CVE-2026-65654

github.com/temporalio/ringpop-go enforces configured LabelOptions limits when an application changes the local node's labels, but affected versions do not apply those limits to label maps received in SWIM membership changes. A network peer that can reach a live Ringpop TChannel listener can...

CVE-2026-65654 temporalio/ringpop-go fails to enforce configured label limits on inbound membership gossip

github.com/temporalio/ringpop-go enforces configured LabelOptions limits when an application changes the local node's labels, but affected versions do not apply those limits to label maps received in SWIM membership changes. A network peer that can reach a live Ringpop TChannel listener can...

CVE-2026-65654

CVE-2026-65654 affects github.com/temporalio/ringpop-go , a Go library implementing the SWIM membership protocol used by Temporal. The vulnerability is a missing enforcement of configured LabelOptions limits on inbound gossip: while local label changes are validated, label maps received from peer...

CVE-2026-65654 temporalio/ringpop-go fails to enforce configured label limits on inbound membership gossip

github.com/temporalio/ringpop-go enforces configured LabelOptions limits when an application changes the local node's labels, but affected versions do not apply those limits to label maps received in SWIM membership changes. A network peer that can reach a live Ringpop TChannel listener can...

EUVD-2026-83895

github.com/temporalio/ringpop-go enforces configured LabelOptions limits when an application changes the local node's labels, but affected versions do not apply those limits to label maps received in SWIM membership changes. A network peer that can reach a live Ringpop TChannel listener can...

CVE-2026-65654 temporalio/ringpop-go fails to enforce configured label limits on inbound membership gossip

github.com/temporalio/ringpop-go enforces configured LabelOptions limits when an application changes the local node's labels, but affected versions do not apply those limits to label maps received in SWIM membership changes. A network peer that can reach a live Ringpop TChannel listener can...

PT-2026-96077

Name of the Vulnerable Software and Affected Versions github.com/temporalio/ringpop-go affected versions not specified Description The software fails to apply configured LabelOptions limits to label maps received during SWIM membership changes. A network peer with access to a live Ringpop TChanne...

CVE-2026-65654: Allocation of Resources Without Limits or Throttling

github.com/temporalio/ringpop-go enforces configured LabelOptions limits when an application changes the local node's labels, but affected versions do not apply those limits to label maps received in SWIM membership changes. A network peer that can reach a live Ringpop TChannel listener can...

Malicious code in @kl-dolphin/swim (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 799f1e9f18de306eaf0e84079501a9b01d2d1d1085ac9f119fa8e047b43a90ac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview @kl-dolphin/swim is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-6402 Malicious code in @kl-dolphin/swim (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 799f1e9f18de306eaf0e84079501a9b01d2d1d1085ac9f119fa8e047b43a90ac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

VulnCheck KEV: CVE-2015-5471

Absolute path traversal vulnerability in include/user/download.php in the Swim Team plugin 1.44.10777 for WordPress allows remote attackers to read arbitrary files via a full pathname in the file parameter...

Malicious code in @marcos_feitoza/timer-tracker-swim (npm)

The package @marcosfeitoza/timer-tracker-swim was found to contain malicious code...

MAL-2025-9097 Malicious code in @marcos_feitoza/timer-tracker-swim (npm)

The package @marcosfeitoza/timer-tracker-swim was found to contain malicious code...

swim-sm.eu Cross Site Scripting vulnerability OBB-3947982

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

web.metroswimshop.com Cross Site Scripting vulnerability OBB-3700620

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

swim-h2020.eu Cross Site Scripting vulnerability OBB-3311403

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

swim-sm.eu Cross Site Scripting vulnerability OBB-2897129

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

swim-school.auksys.com Cross Site Scripting vulnerability OBB-2567848

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

swim-performance.de Improper Access Control vulnerability OBB-2215906

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...