|
fix: Save response read access check logs errors twice or as warnings
|
mtrezza |
L
|
AI
|
2.9h
|
1.1h
|
Oct 23, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
fix: Save response reveals whether a field is stored to a caller without read access (GHSA-ch64-8phh-m7hc)
|
mtrezza |
XL
|
No
|
0.8h
|
0.5h
|
Oct 23, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
fix: Save response reveals whether a field is stored to a caller without read access (GHSA-ch64-8phh-m7hc)
|
mtrezza |
XL
|
No
|
1.1h
|
0.1h
|
Oct 23, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
fix: Pre-authentication denial of service via email address format regex backtracking (GHSA-9492-427f-466x)
|
mtrezza |
M
|
No
|
1.8h
|
0.1h
|
Oct 22, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
fix: Pre-authentication denial of service via email address format regex backtracking (GHSA-9492-427f-466x)
|
mtrezza |
M
|
No
|
2.2h
|
0.1h
|
Oct 22, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
build: Release
|
parseplatformorg |
XL
|
No
|
1.3h
|
-
|
Oct 21, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
fix: Object create returns field values to a caller without read access (GHSA-qq3r-ppqq-rh6m)
|
mtrezza |
XL
|
No
|
16.1h
|
0.1h
|
Oct 21, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
fix: Object create returns field values to a caller without read access (GHSA-qq3r-ppqq-rh6m)
|
mtrezza |
XL
|
No
|
17.8h
|
0.1h
|
Oct 21, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
fix: Object write with a crafted dot notation key can pollute a shared prototype when the class has a trigger or LiveQuery (GHSA-95hp-82c6-25q5)
|
mtrezza |
XL
|
No
|
1.4h
|
0.1h
|
Oct 20, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
fix: Object write with a crafted dot notation key can pollute a shared prototype when the class has a trigger or LiveQuery (GHSA-95hp-82c6-25q5)
|
mtrezza |
XL
|
No
|
16.1h
|
0.2h
|
Oct 20, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
fix: Session upgrade endpoint creates an additional session from an already revocable session token (GHSA-2j2x-c587-q33g)
|
mtrezza |
M
|
No
|
1.4h
|
0.1h
|
Oct 20, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
fix: Session upgrade endpoint creates an additional session from an already revocable session token (GHSA-2j2x-c587-q33g)
|
mtrezza |
M
|
No
|
2.2h
|
0.1h
|
Oct 20, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
fix: Object write with a null dot notation key can corrupt a field or make reads fail on MongoDB (GHSA-655c-2xf3-77x9)
|
mtrezza |
L
|
No
|
3.3h
|
0.1h
|
Oct 19, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
fix: Object write with a null dot notation key can corrupt a field or make reads fail on MongoDB (GHSA-655c-2xf3-77x9)
|
mtrezza |
L
|
No
|
6.3h
|
0.1h
|
Oct 19, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
fix: Object update with a dot notation key below a pointer field can terminate the server process (GHSA-wc3c-6843-q7mv)
|
mtrezza |
L
|
No
|
3.6h
|
0.2h
|
Oct 19, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
fix: Object update with a dot notation key below a pointer field can terminate the server process (GHSA-wc3c-6843-q7mv)
|
mtrezza |
L
|
No
|
5.7h
|
0.2h
|
Oct 19, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
docs: Clarify read access rules for update responses
|
mtrezza |
XS
|
AI
|
0.8h
|
0.1h
|
Oct 18, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
docs: Document how read access limits update responses
|
mtrezza |
S
|
AI
|
0.8h
|
0.1h
|
Oct 18, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
fix: Object update returns stored field values to a caller without read access (GHSA-2rcp-jc67-vq74)
|
mtrezza |
XL
|
AI
|
30.1h
|
0.1h
|
Oct 18, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
fix: Object update returns stored field values to a caller without read access (GHSA-2rcp-jc67-vq74)
|
mtrezza |
XL
|
AI
|
34.4h
|
0.1h
|
Oct 18, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
refactor: Track visited roles in a set during role hierarchy resolution
|
mtrezza |
M
|
AI
|
0.7h
|
0.1h
|
Oct 16, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
build: Release
|
parseplatformorg |
XL
|
No
|
7.1h
|
-
|
Oct 16, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
fix: Option `requestKeywordDenylist` does not apply to query parameters `keys`, `include` and `excludeKeys`
|
mtrezza |
M
|
AI
|
1.4h
|
0.0h
|
Oct 16, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
fix: Installation update is written to the installation named by the request's installation ID instead of the addressed object (GHSA-8j8q-73xx-w3m4)
|
mtrezza |
M
|
No
|
1.0h
|
0.1h
|
Oct 15, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
fix: Object write with a crafted key can pollute a shared prototype and cause denial of service (GHSA-rx55-fw4j-pvpx)
|
mtrezza |
L
|
No
|
0.8h
|
0.1h
|
Oct 15, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
fix: Object write with a crafted key can pollute a shared prototype and cause denial of service (GHSA-rx55-fw4j-pvpx)
|
mtrezza |
L
|
No
|
1.4h
|
0.1h
|
Oct 15, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
fix: Object update returns the stored value of a field reverted in `beforeSave` to a caller without read access (GHSA-9rvr-f5hc-9f2f)
|
mtrezza |
L
|
No
|
11.5h
|
0.2h
|
Oct 15, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
fix: Object update returns the stored value of a field reverted in `beforeSave` to a caller without read access (GHSA-9rvr-f5hc-9f2f)
|
mtrezza |
L
|
No
|
13.6h
|
0.1h
|
Oct 15, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
fix: Object write with a dot notation key can skip `afterSave` triggers and LiveQuery events (GHSA-969q-274f-mc7w)
|
mtrezza |
XL
|
No
|
5.2h
|
0.1h
|
Oct 14, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
fix: Object write with a dot notation key can skip `afterSave` triggers and LiveQuery events (GHSA-969q-274f-mc7w)
|
mtrezza |
XL
|
No
|
10.7h
|
0.1h
|
Oct 14, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
fix: Relation `$relatedTo` query using an operator instead of an object ID bypasses owning-object ACL (GHSA-58m4-cqvw-4vgh)
|
mtrezza |
M
|
No
|
7.3h
|
0.1h
|
Oct 11, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
fix: Relation `$relatedTo` query using an operator instead of an object ID bypasses owning-object ACL (GHSA-58m4-cqvw-4vgh)
|
mtrezza |
M
|
No
|
7.6h
|
0.1h
|
Oct 11, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
fix: SMS MFA login code request saves other login request fields with master privileges (GHSA-9rh6-r4ph-367v)
|
mtrezza |
M
|
No
|
1.0h
|
0.1h
|
Oct 11, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
fix: SMS MFA login code request saves other login request fields with master privileges (GHSA-9rh6-r4ph-367v)
|
mtrezza |
M
|
No
|
1.9h
|
0.1h
|
Oct 11, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
fix: LiveQuery subscriptions using a `$or` query can receive another user's events, including session tokens (GHSA-349r-988w-x3jp)
|
mtrezza |
L
|
No
|
2.9h
|
0.1h
|
Oct 10, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
fix: LiveQuery subscriptions using a `$or` query can receive another user's events, including session tokens (GHSA-349r-988w-x3jp)
|
mtrezza |
L
|
No
|
3.5h
|
0.1h
|
Oct 10, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
fix: Malformed query operators `$or`, `$and`, `$nor`, `$options` cause internal server error
|
mtrezza |
XL
|
AI
|
1.9h
|
0.2h
|
Oct 10, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
fix: Custom auth adapters that extend the AuthAdapter class accept any authData (GHSA-rq3w-5c6f-p7wr)
|
mtrezza |
XL
|
No
|
4.8h
|
0.1h
|
Oct 10, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
fix: Custom auth adapters that extend the AuthAdapter class accept any authData (GHSA-rq3w-5c6f-p7wr)
|
mtrezza |
XL
|
No
|
7.7h
|
0.1h
|
Oct 10, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
fix: Login with master key overwrites stored MFA settings of user
|
mtrezza |
XL
|
AI
|
0.6h
|
0.1h
|
Oct 09, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
build: Release
|
parseplatformorg |
XL
|
No
|
1.9h
|
-
|
Oct 09, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
fix: Unauthenticated deletion of class schemas removes class-level permissions on MongoDB (GHSA-qmg9-m772-5rm7)
|
mtrezza |
M
|
No
|
1.1h
|
0.1h
|
Oct 08, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
fix: Unauthenticated deletion of class schemas removes class-level permissions on MongoDB (GHSA-qmg9-m772-5rm7)
|
mtrezza |
M
|
No
|
1.7h
|
0.1h
|
Oct 08, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
fix: Object write with a reserved field name can make reads fail on MongoDB (GHSA-gwrq-q25v-g8mr)
|
mtrezza |
L
|
No
|
1.7h
|
0.6h
|
Oct 08, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
fix: Object write with a reserved field name can make reads fail on MongoDB (GHSA-gwrq-q25v-g8mr)
|
mtrezza |
L
|
No
|
2.3h
|
0.1h
|
Oct 08, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
fix: Batch and direct access requests fail for object IDs without alphanumeric characters or class names without letters
|
mtrezza |
M
|
AI
|
1.0h
|
0.1h
|
Oct 07, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
fix: GraphQL API fails when a class name or mutation alias collides with a built-in name
|
mtrezza |
L
|
AI
|
2.6h
|
0.1h
|
Oct 07, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
build: Release
|
parseplatformorg |
XL
|
No
|
6.5h
|
-
|
Oct 05, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
fix: User update accepts an empty username or password
|
mtrezza |
M
|
AI
|
0.8h
|
0.1h
|
Oct 05, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|
|
test: User update without session does not reveal whether a username or email is taken
|
mtrezza |
M
|
AI
|
0.6h
|
0.1h
|
Oct 05, 2026
|
LLM analysis pending
This PR has not been analyzed yet.
|