Security advisories

high2026-03-09

CVE-2026-30926-SiYuan: Authorization Bypass Allows Low-Privilege Publish User to Modify Notebook Content via /api/block/appendHeadingChildren

siyuan-note/siyuan · GHSA-f9cq-v43p-v523

critical2026-03-09

CVE-2026-30863-Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters

parse-community/parse-server · GHSA-x6fw-778m-wr9v

medium2026-03-09

CVE-2026-30854-Parse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabled

parse-community/parse-server · GHSA-q5q9-2rhp-33qw

medium2026-03-09

CVE-2026-30850-Parse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorization

parse-community/parse-server · GHSA-hwx8-q9cg-mqmc

medium2026-03-09

CVE-2026-30848-Parse Server: `PagesRouter` path traversal allows reading files outside configured pages directory

parse-community/parse-server · GHSA-hm3f-q6rw-m6wh

high2026-03-09

CVE-2026-30920-OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding

oneuptime/oneuptime · GHSA-656w-6f6c-m9r6

medium2026-03-09

CVE-2026-29773-Kubewarden: Cross-namespace data exfiltration via deprecated host callback binding

kubewarden/kubewarden-controller · GHSA-6r7f-3fwq-hq74

high2026-03-09

CVE-2026-29196-Netmaker: Service User with Network Access Can Access config files with WireGuard Private Keys

gravitl/netmaker · GHSA-4hgg-c4rr-6h7f

medium2026-03-09

CVE-2026-29195-Netmaker has Privilege Escalation from Admin to Super-Admin via User Update

gravitl/netmaker · GHSA-ch3w-9456-38v3

high2026-03-09

CVE-2026-29194-Netmaker has Insufficient Authorization in Host Token Verification

gravitl/netmaker · GHSA-hmqr-wjmj-376c

high2026-03-09

CVE-2026-28513-Pocket ID: OIDC authorization code validation uses AND instead of OR, allowing cross-client token exchange

pocket-id/pocket-id · GHSA-qh6q-598w-w6m2

high2026-03-09

CVE-2026-28512-Pocket ID: OAuth redirect_uri validation bypass via userinfo/host confusion

pocket-id/pocket-id · GHSA-9h33-g3ww-mqff

high2026-03-09

CVE-2026-25041-@budibase/server: Command Injection in PostgreSQL Dump Command

budibase/budibase · GHSA-726g-59wr-cj4c

medium2026-03-09

CVE-2026-25604-Apache Airflow AWS Auth Manager has Host Header Injection Leading to SAML Authentication Bypass

apache/airflow · GHSA-rv5f-ccpm-xjj4

high2026-03-09

CVE-2025-69219-Apache Airflow Providers Http has Unsafe Pickle Deserializatio leading to RCE via HttpOperator

apache/airflow · GHSA-9r5j-7r2x-rv4g

critical2026-03-09

CVE-2026-24015-Apache IoTDB has an Insecure Default Configuration Vulnerability

apache/iotdb · GHSA-74cf-pgh9-m5q2

critical2026-03-09

CVE-2026-24713-Apache IoTDB has an Improper Input Validation vulnerability

apache/iotdb · GHSA-6w48-2g9j-v9q5

high2026-03-07

CVE-2026-24308-Apache ZooKeeper has improper handling of configuration values

apache/zookeeper · GHSA-crhr-qqj8-rpxc

high2026-03-07

CVE-2026-24281-Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager

apache/zookeeper · GHSA-7xrh-hqfc-g7qr

high2026-03-07

CVE-2025-14675-Meta Box Plugin for WordPress: Authenticated (Contributor+) Arbitrary File Deletion via ajax_delete_file

wpmetabox/meta-box · GHSA-m4q3-832v-44j6