https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 06:27:09 +0000 https://cve.radiocsirt.org/vuln/cve-2026-61448 <p><strong>Affected:</strong> parse-community parse-server</p> <p>Parse Server is affected by a stored cross-site scripting (XSS) vulnerability in versions &gt;= 9.0.0, &lt; 9.10.0-alpha.2 and &lt;= 8.6.83. When an uploaded file&#39;s extension is not recognized by the mime package, Parse Server preserves the client-supplied Content-Type. A malformed Content-Type that is not a valid type/subtype media type (e.g., &#39;image&#39;, &#39;image/&#39;, or &#39;image//svg+xml&#39;) bypasses the fileUpload.fileExtensions blocklist and is stored unchanged. On storage adapters that persist and serve the uploaded Content-Type (such as Amazon S3, Google Cloud Storage, or Azure Blob Storage), a browser cannot parse the malformed value and falls back to MIME-sniffing; a file whose body begins with HTML is rendered as HTML, executing embedded script in the application&#39;s origin against other users who open the file URL. The default GridFS storage adapter is not affected. Fixed in 9.10.0-alpha.2 and 8.6.84.</p> <p><strong>Affected:</strong> parse-community parse-server</p> <p>Parse Server is affected by a stored cross-site scripting (XSS) vulnerability in versions &gt;= 9.0.0, &lt; 9.10.0-alpha.2 and &lt;= 8.6.83. When an uploaded file&#39;s extension is not recognized by the mime package, Parse Server preserves the client-supplied Content-Type. A malformed Content-Type that is not a valid type/subtype media type (e.g., &#39;image&#39;, &#39;image/&#39;, or &#39;image//svg+xml&#39;) bypasses the fileUpload.fileExtensions blocklist and is stored unchanged. On storage adapters that persist and serve the uploaded Content-Type (such as Amazon S3, Google Cloud Storage, or Azure Blob Storage), a browser cannot parse the malformed value and falls back to MIME-sniffing; a file whose body begins with HTML is rendered as HTML, executing embedded script in the application&#39;s origin against other users who open the file URL. The default GridFS storage adapter is not affected. Fixed in 9.10.0-alpha.2 and 8.6.84.</p> https://cve.radiocsirt.org/vuln/cve-2026-61448