A vulnerability in filelock versions 4.1.0 through 4.2.0 allows a local user with write access to a shared lock directory without the sticky bit to create a hard link to another user's file by exploiting the restore branch of the stale lock break mechanism. This can expose file metadata and enable the attacker to cause the lock user's FileLock to truncate or modify the linked file. The issue arises due to symbolic link following behavior in os.link on CPython 3.12+ on Linux and macOS. The vulnerability requires specific conditions including a non-sticky writable directory and repeated lock acquisition by the lock user. It has a CVSS 3.1 score of 5.3 (Medium).
A vulnerability in filelock versions 4.1.0 through 4.2.0 allows a local user to evict a fresh lock file owned by another user by exploiting inode reuse and coarse clock timestamp manipulation on certain filesystems like ext4. This causes two processes of the lock owner to enter a critical section simultaneously, violating lock integrity without affecting confidentiality or availability. The attack requires local access, specific filesystem behavior, and precise timing, making exploitation complex and unreliable.
CVE-2026-116685 is a vulnerability in the Model Context Protocol Python SDK versions from 1.8.0 up to but not including 1.30.0, and from 2.0.0 up to but not including 2.2.0. Certain client components improperly follow HTTP redirects to different origins while forwarding sensitive custom credential headers and request bodies, potentially exposing sensitive information to unauthorized actors. This issue is fixed in versions 1.30.0 and 2.2.0.
MembershipWorks plugin for WordPress versions before 6.17 has an information disclosure vulnerability that allows unauthenticated attackers to access member-only content via the WordPress REST API. The plugin fails to apply content protection filters during REST API requests, exposing protected content to unauthorized users. This issue is fixed in version 6.17.
CVE-2026-116684 is an authorization vulnerability in the Model Context Protocol Python SDK affecting versions from 1.10.0 up to but not including 1.30.0, and from 2.0.0 up to but not including 2.2.0. The flaw occurs when server-side bearer authentication configured with AuthSettings and token_verifier accepts a valid token issued for a different service due to lack of independent audience (aud) validation. This allows an attacker holding a token for one resource to authenticate to a different MCP server and gain unauthorized access. The issue is fixed in versions 1.30.0 and 2.2.0.
CVE-2026-112940 affects the filelock library's ReadWriteLock and AsyncReadWriteLock components that use SQLite for locking. On Linux systems with /proc mounted, SQLite reopens lock database files by name, following symlinks and acting on side files such as -journal, -wal, and -shm. A local attacker with write access to the directory containing the lock database can exploit this to cause the lock user to overwrite or unlink files with the lock user's privileges. This requires the directory to be writable without the sticky bit, such as a 0777 or group-writable directory without sticky bit. The vulnerability is present in filelock versions 3.20.4 through 4.2.0, with the /proc/self/fd redirect introduced in 4.0.9 and side-file variants since 3.20.4. The issue can cause high integrity and availability impact but no confidentiality loss. A fix is available in version 1.18.4 of the affected product pipx.
filelock versions 4.1.0 through 4.2.0 contain a vulnerability in their ReadWriteLock and AsyncReadWriteLock implementations where private .filelock-* directories are deleted recursively without verifying the directory's identity. This can be exploited by a local user who can rename directories in the shared parent directory (without sticky bit protection) to cause the lock user's process to delete arbitrary directories with the lock user's permissions. The issue affects macOS since 4.1.1 and POSIX environments without a usable /proc/self/fd, such as chroots or containers without /proc. The vulnerability has a CVSS 3.1 score of 6.1 (Medium) and is fixed in filelock version 4.2.1.
CVE-2026-114605 is a high-severity vulnerability in the ldeep product affecting dnspython's dns.name.from_wire_parser() function. A specially crafted DNS message can cause excessive CPU usage during DNS name decompression, potentially leading to denial of service (DoS) conditions in applications processing untrusted DNS wire format messages. The issue is fixed in dnspython version 2.9.0. No workarounds are currently known.
undici versions 7.0.0 through before 7.30.1 and 8.0.0 through before 8.12.2 have a cache poisoning and cross-user data disclosure vulnerability when using an originless Agent with composed redirect and shared cache interceptors. The cache key is built from the original request URL before redirects change the origin, causing responses from redirected origins to be cached under the original URL. This allows an attacker controlling the redirect target to poison the cache or disclose private data to other users. The issue is fixed in versions 7.30.1 and 8.12.2 by verifying origin consistency before caching and preserving cache-control policies across redirects.
undici's Agent component improperly handles TLS options by deep cloning constructor options via JSON serialization, which drops function-valued TLS callbacks such as checkServerIdentity. This results in a TLS certificate validation bypass where custom verification logic is ignored, potentially allowing acceptance of TLS peers that should be rejected. The vulnerability affects applications using Agent as the default dispatcher for request, fetch, and setGlobalDispatcher, as well as EnvHttpProxyAgent on certain routes. Fixed in undici versions 6.29.1, 7.30.1, and 8.12.2.
undici is vulnerable to a denial of service condition triggered by a TLS 1.2 server-initiated renegotiation presenting a different, valid but hostname-mismatched certificate. This causes an uncaught assertion error that crashes the Node.js client process, affecting both HTTP/1.1 and HTTP/2. Only TLS 1.2 is impacted, as TLS 1.3 does not support renegotiation. The issue is fixed in undici versions 6.29.1, 7.30.1, and 8.12.2. Mitigation includes upgrading to these versions or restricting connections to TLS 1.3 to prevent renegotiation.
undici's WebSocket client, including Node.js's bundled globalThis.WebSocket, is vulnerable to a denial of service condition caused by unbounded automatic PONG buffering. A malicious WebSocket server can send continuous PING frames causing the client to queue PONG responses without respecting backpressure, leading to memory exhaustion and process termination. This affects undici versions from 5.15.0 up to but not including 6.29.1, 7.0.0 up to 7.30.1, and 8.0.0 up to 8.12.2. Upgrading to versions 6.29.1, 7.30.1, or 8.12.2 mitigates the issue by properly handling backpressure.
A vulnerability in undici's decompress interceptor allows a denial of service via an unhandled exception. When the decompress interceptor forwards decompressed data to a downstream handler that throws an exception asynchronously (such as the dump interceptor with a maxSize limit), the exception is uncaught and terminates the Node.js process. This can be triggered by a malicious HTTP server sending a small compressed response that decompresses to a size exceeding the limit. The issue affects undici versions >=7.15.0 <7.30.1 and >=8.0.0 <8.12.2. Fixed in versions 7.30.1 and 8.12.2.
Certain versions of the MCP TypeScript SDK and related packages do not limit HTTP POST request body size or JSON-RPC batch length. This allows an attacker to send very large requests or long batches, potentially exhausting server memory and causing denial of service. No authentication is required unless implemented outside the SDK. Fixed versions impose limits on request size and batch length.
Symfony's YAML parser had an unbounded recursion vulnerability in its inline lexer, allowing deeply nested inline collections in YAML documents to cause stack exhaustion and crash the process. This affects any code parsing untrusted YAML, including endpoints using #[MapRequestPayload] without restricting acceptFormat. The issue is fixed by bounding the nesting level and raising a ParseException when exceeded.
A Regular Expression Denial of Service (ReDoS) vulnerability exists in Symfony's HeaderUtils::split() method, reachable via the Cache-Control HTTP request header. The vulnerability arises from a regex pattern that inefficiently handles whitespace, causing exponential backtracking and high CPU usage when processing crafted headers. This can lead to significant request processing delays or dropped header directives. Fixed versions are available starting from 5.4.54, 6.4.46, 7.4.19, and 8.1.7.
A denial of service vulnerability exists in go-jose when parsing JWKs containing RSA keys with crafted parameters. The vulnerability arises because go-jose does not validate bounds on RSA modulus and primes before calling crypto/rsa.PrivateKey.Validate(), which on Go 1.24+ has cubic time complexity relative to key size. This allows an attacker to supply a malicious JWK that causes excessive CPU consumption during parsing. The issue affects go-jose versions prior to 4.1.6 and 3.0.5 and has been fixed in version 4.1.6.
CTFer.io's CTFd Terraform Provider improperly stores team passwords as non-sensitive values in the Terraform state file. This allows local or remote attackers with access to the Terraform state to read team passwords without needing the state decryption password. The vulnerability is identified as CWE-522 and affects versions from 0.1.5 through 1.1.0 and all versions prior to 2.8.2. A patch is available in version 2.8.2. No workaround exists, but limiting access to the Terraform state file is recommended to reduce risk.