⚠️ Monkeytype Rate Limit Bypass Enables Abuse
Monkeytype operators should review exposed deployments and patch when a fixed version is available. Prioritize instances with public signup or email workflows because attackers can abuse this flaw for mail bombing, quota consumption, and brute-force protection bypass.
CVE-2026-69183 affects Monkeytype 26.26.0 and earlier, where backend rate-limit key generation trusts client-controlled headers instead of trusted proxy-derived values. The vulnerability has CVSS 7.5 and HIGH severity, allowing unauthenticated attackers to bypass request throttling, abuse account recovery endpoints, and cause resource exhaustion.
🔗 Read more 🔗
Source: NVD
🛡️ Plate DOCX Conversion Flaw Exposes Internal Services
Applications using Plate document conversion with untrusted HTML should upgrade to 53.3.2 immediately. Teams running server-side DOCX generation should treat these services as exposed because attackers may reach internal resources through crafted remote URLs.
CVE-2026-65842 affects Plate versions prior to 53.3.2 through the @platejs/docx-io HTML to DOCX conversion process that fetches remote images. The vulnerability has CVSS 8.2 and HIGH severity, enabling server-side request forgery with response disclosure and possible resource consumption.
🔗 Read more 🔗
Source: NVD
🌐 Link Preview JS DNS Rebinding Bypasses SSRF Protection
Upgrade Link Preview JS to 4.0.4 and review any preview services that process user-controlled URLs. This is especially urgent for internet-facing applications because attackers can use crafted domains to reach protected internal services.
CVE-2026-61704 affects Link Preview JS versions prior to 4.0.4, where DNS validation can be bypassed because the validated address differs from the final fetched hostname. The vulnerability has CVSS 7.5 and HIGH severity, allowing attackers to bypass SSRF defenses and access internal HTTP resources.
🔗 Read more 🔗
Source: NVD
🚨 dbx Authentication Bypass Enables Database Takeover
Patch dbx to version 0.5.51 immediately and verify DBX_PASSWORD settings on all deployments. Internet-exposed instances are the highest priority because attackers may read, alter, or destroy data in connected databases.
CVE-2026-55642 affects dbx prior to 0.5.51, where missing password configuration can allow protected API routes to proceed without authentication. The vulnerability has CVSS 9.8 and CRITICAL severity, allowing unauthenticated network attackers to use configured database credentials and execute arbitrary SQL.
🔗 Read more 🔗
Source: NVD
📦 NanaZip Archive Parsing Bug Risks Data Exposure
NanaZip users should install stable version 6.0.1698.0 or preview version 6.5.1742.0 and avoid opening untrusted archives until updated. Prioritize workstations that regularly process downloaded files.
CVE-2026-54616 affects NanaZip versions from 1.0.88.0 through stable version 6.0.1698.0 and preview version 6.5.1742.0 due to improper Lz4Decode error handling. The vulnerability has CVSS 7.1 and HIGH severity, potentially allowing heap data disclosure or crashes through crafted archives.
🔗 Read more 🔗
Source: NVD
🤖 LangBot MCP Configuration Flaw Enables Commands
LangBot administrators should patch when a fixed version is available and restrict account creation and extension configuration access. Review MCP configurations now for unauthorized command settings because any user account may be able to trigger server-side execution.
CVE-2026-54449 affects LangBot 4.10.7 and earlier, where authenticated users can change STDIO MCP server configurations without proper authorization controls. The vulnerability has CVSS 8.8 and HIGH severity, allowing command execution with the privileges of the LangBot service.
🔗 Read more 🔗
Source: NVD
🔄 deepmerge-ts Recursion Bug Can Crash Applications
Developers using deepmerge-ts with untrusted object data should upgrade to version 8.0.0. Services handling complex user input should prioritize this dependency update because crafted objects can crash application workers.
CVE-2026-40345 affects deepmerge-ts versions prior to 8.0.0, where recursive object merging can repeatedly process self-referencing object structures. The vulnerability has CVSS 8.2 and HIGH severity, allowing denial of service through attacker-controlled recursive object graphs.
🔗 Read more 🔗
Source: NVD
🎨 GIMP APNG Parser Vulnerability Enables Remote Code Execution
GIMP users should apply available security updates and avoid opening untrusted image files until patched. Designers and media teams handling external artwork should prioritize affected installations.
CVE-2026-18309 is a GIMP APNG file parsing vulnerability that allows remote attackers to execute arbitrary code after a user opens a malicious file or visits a malicious page. The vulnerability has CVSS 7.8 and HIGH severity, caused by an integer overflow before buffer allocation.
🔗 Read more 🔗
Source: NVD
🎨 GIMP TIF Parser Integer Overflow Creates RCE Risk
Patch GIMP installations used for image processing and warn users against opening untrusted TIF files. Workstations receiving external graphics should be updated promptly because exploitation can lead to code execution.
CVE-2026-18308 is a GIMP TIF file parsing vulnerability that allows remote attackers to execute arbitrary code after user interaction with a malicious file or page. The vulnerability has CVSS 7.8 and HIGH severity, involving an integer overflow caused by insufficient validation of user-supplied data.
🔗 Read more 🔗
Source: NVD
💥 GIMP TIF Heap Overflow Leads to Code Execution
Update GIMP deployments and limit exposure to untrusted TIF files until patches are applied. Treat this as a workstation code execution risk for users handling external image content.
CVE-2026-18307 is a GIMP TIF file parsing heap-based buffer overflow vulnerability affecting systems where users open malicious files or pages. The vulnerability has CVSS 7.8 and HIGH severity, allowing attackers to execute code in the context of the current process.
🔗 Read more 🔗
Source: NVD
🖼️ GIMP SGI Parser Integer Overflow Enables RCE
Apply GIMP security updates and restrict handling of untrusted SGI files. Organizations using GIMP in creative workflows should include these systems in normal vulnerability remediation cycles.
CVE-2026-18306 is a GIMP SGI file parsing vulnerability that can allow remote attackers to execute arbitrary code after a malicious file is opened. The vulnerability has CVSS 7.8 and HIGH severity, caused by improper validation of user-supplied data resulting in an integer overflow.
🔗 Read more 🔗
Source: NVD
🖼️ GIMP TIF Integer Overflow Opens Code Execution Path
Update affected GIMP installations and reinforce safe handling of external graphics files. Users working with downloaded or shared TIF content should receive the update quickly.
CVE-2026-18305 is a GIMP TIF file parsing integer overflow vulnerability affecting users who open malicious files or visit malicious pages. The vulnerability has CVSS 7.8 and HIGH severity, allowing attackers to execute code in the context of the current process.
🔗 Read more 🔗
Source: NVD