CVE-2026-118766 is a server-side request forgery (SSRF) vulnerability in the Botan C++ cryptography library prior to version 3.13.0. The issue arises from Botan's online OCSP client allowing a single HTTP redirect when posting OCSP requests, which can be exploited by a malicious OCSP responder or an on-path attacker to make a blind request to internal HTTP services. This can potentially affect internal services that have non-idempotent GET handlers and allow timing-based information leakage. The vulnerability is fixed in Botan version 3.13.0.
Botan is a C++ cryptography library. From 3.7.0 until 3.13.0, an application that calls AutoSeeded_RNG::clear() and then calls randomize with an empty output buffer while the generator is unseeded can cause AutoSeeded_RNG to mark itself seeded without consulting the configured entropy source. On builds without BOTAN_HAS_SYSTEM_RNG, the fallback uses only a clock value and process ID, so a later non-empty request can produce output from predictable state. This issue is fixed in version 3.13.0.
CVE-2026-118764 is a high-severity vulnerability in the isaacs minimatch library prior to version 11.0.1. It involves asymmetric resource consumption due to repeated expansion of malicious glob patterns, leading to excessive CPU and memory usage during pattern compilation. The issue is fixed in version 11.0.1.
CVE-2026-118763 is a vulnerability in sigstore-js versions prior to 0.7.2 where registry credentials can be leaked to attacker-controlled hosts. The RegistryClient.signIn() method stores authorization headers globally, and RegistryClient.uploadBlob() sends PUT requests to arbitrary blob-upload URLs without verifying their origin. This allows a malicious registry to capture sensitive credentials during artifact pushes. The issue is fixed in version 0.7.2 by isolating registry credentials and restricting their transmission to the registry origin only.
The npm package @chatunitycenter/baileys contains malicious code that compromises any computer on which it is installed or running. This compromise potentially grants full control to an outside entity, risking exposure of all secrets and keys stored on the affected system. Immediate removal of the package and rotation of all secrets from a different, trusted computer are strongly advised.
CVE-2026-118762 is a critical vulnerability in the Monkeytype repository's CI workflow prior to version 26.43.0. The GitHub Actions workflow runs with repository write permissions on pull_request_target events and executes code from forked pull requests with elevated privileges. This allows an external contributor to execute arbitrary code, access the GITHUB_TOKEN, and potentially push changes or modify pull requests and issues. The vulnerability affects only the repository's CI workflow, not the Monkeytype application or user data. The issue is fixed in version 26.43.0.
CVE-2026-115805 is a high-severity vulnerability in Rapid7 Insight Agent on Linux and macOS. It involves improper neutralization of special elements in OS commands due to unsafe handling of local filesystem paths. Authenticated local users with existing access can exploit this flaw to gain elevated privileges. The vulnerability is fixed in version 4.1.4.43.
CVE-2026-119115 is an incorrect authorization vulnerability in the issuer resolution logic of AWS Private CA Connector for Kubernetes. Authenticated users with approval policies limited to namespace-scoped issuers could, under certain conditions, obtain certificates signed by cluster-scoped issuers they are not authorized to use. This includes the ability to obtain subordinate CA certificates. The issue affects aws-privateca-issuer versions before v1.10.1 and the AWS Private CA Connector for Kubernetes EKS add-on before v1.10.1-eksbuild.1. AWS has published a security bulletin with details and remediation guidance.
The decode-uri-component package has a denial of service vulnerability due to quadratic time complexity when processing malformed inputs with many distinct percent-encoded runs. An attacker can craft a payload of about 224 KB that causes the Node.js event loop to block for approximately 20 seconds, making the application unresponsive. This affects version 0.5.0 and earlier. The issue arises because the fallback decoding function performs multiple regex replacements proportional to the number of distinct encoded runs, leading to O(K·L) complexity. The vulnerability impacts availability only, with no confidentiality or integrity effects. It is fixed in version 0.5.1.
An unauthenticated remote denial of service vulnerability exists in the Twisted HTTP/2 server due to improper handling of rapid stream resets. A remote client can send a request with END_STREAM followed immediately by a stream reset, causing the server to render the request fully before processing the reset. This allows repeated rapid resets on a single connection to exhaust CPU resources, bypassing the concurrent-stream limit. The issue affects Twisted versions prior to 26.10.0rc1 and has no impact on confidentiality or integrity.
A denial of service vulnerability exists in the zip crate versions 5.1.0 up to but not including 9.0.0 when the legacy-zip feature is enabled. An attacker can craft a malicious ZIP64 archive with an uncompressed size set to an extremely large value, causing a capacity overflow panic in the Shrink decoder during extraction. This panic terminates the affected process, leading to denial of service. The issue arises because the decoder reserves output buffer capacity based on the uncompressed size from ZIP metadata before validating the compressed data size. This vulnerability is fixed in version 9.0.0.
A vulnerability in the zip crate (versions 7.2.0 up to but not including 9.0.0) allows an attacker to write arbitrary files outside the intended extraction directory by exploiting symlink validation flaws. The issue arises because the path validation is purely lexical and absolute symlink targets are not properly rejected, enabling directory traversal outside the extraction target. This is especially impactful on Windows, where a single symlink can redirect extraction to a different drive or remote share. The vulnerability requires the attacker to know or guess the absolute extraction path. The issue was introduced by a change in path handling in version 7.2.0 and fixed in version 9.0.0.
A vulnerability in the zip crate's AES-encrypted entry handling allows an attacker to bypass HMAC authentication if the entry's declared compressed size exceeds the actual data length, causing premature EOF. This results in truncated, unauthenticated plaintext being accepted without error. Zero-payload entries also bypass authentication. The flaw affects versions from 0.6.0 up to but not including 9.0.0 and is fixed in version 9.0.0.
A vulnerability in the zip crate (versions >=1.3.0 <9.0.0) allows an attacker to cause an uncatchable process abort during extraction by specifying an unbounded symlink target size. The flaw arises because the symbolic-link extraction code allocates memory based on an attacker-controlled size from the ZIP central directory without bounds checking. This leads to an infallible allocation failure that aborts the process, causing denial of service. The issue is fixed in version 9.0.0.
A vulnerability in Vite dev server allows bypassing the server.fs.deny file access restrictions via crafted query parameters. This affects applications that expose the Vite dev server to the network and have sensitive files in allowed directories that are supposed to be denied. The issue was fixed in version 6.4.5.
A vulnerability in the Shopify App's token-exchange authentication allowed cross-shop authorization bypass due to confusion between the authenticated shop context and the shop specified in the request parameter. This could lead to unauthorized access or actions in another shop's context if the application used the vulnerable helpers for security-sensitive decisions. The issue is fixed in shopify_app version 23.0.3.
cert-manager versions prior to 1.19.6 and 1.20.3 allow namespace users with permission to create ACME Challenge resources to bypass Issuer and ClusterIssuer DNS01 solver policies. This occurs because the controller accepts attacker-controlled DNS provider configurations from Challenge.spec.solver without validating ownership or solver restrictions. This can lead to unauthorized use of DNS credentials or credential disclosure, particularly with acme-dns providers.
Keycloak versions prior to 26.6.4 contain a cross-site scripting (XSS) vulnerability that allows a remote attacker with administrative privileges and specific permissions to bypass client URI validation. This is done by registering a malicious client with a specially crafted redirect URI using a case-insensitive javascript: or data: scheme. The vulnerability enables arbitrary code execution in the Keycloak origin when a victim interacts with crafted links, such as during logout or in the Admin Console. A fix is available in version 26.6.4.
CVE-2026-11587 is a high-severity SQL injection vulnerability in Centreon affecting versions 24.10 and 25.10. It allows an authenticated user with access to ACL management to read and modify the Centreon database. The vulnerability is fixed in centreon-web versions 24.10.28 and 25.10.15.
A vulnerability in Keycloak allows a realm administrator with the "manage-realm" role to disclose information by submitting arbitrary filesystem paths as keystore parameters when creating a key provider component. This flaw enables probing of filesystem paths to determine file existence and readability by the Keycloak process, potentially aiding further attacks. The issue affects Keycloak versions prior to 26.6.4. A fix is available in version 26.6.4.