Monkeytypegame · product
monkeytype
5 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
Every one of the 5 is a mark on the map. Named now: 1 to 5, most at risk first.
- Monkeytype is vulnerable to Poisoned Pipeline Execution through Code Injection in its `ci-failure-comment.yml` GitHub Workflow, enabling attackers to gain `pull-requests` write ac…
- Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)
- Monkeytype: fork PR can execute code with elevated GITHUB_TOKEN
- Monkeytype vulnerable to stored XSS in approve quotes page
- Monkeytype Vulnerable to Self-XSS on loading saved custom text
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.