CVE-2026-69183

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...

CVE-2026-69183 Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...

CVE-2026-69183 Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...

EUVD-2026-63423

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...

CVE-2026-73198

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the /ipa/i18nmessages endpoint by sending an arbitrarily large request body. This can cause the service to consume excessive memory, leading to memory exhaustion, degraded responsiveness, and a denial o...

CVE-2026-69183: Authentication Bypass by Spoofing

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...

CVE-2026-76400 Denial of Service (DoS) through the REST API in Splunk Connect for Kafka

In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer REST API and influence responses from a Hypertext Transfer Protocol HTTP Event Collector endpoint in Splunk Enterprise could cause the connector to retry faile...

CVE-2026-69222

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.2, the join filter in src/filters/array.ts computes complexity from array.length and separator length instead of the total string length produced by array.joinsep. The concat filter can cheaply doub...

CVE-2026-69222 LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.2, the join filter in src/filters/array.ts computes complexity from array.length and separator length instead of the total string length produced by array.joinsep. The concat filter can cheaply doub...

CVE-2026-69222 LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.2, the join filter in src/filters/array.ts computes complexity from array.length and separator length instead of the total string length produced by array.joinsep. The concat filter can cheaply doub...

EUVD-2026-62850

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, actix-web ConnectionInfo::realipremoteaddr reads the first value of X-Forwarded-For as the client address used by rawipkey in crates/utils/src/ratelimit/mod.rs. Lemmy's bundled docker/nginx.conf uses...

CVE-2026-54738 Lemmy: Rate limit bypass via X-Forwarded-For header spoofing in actix-web ConnectionInfo

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, actix-web ConnectionInfo::realipremoteaddr reads the first value of X-Forwarded-For as the client address used by rawipkey in crates/utils/src/ratelimit/mod.rs. Lemmy's bundled docker/nginx.conf uses...

CVE-2026-54738 Lemmy: Rate limit bypass via X-Forwarded-For header spoofing in actix-web ConnectionInfo

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, actix-web ConnectionInfo::realipremoteaddr reads the first value of X-Forwarded-For as the client address used by rawipkey in crates/utils/src/ratelimit/mod.rs. Lemmy's bundled docker/nginx.conf uses...

CVE-2026-54738 Lemmy: Rate limit bypass via X-Forwarded-For header spoofing in actix-web ConnectionInfo

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, actix-web ConnectionInfo::realipremoteaddr reads the first value of X-Forwarded-For as the client address used by rawipkey in crates/utils/src/ratelimit/mod.rs. Lemmy's bundled docker/nginx.conf uses...

CVE-2026-54738

Lemmy , a fediverse link aggregator and forum, is vulnerable to rate limit bypass via X-Forwarded-For header spoofing in versions prior to 0.19.19 and 1.0.0-beta.1 . The root cause is that actix-web's ConnectionInfo::realip_remote_addr reads the first value of X-Forwarded-For as the client addres...

BIT-GOLANG-2026-33818 Enforce maximum recursion depth in encoding/asn1

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...

SUSE-SU-2026:23300-1 Security update for go1.25

This update for go1.25 fixes the following issues: Update to go1.25.13 released 2026-08-13, bsc1244485. Security issues fixed: - CVE-2026-33818: encoding/asn1: unenforced recursion limit can lead to stack exhaustion when parsing deeply-nested, recursive structures bsc1275034. - CVE-2026-39821:...

PT-2026-78696

Name of the Vulnerable Software and Affected Versions Lemmy versions prior to 0.19.19 Lemmy versions prior to 1.0.0-beta.1 Description An issue exists where the ConnectionInfo::realip remote addr function in actix-web reads the first value of the X-Forwarded-For header as the client address used ...

PT-2026-79919

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...

CVE-2026-69222: Uncontrolled Resource Consumption

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.2, the join filter in src/filters/array.ts computes complexity from array.length and separator length instead of the total string length produced by array.joinsep. The concat filter can cheaply doub...