https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 12:12:24 +0000 https://cve.radiocsirt.org/vuln/bit-parse-2026-66009 <p><strong>Affected:</strong> Bitnami: parse</p> <p>Parse Server versions &gt;= 9.0.0 before 9.10.0 and &gt;= 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled (graphQLPublicIntrospection: false, the default). A client holding only the public application id — with no user session, master key, or maintenance key — can trigger validation errors to learn the names of required (non-null) custom fields on classes it already references by name, partially defeating the schema-hiding intent of disabling public introspection. No stored data, credentials, optional field names, unreferenced class names, or Cloud Code function names are exposed.</p> <p><strong>Affected:</strong> Bitnami: parse</p> <p>Parse Server versions &gt;= 9.0.0 before 9.10.0 and &gt;= 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled (graphQLPublicIntrospection: false, the default). A client holding only the public application id — with no user session, master key, or maintenance key — can trigger validation errors to learn the names of required (non-null) custom fields on classes it already references by name, partially defeating the schema-hiding intent of disabling public introspection. No stored data, credentials, optional field names, unreferenced class names, or Cloud Code function names are exposed.</p> https://cve.radiocsirt.org/vuln/bit-parse-2026-66009 https://cve.radiocsirt.org/vuln/euvd-2026-341526 EUVD-2026-341526 https://cve.radiocsirt.org/vuln/euvd-2026-341526 https://cve.radiocsirt.org/vuln/fkie_cve-2026-66009 <p>Parse Server versions &gt;= 9.0.0 before 9.10.0-alpha.5 and &gt;= 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled (graphQLPublicIntrospection: false, the default). A client holding only the public application id — with no user session, master key, or maintenance key — can trigger validation errors to learn the names of required (non-null) custom fields on classes it already references by name, partially defeating the schema-hiding intent of disabling public introspection. No stored data, credentials, optional field names, unreferenced class names, or Cloud Code function names are exposed.</p> <p>Parse Server versions &gt;= 9.0.0 before 9.10.0-alpha.5 and &gt;= 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled (graphQLPublicIntrospection: false, the default). A client holding only the public application id — with no user session, master key, or maintenance key — can trigger validation errors to learn the names of required (non-null) custom fields on classes it already references by name, partially defeating the schema-hiding intent of disabling public introspection. No stored data, credentials, optional field names, unreferenced class names, or Cloud Code function names are exposed.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-66009 https://cve.radiocsirt.org/vuln/ghsa-v9g2-r7jf-7j84 <p>Parse Server versions &gt;= 9.0.0 before 9.10.0-alpha.5 and &gt;= 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled (graphQLPublicIntrospection: false, the default). A client holding only the public application id — with no user session, master key, or maintenance key — can trigger validation errors to learn the names of required (non-null) custom fields on classes it already references by name, partially defeating the schema-hiding intent of disabling public introspection. No stored data, credentials, optional field names, unreferenced class names, or Cloud Code function names are exposed.</p> <p>Parse Server versions &gt;= 9.0.0 before 9.10.0-alpha.5 and &gt;= 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled (graphQLPublicIntrospection: false, the default). A client holding only the public application id — with no user session, master key, or maintenance key — can trigger validation errors to learn the names of required (non-null) custom fields on classes it already references by name, partially defeating the schema-hiding intent of disabling public introspection. No stored data, credentials, optional field names, unreferenced class names, or Cloud Code function names are exposed.</p> https://cve.radiocsirt.org/vuln/ghsa-v9g2-r7jf-7j84