CVE-2026-118762 is a critical vulnerability in the Monkeytype repository's CI workflow prior to version 26.43.0. The GitHub Actions workflow runs with repository write permissions on pull_request_target events and executes code from forked pull requests with elevated privileges. This allows an external contributor to execute arbitrary code, access the GITHUB_TOKEN, and potentially push changes or modify pull requests and issues. The vulnerability affects only the repository's CI workflow, not the Monkeytype application or user data. The issue is fixed in version 26.43.0.
CVE-2026-115805 is a high-severity vulnerability in Rapid7 Insight Agent on Linux and macOS. It involves improper neutralization of special elements in OS commands due to unsafe handling of local filesystem paths. Authenticated local users with existing access can exploit this flaw to gain elevated privileges. The vulnerability is fixed in version 4.1.4.43.
The decode-uri-component package has a denial of service vulnerability due to quadratic time complexity when processing malformed inputs with many distinct percent-encoded runs. An attacker can craft a payload of about 224 KB that causes the Node.js event loop to block for approximately 20 seconds, making the application unresponsive. This affects version 0.5.0 and earlier. The issue arises because the fallback decoding function performs multiple regex replacements proportional to the number of distinct encoded runs, leading to O(K·L) complexity. The vulnerability impacts availability only, with no confidentiality or integrity effects. It is fixed in version 0.5.1.
An unauthenticated remote denial of service vulnerability exists in the Twisted HTTP/2 server due to improper handling of rapid stream resets. A remote client can send a request with END_STREAM followed immediately by a stream reset, causing the server to render the request fully before processing the reset. This allows repeated rapid resets on a single connection to exhaust CPU resources, bypassing the concurrent-stream limit. The issue affects Twisted versions prior to 26.10.0rc1 and has no impact on confidentiality or integrity.
A denial of service vulnerability exists in the zip crate versions 5.1.0 up to but not including 9.0.0 when the legacy-zip feature is enabled. An attacker can craft a malicious ZIP64 archive with an uncompressed size set to an extremely large value, causing a capacity overflow panic in the Shrink decoder during extraction. This panic terminates the affected process, leading to denial of service. The issue arises because the decoder reserves output buffer capacity based on the uncompressed size from ZIP metadata before validating the compressed data size. This vulnerability is fixed in version 9.0.0.
A vulnerability in the zip crate (versions 7.2.0 up to but not including 9.0.0) allows an attacker to write arbitrary files outside the intended extraction directory by exploiting symlink validation flaws. The issue arises because the path validation is purely lexical and absolute symlink targets are not properly rejected, enabling directory traversal outside the extraction target. This is especially impactful on Windows, where a single symlink can redirect extraction to a different drive or remote share. The vulnerability requires the attacker to know or guess the absolute extraction path. The issue was introduced by a change in path handling in version 7.2.0 and fixed in version 9.0.0.
A vulnerability in the zip crate's AES-encrypted entry handling allows an attacker to bypass HMAC authentication if the entry's declared compressed size exceeds the actual data length, causing premature EOF. This results in truncated, unauthenticated plaintext being accepted without error. Zero-payload entries also bypass authentication. The flaw affects versions from 0.6.0 up to but not including 9.0.0 and is fixed in version 9.0.0.
A vulnerability in the zip crate (versions >=1.3.0 <9.0.0) allows an attacker to cause an uncatchable process abort during extraction by specifying an unbounded symlink target size. The flaw arises because the symbolic-link extraction code allocates memory based on an attacker-controlled size from the ZIP central directory without bounds checking. This leads to an infallible allocation failure that aborts the process, causing denial of service. The issue is fixed in version 9.0.0.
A vulnerability in Vite dev server allows bypassing the server.fs.deny file access restrictions via crafted query parameters. This affects applications that expose the Vite dev server to the network and have sensitive files in allowed directories that are supposed to be denied. The issue was fixed in version 6.4.5.
A vulnerability in the Shopify App's token-exchange authentication allowed cross-shop authorization bypass due to confusion between the authenticated shop context and the shop specified in the request parameter. This could lead to unauthorized access or actions in another shop's context if the application used the vulnerable helpers for security-sensitive decisions. The issue is fixed in shopify_app version 23.0.3.
cert-manager versions prior to 1.19.6 and 1.20.3 allow namespace users with permission to create ACME Challenge resources to bypass Issuer and ClusterIssuer DNS01 solver policies. This occurs because the controller accepts attacker-controlled DNS provider configurations from Challenge.spec.solver without validating ownership or solver restrictions. This can lead to unauthorized use of DNS credentials or credential disclosure, particularly with acme-dns providers.
Keycloak versions prior to 26.6.4 contain a cross-site scripting (XSS) vulnerability that allows a remote attacker with administrative privileges and specific permissions to bypass client URI validation. This is done by registering a malicious client with a specially crafted redirect URI using a case-insensitive javascript: or data: scheme. The vulnerability enables arbitrary code execution in the Keycloak origin when a victim interacts with crafted links, such as during logout or in the Admin Console. A fix is available in version 26.6.4.
CVE-2026-11587 is a high-severity SQL injection vulnerability in Centreon affecting versions 24.10 and 25.10. It allows an authenticated user with access to ACL management to read and modify the Centreon database. The vulnerability is fixed in centreon-web versions 24.10.28 and 25.10.15.
A vulnerability in Keycloak allows a realm administrator with the "manage-realm" role to disclose information by submitting arbitrary filesystem paths as keystore parameters when creating a key provider component. This flaw enables probing of filesystem paths to determine file existence and readability by the Keycloak process, potentially aiding further attacks. The issue affects Keycloak versions prior to 26.6.4. A fix is available in version 26.6.4.
A vulnerability in org.keycloak:keycloak-services allows an authenticated user with a User-Managed Access (UMA) permission ticket for one resource to bypass per-resource access controls and gain unauthorized access to all resources of that type within the same resource server. This issue occurs when the resource server is configured in PERMISSIVE policy enforcement mode and affects typed resources with ownerManagedAccess enabled without explicit policies protecting the resource type. The vulnerability can lead to unauthorized information disclosure or modification of resources. A fix is available in version 26.6.4.
Kubeflow Pipelines prior to version 2.18.0 contains a vulnerability where the API server decompresses uploaded pipeline archives without properly limiting the expanded data size. This can lead to excessive memory consumption and resource exhaustion, potentially causing a denial of service. The vulnerability arises because decompression occurs before namespace authorization during multipart uploads, allowing unauthenticated callers to trigger resource exhaustion. The issue is fixed in version 2.18.0.
A vulnerability in Keycloak Policy Enforcer allows any authenticated user to bypass all authorization policies, including role, scope, and UMA permission checks. This occurs when an attacker includes the configured access-denied page path within a request URL, either as a path segment or a query parameter, enabling unauthorized access to protected resources. The flaw affects Keycloak versions prior to 26.6.4 and 26.0.10. A fix is available in these versions.
CVE-2026-119115 is an incorrect authorization vulnerability in AWS Private CA Connector for Kubernetes (aws-privateca-issuer) before version 1.10.1. It allows an authenticated remote user to obtain certificates, including subordinate CA certificates, signed by a cluster-scoped AWS Private CA issuer that their approval policy does not authorize. The issue is fixed in version 1.10.1 and the corresponding EKS add-on version 1.10.1-eksbuild.1. Users must upgrade and ensure issuerRef.kind fields are correctly set to AWSPCAIssuer or AWSPCAClusterIssuer to match the referenced issuer.
A vulnerability in Keycloak's client registration service allows an attacker with a previously issued Registration Access Token (RAT) to re-enable clients that an administrator has disabled. This enables the attacker to reset the client's secret and potentially regain privileged API access, leading to unauthorized information disclosure and integrity compromise. The issue affects versions prior to 26.6.4 and has been assigned CVE-2026-9705 with a CVSS score of 6.5 (medium severity). A patch is available in version 26.6.4.