80363 matches found
CVE-2026-69183
Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...
CVE-2026-69183 Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)
Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...
CVE-2026-69183
Monkeytype (a typing test application) versions 26.26.0 and earlier contain a rate-limit bypass in the backend key generator (backend/src/middlewares/rate-limit.ts). The generator prioritizes client-controlled cf-connecting-ip and x-forwarded-for headers over the trust-proxy-derived req.ip, allow...
CVE-2026-63044
A Server-Side Request Forgery (SSRF) vulnerability exists in Apache InLong (versions 2.0.0 through 2.3.x) due to an authenticated SSRF via POST /api/node/testConnection . Any authenticated user, regardless of administrative privileges, can force the InLong Manager server to make outbound HTTP req...
CVE-2026-63039
Apache InLong versions 2.0.0 through 2.3.x are vulnerable to an SQL injection (CWE-89) due to improper neutralization of special elements in SQL commands. The root cause is the use of unvalidated MyBatis ${} string interpolation within the AuditAlertRuleEntityMapper.selectByCondition method. Spec...
EUVD-2026-63398
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This appears to allow SQL injection in the ORDER BY clause against the Manager backend database. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgra...
CVE-2026-63016 Apache InLong: Ordinary users can create new packages
Uncontrolled Resource Consumption vulnerability in Apache InLong. Users could affect operational configuration or allow upload of non-official packages. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick 1 to solve it. 1...
CVE-2026-76928
A flaw in Wireshark's X.509IF protocol dissector allows a remote attacker to cause a Denial of Service DoS. By providing a specially crafted capture file or network stream, an attacker can crash the application, making it unavailable. Mitigation Avoid opening untrusted capture files or monitoring...
golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...
EUVD-2026-63166
X.509IF protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...
mysql:8.4 security, bug fix, and enhancement update
An update is available for module.mysql, rapidjson, module.mecab-ipadic, mysql, mecab-ipadic, module.rapidjson, mecab, perl-DBD-MySQL, module.mecab, module.perl-DBD-MySQL. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...
PT-2026-79045
Name of the Vulnerable Software and Affected Versions Apache InLong versions 2.0.0 through 2.3.x Description An issue exists where StreamSource performs no authorization check, allowing any authenticated user to logically delete all stream sources. Recommendations Upgrade to version 2.4.0...
RHEL 9 : libreswan (RHSA-2026:57741)
The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:57741 advisory. Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide...
Deserialization of Untrusted Data
Overview org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the deserialization. An attacker can execute arbitrary code by submitting a crafted GraphQL request containing...
CVE-2026-72861: Improper Verification of Cryptographic Signature
The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src/github.js and in node-typescript/github-issue-bot/src/github.ts returns "typeof signature !== 'string' || await verify...", so when the...
SPIP X-Spip-Filtre Unauthenticated RCE
This module exploits a PHP function-call injection in SPIP's template engine. The analyseresultatskel function extracts patterns from the rendered page body and calls the listed functions as template filters. A newline character is injected into a GET parameter value, which places a header call o...
CVE-2026-50192: Exposure of Sensitive Information to an Unauthorized Actor
Kerberos Agent is an open source video surveillance management agent. Prior to version 3.6.26, the Kerberos Hub upload path sends the agent's Hub credentials in the custom X-Kerberos-Hub-PrivateKey and X-Kerberos-Hub-PublicKey request headers to the operator-configured Hub URL config.HubURI. The...
PT-2026-79386
Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.4.21 Description Unauthenticated remote attackers can execute arbitrary code due to a code injection flaw. This issue occurs when the analyse resultat skel function mishandles the X-Spip-Filtre HTTP request header. Thi...
Linux Distros Unpatched Vulnerability : CVE-2026-76928
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - X.509IF protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service CVE-2026-76928 Note that Nessus relies on the presence of the...
