monkey

Monkey documentation This folder contains the Monkey Documentation site. For more information see content/development/contribute-documentation.md...

Apache Tika - XXE Injection

Apache Tika versions 1.13 through 3.2.1 are vulnerable to XXE via malicious XFA in PDFs, allowing file read and SSRF attacks. id: CVE-2025-54988 info: name: Apache Tika - XXE Injection author: tx1ee severity: critical description: | Apache Tika versions 1.13 through 3.2.1 are vulnerable to XXE vi...

PT-2026-104445

UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine registered email addresses by observing differing HTTP responses from the POST /api/account/reset-password/init endpoint. Attackers can submit arbitrary email addresses and...

Uncaught Exception

Overview astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind. Affected versions of this package are vulnerable to Uncaught Exception via createRequest and createRequestFromNodeRequest in node.ts when processing a request with a malformed port valu...

The vulnerability of the CreateInstanceFromBackup() function in the `internal/server/storage/backend.go` file of the container management system and the virtual machine manager Incus allows a attacker to trigger a service failure.

The vulnerability of the CreateInstanceFromBackup function in the internal/server/storage/backend.go file of the container management system and the virtual machine manager Incus is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause service interruptio...

The vulnerability of the CreateCustomVolumeFromBackup() function in the `internal/server/storage/backend.go` file of the container management system and the virtual machine manager Incus allows a attacker to trigger a service failure.

The vulnerability of the CreateCustomVolumeFromBackup function in the internal/server/storage/backend.go file of the container management system and the virtual machine manager software Incus is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a...

OpenAI Agent Bypassed Australian Medicare Portal Controls to Access Non-Public Files

An AI agent on an internal OpenAI research task bypassed access controls on an Australian government Medicare statistics portal in June, Prime Minister Anthony Albanese said. The portal publishes aggregate figures, such as spending, and is separate from the systems that handle Medicare claims and...

CVE-2026-96672

Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculationformula values reference whitelisted methods before passing them to frappe.call. Accounts Managers can supply arbitrary dotted Python paths to invoke non-whitelisted internal server-side methods and...

CVE-2026-55179 Joplin: Logic error in Joplin Server allows a signed-in user to read any note from its internal server ID

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /items/:id/content route in packages/server/src/routes/index/items.ts loads item content from an attacker-supplied internal server ID without checking...

CVE-2026-55179 Joplin: Logic error in Joplin Server allows a signed-in user to read any note from its internal server ID

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /items/:id/content route in packages/server/src/routes/index/items.ts loads item content from an attacker-supplied internal server ID without checking...

EUVD-2025-210804

HCL Connections is vulnerable to server-side request forgery SSRF when an internal server is compromised possibly allowing an attacker to send unauthorized requests in certain scenarios leading to information disclosure or security bypass...

CVE-2025-62341

HCL Connections is vulnerable to server-side request forgery SSRF when an internal server is compromised possibly allowing an attacker to send unauthorized requests in certain scenarios leading to information disclosure or security bypass...

CVE-2025-62341

HCL Connections contains a server-side request forgery (SSRF) vulnerability that becomes exploitable when an internal server is compromised. In certain scenarios, an attacker can send unauthorized requests, potentially leading to information disclosure or security bypass . The CVSS 3.1 base score...

CVE-2025-62341 HCL Connections is vulnerable to server-side request forgery (SSRF)

HCL Connections is vulnerable to server-side request forgery SSRF when an internal server is compromised possibly allowing an attacker to send unauthorized requests in certain scenarios leading to information disclosure or security bypass...

CVE-2025-62341 HCL Connections is vulnerable to server-side request forgery (SSRF)

HCL Connections is vulnerable to server-side request forgery SSRF when an internal server is compromised possibly allowing an attacker to send unauthorized requests in certain scenarios leading to information disclosure or security bypass...

PT-2026-82328

Name of the Vulnerable Software and Affected Versions HCL Connections affected versions not specified Description HCL Connections is susceptible to server-side request forgery SSRF, a flaw that occurs when a server is tricked into making requests to an unintended location. This issue arises when ...

CVE-2026-48754: NULL Pointer Dereference

Incus is a system container and virtual machine manager. Prior to version 7.1.0, backend.createDependentVolumesFromBackup in internal/server/storage/backend.go contains a cluster of unguarded pointer derefs on every dependent-volume entry's VolumeSnapshotsi, Volume, and Pool sub-fields. An...

CVE-2026-48756: NULL Pointer Dereference

Incus is a system container and virtual machine manager. Prior to version 7.1.0, backend.CreateCustomVolumeFromBackup in internal/server/storage/backend.go contains an unguarded time.Time dereference on the ExpiresAt field of every volume-snapshot entry in an imported custom-volume backup. An...

CVE-2026-71250 Firefly III - Webhook URL Validation Explicitly Allows Loopback and Is Bypassable via DNS Rebinding

Firefly III's webhook URL validator IsValidWebhookUrl.php filters most private/reserved IPv4 ranges but contains an explicit early-return that allows any resolved address in 127.0.0.0/8, permitting an authenticated user with webhooks enabled, which is off by default to configure a webhook targeti...

Amazon Linux 2023 : openvpn, openvpn-devel (ALAS2023-2026-2038)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2038 advisory. OpenVPN memory-leak in tls-crypt-v2 client key handling that could lead to out-of-memory situations and subsequent server crashes CVE-2026-12932 When dynamic tls-crypt is active, it is possibl...