low · CVSS v3 3.1 · CVSS v4 2.3

CVE-2026-122301

Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 returns field values in object create responses to callers t…

Description

Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 returns field values in object create responses to callers that lack read access to the created object through class-level permissions or the object's ACL. An attacker with create permission can create objects to obtain values set by Cloud Code triggers, schema defaults, and the class default ACL.

Scores

Severity
low
CVSS v2
2.1
CVSS v3
3.1
CVSS v4
2.3
EPSS
—

← All CVEs

Related CVEs

low

CVE-2026-107776

The Dokan WordPress plugin before 5.3.3 does not reconcile the amount credited to a vendor's reverse-withdrawal ledger against the amount actually collected for the payment order, allowing a vendor to clear their outstanding commission debt while paying less than the balance owed when a discount coupon is applied at checkout.

View analysis

low

CVE-2026-108838

IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain a vulnerability that allows a local attacker to trigger uncontrolled resource consumption. This flaw can lead to a denial of service condition on the affected system.

View analysis

low

CVE-2026-116376

IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain an open redirect flaw that can be exploited by a remote authenticated user to facilitate phishing attacks. The vulnerability allows attackers to redirect users to malicious sites after authentication, potentially compromising credentials or delivering malware. It is considered low severity but still relevant for environments that rely on this product.

View analysis

low

CVE-2026-121745

Node Version Manager (nvm) versions 0.40.0 through 0.40.8 expose authentication credentials in process arguments when downloading from private mirrors. This allows other local users on the same system to read the token via standard process inspection tools. The issue is resolved in version 0.41.0 by passing headers via stdin or private config files.

View analysis