EUVD-2026-70482

Helicone's VaultManager.getDecryptedProviderKeyById function in the GET /v1/vault/key/providerKeyId endpoint fails to validate the requester's organization against the vault key's organization identifier. Attackers with admin or owner privileges in any organization can retrieve decrypted upstream...

js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing

A flaw was found in js-yaml, a JavaScript YAML parser. An attacker can exploit this by providing a specially crafted YAML document that causes the parser to perform excessive processing when handling merge keys with empty sources. This can lead to prolonged CPU consumption, effectively causing a...

js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing

A flaw was found in js-yaml, a JavaScript YAML parser. An attacker can exploit this by providing a specially crafted YAML document that causes the parser to perform excessive processing when handling merge keys with empty sources. This can lead to prolonged CPU consumption, effectively causing a...

EUVD-2026-70403

n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability in the Git node. The node reset a fixed list of command-bearing configuration keys before each operation, but that list did not cover the content-filter and merge-driver key families. A repository with...

PT-2026-85037

The PyPI Incident as the Harm Threshold Marker Of the four incidents, the Mythos 5 PyPI package upload is the only one confirmed to have produced real-world third-party harm: the package was downloaded and executed by external systems before it was caught Source: TechCrunch, July 31, 2026. The...

PT-2026-85226

node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS1 v1.5 signature verification. Attackers can embed garbage bytes inside the DigestAlgorithm sequence to forge valid signatures for arbitrary messages using low-exponent RSA keys. This is an...

js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing

A flaw was found in js-yaml, a JavaScript YAML parser. An attacker can exploit this by providing a specially crafted YAML document that causes the parser to perform excessive processing when handling merge keys with empty sources. This can lead to prolonged CPU consumption, effectively causing a...

js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing

A flaw was found in js-yaml, a JavaScript YAML parser. An attacker can exploit this by providing a specially crafted YAML document that causes the parser to perform excessive processing when handling merge keys with empty sources. This can lead to prolonged CPU consumption, effectively causing a...

CVE-2026-84655

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and Python API responses...

CVE-2026-84655

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and Python API responses...

EUVD-2026-70121

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and Python API responses...

CVE-2026-84655

Jenkins versions 2.579 and earlier and LTS 2.568.2 and earlier fail to escape map keys when serializing objects as JSON and Python through its REST API. Attackers who can control map property names can inject arbitrary fields into JSON and Python API responses. CISA ADP assesses exploitation as n...

CVE-2026-84655

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and Python API responses...

CVE-2026-84655

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and Python API responses...

CVE-2026-71847

A flaw was found in Ruby JSON. A heap-use-after-free vulnerability exists in the JSON::ResumableParser component. A remote attacker, by supplying a specially crafted JSON stream with truncated duplicate keys, can cause the application to dereference freed memory. This can lead to process...

Injection vulnerability in REST API

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API. This allows attackers able to control map property names to inject arbitrary fields into JSON and Python API responses. Jenkins 2.580, LTS 2.568.3 escapes...

CVE-2026-84375

A flaw was found in js-yaml, a JavaScript YAML parser. An attacker can exploit this by providing a specially crafted YAML document that causes the parser to perform excessive processing when handling merge keys with empty sources. This can lead to prolonged CPU consumption, effectively causing a...

CVE-2026-78597 Missing Authorization in Kibana Entity Store Leading to Unauthorized API Key Creation

Missing Authorization CWE-862 in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only low-privilege Security feature access could invoke an administrative operation tha...

CVE-2026-78597

Kibana 's Entity Store feature is affected by a Missing Authorization flaw (CWE-862) that allows an authenticated user with only low-privilege Security feature access to invoke an administrative operation, creating and persisting Elasticsearch API keys under the caller's identity while bypassing ...

CVE-2026-42393

A flaw was found in dovecot. The comparison mechanism for doveadm passwords and API keys is not fully timing safe. A remote attacker, with network access to the doveadm service, could repeatedly make requests and accurately measure response timings. This could allow the attacker to learn the leng...