authentication adapter account takeover via identity spoofing

parse-community/parse-server · GHSA-fr88-w35c-r596

critical2026-03-11

CVE-2026-30966-Parse Server has role escalation and CLP bypass via direct `_Join` table write

parse-community/parse-server · GHSA-5f92-jrq3-28rc

critical2026-03-11

CVE-2026-30965-Parse Server vulnerable to session token exfiltration via `redirectClassNameForKey` query parameter

parse-community/parse-server · GHSA-6r2j-cxgf-495f

high2026-03-11

CVE-2026-30962-Parse Server has a protected fields bypass via logical query operators

parse-community/parse-server · GHSA-72hp-qff8-4pvv

high2026-03-11

CVE-2026-30951-Sequelize v6 Vulnerable to SQL Injection via JSON Column Cast Type

sequelize/sequelize · GHSA-6457-6jrx-69cr

high2026-03-11

CVE-2026-30949-Parse Server missing audience validation in Keycloak authentication adapter

parse-community/parse-server · GHSA-48mh-j4p5-7j9v

high2026-03-11

CVE-2026-30948-Parse Server vulnerable to stored cross-site scripting (XSS) via SVG file upload

parse-community/parse-server · GHSA-hcj7-6gxh-24ww

high2026-03-11

CVE-2026-30947-Parse Server has a bypass of class-level permissions in LiveQuery

parse-community/parse-server · GHSA-7ch5-98q2-7289

high2026-03-11

CVE-2026-30946-Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API

parse-community/parse-server · GHSA-cmj3-wx7h-ffvg

high2026-03-11

CVE-2026-30945-StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service

withstudiocms/studiocms · GHSA-8rgj-vrfr-6hqr

high2026-03-11

CVE-2026-30941-Parse Server has a NoSQL injection via token type in password reset and email verification endpoints

parse-community/parse-server · GHSA-vgjh-hmwf-c588

medium2026-03-11

CVE-2026-31826-pypdf: manipulated stream length values can exhaust RAM

py-pdf/pypdf · GHSA-hqmh-ppp3-xvm7