monkey

Monkey documentation This folder contains the Monkey Documentation site. For more information see content/development/contribute-documentation.md...

Apache Tika - XXE Injection

Apache Tika versions 1.13 through 3.2.1 are vulnerable to XXE via malicious XFA in PDFs, allowing file read and SSRF attacks. id: CVE-2025-54988 info: name: Apache Tika - XXE Injection author: tx1ee,s4e-io severity: critical description: | Apache Tika versions 1.13 through 3.2.1 are vulnerable to...

CVE-2026-126392

Parse Server from 9.10.6-alpha.1 before 9.10.8-alpha.1 contains an information disclosure vulnerability that allows clients with write but not read access to learn whether fields are stored on MongoDB. Attackers can send updates with dot notation operations on top-level fields and observe interna...

EUVD-2026-121708

pgEdge RAG Server discloses part of the configured provider credential through API error messages...

CVE-2026-125326

pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query API in internal/server/handlers.go returns err.Error from failed LLM provider calls, preserving provider-controlled error text that can quote a...

CVE-2026-125326

pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query API in internal/server/handlers.go returns err.Error from failed LLM provider calls, preserving provider-controlled error text that can quote a...

CVE-2026-125326 pgEdge RAG Server discloses part of the configured provider credential through API error messagespgEdge RAG Server discloses part of the configured provider credential through API error messages

pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query API in internal/server/handlers.go returns err.Error from failed LLM provider calls, preserving provider-controlled error text that can quote a...

CVE-2026-125326 pgEdge RAG Server discloses part of the configured provider credential through API error messagespgEdge RAG Server discloses part of the configured provider credential through API error messages

pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query API in internal/server/handlers.go returns err.Error from failed LLM provider calls, preserving provider-controlled error text that can quote a...

CVE-2026-125326

The pgEdge RAG Server contains a vulnerability in its unauthenticated query API (specifically within internal/server/handlers.go ) affecting versions prior to 2.0.0 . The software improperly returns err.Error() from failed LLM provider calls, which can preserve provider-controlled error text cont...

CVE-2026-125326 pgEdge RAG Server discloses part of the configured provider credential through API error messagespgEdge RAG Server discloses part of the configured provider credential through API error messages

pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query API in internal/server/handlers.go returns err.Error from failed LLM provider calls, preserving provider-controlled error text that can quote a...

PT-2026-144093

Name of the Vulnerable Software and Affected Versions pgEdge RAG Server versions prior to 2.0.0 Description The unauthenticated query API in internal/server/handlers.go returns error messages from failed LLM provider calls. These responses can include provider-controlled text that quotes a...

Exploit for CVE-2026-101259

CVE-2026-101259 — camel-coap: the consumer sent the exception...

PT-2026-132427

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have retrieved sensitive internal server credentials due to improper filtering of internal...

CVE-2026-101259

Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CoAP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2. When the CoAP consumer could not build its response once the route had completed, CamelCoapResource caug...

EUVD-2026-109667

Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CoAP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2. When the CoAP consumer could not build its response once the route had completed, CamelCoapResource caug...

CVE-2026-101259 Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions

Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CoAP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2. When the CoAP consumer could not build its response once the route had completed, CamelCoapResource caug...

CVE-2026-101259 Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions

Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CoAP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2. When the CoAP consumer could not build its response once the route had completed, CamelCoapResource caug...

CVE-2026-101259 Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions

Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CoAP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2. When the CoAP consumer could not build its response once the route had completed, CamelCoapResource caug...

CVE-2026-101259

The Apache Camel CoAP component is vulnerable to information disclosure due to unmuted consumer exceptions in versions 4.0.0 to 4.18.4 , 4.19.0 to 4.22.1 , and 4.23.0 (specifically before 4.23.0). When a CoAP consumer fails to build a response after a route completes—typically due to a type conve...

Apache Camel information disclosure vulnerability

Vulnerabilities related to information disclosure exist in Apache Camel versions 4.0.0 through 4.18.5 and 4.19.0 through 4.22.2. These vulnerabilities arise when a CoAP consumer fails to perform type conversion after routing is completed; as a result, CamelCoapResource captures an exception and...