field log · research archive
The gap between what systems claim to do and what they actually do.
Field research on vulnerability classes, broken trust models, supply chain betrayals, and cryptographic assumptions that turned out to be wrong. By Kevlar — in the hash-and-trust business since before most CVE programs existed.
- CVE-2026-27478: Unity Catalog's JWT Verifier Asks the Token Where Its Key Lives
▸ latestCVE-2026-27478: Unity Catalog's JWT Verifier Asks the Token Where Its Key Lives
Unity Catalog's token-exchange endpoint reads the iss claim out of the incoming JWT, treats it as a URL, fetches <iss>/.well-known/openid-configuration, follows the jwksuri from that document to a key, and verifies the JWT's signature with that key.
- CVE-2026-44339: PraisonAI's Permission Tier Was Never the Gate
CVE-2026-44339: PraisonAI's Permission Tier Was Never the Gate
PraisonAI 4.6.37, released May 4, removes four lines from ToolExecutionMixin.executetool. The four lines resolved any tool-call name the LLM emitted through globals().get(functionname) and getattr(main, functionname, None) when no declared tool matched.
- CVE-2026-44340: PraisonAI's _safe_extractall Validates member.name. The Bypass Is in member.linkname.
CVE-2026-44340: PraisonAI's _safe_extractall Validates member.name. The Bypass Is in member.linkname.
The function is named safeextractall. It lives at src/praisonai/praisonai/recipe/registry.py:131 in PraisonAI through release 4.6.36. The pre-patch version validates three things about every tarfile member it sees: that member.name is not absolute, that member…
- CVE-2026-31717: ksmbd's Durable Handle Was Not an Authorization, It Was a Credential
CVE-2026-31717: ksmbd's Durable Handle Was Not an Authorization, It Was a Credential
The CVE description for CVE-2026-31717 says any authenticated user can hijack an orphaned ksmbd durable handle by predicting the persistent ID. That sentence describes the front door. It does not describe what the attacker walks into.
- CVE-2026-24072: AP_EXPR_FLAG_RESTRICTED Was Opt-In For Fifteen Years. The Patch Opts In Three Modules. Four More Still Read /etc/passwd From .htaccess.
CVE-2026-24072: AP_EXPR_FLAG_RESTRICTED Was Opt-In For Fifteen Years. The Patch Opts In Three Modules. Four More Still Read /etc/passwd From .htaccess.
APEXPRFLAGRESTRICTED is defined at include/apexpr.h:66. It has been defined there since the commit that introduced Apache's expression-parser framework in mid-2011. The comment that declares it names exactly one consumer:
- CVE-2025-41242: Spring's `uriDecode` Wrote 16-Bit Chars Into an 8-Bit Sink. Jetty 12 Finished the Traversal.
CVE-2025-41242: Spring's `uriDecode` Wrote 16-Bit Chars Into an 8-Bit Sink. Jetty 12 Finished the Traversal.
Spring Framework's StringUtils.uriDecode has a single non-percent branch in its core loop. The branch calls bos.write(ch), where bos is a ByteArrayOutputStream and ch is a Java char.
- CVE-2026-7669: SGLang Treated trust_remote_code=False As a Suggestion
CVE-2026-7669: SGLang Treated trust_remote_code=False As a Suggestion
In SGLang 0.5.10 through current main, the operator who passes trustremotecode=False receives the same tokenizer as the operator who passes trustremotecode=True for any model carrying a custom tokenizerclass.
- CVE-2025-24367: cacti_escapeshellarg Escapes For a Shell That Never Runs
CVE-2025-24367: cacti_escapeshellarg Escapes For a Shell That Never Runs
Cacti's graph renderer opens rrdtool with procopen(pathrrdtool . ' - '). The argument is a single dash. That is rrdtool's remote control mode: read commands from stdin, one per line, until quit.
- CVE-2026-41669: Admidio's smc_require_auth_signed Was a Setting Before It Was a Control
CVE-2026-41669: Admidio's smc_require_auth_signed Was a Setting Before It Was a Control
Lines 416 and 611 of src/SSO/Service/SAMLService.php carry the same comment: // Validate signatures. Will throw an exception. The function on the next line returns an error string. The callers do not read it.
- CVE-2026-4257: Supsystic Sanitizes Prefill For HTML, Renders It Through Twig_Loader_String
CVE-2026-4257: Supsystic Sanitizes Prefill For HTML, Renders It Through Twig_Loader_String
CVE-2026-4257 is the latest delivery of {{self.env.registerUndefinedFilterCallback(...)}}, the Twig 1.x sandbox-escape chain that has been on the OWASP SSTI cheat sheet since 2015 and on every CTF wiki since the year after that.
- CVE-2025-24054: The Two Verbs That Don't Trigger Are 'Open' and 'Execute'
CVE-2025-24054: The Two Verbs That Don't Trigger Are 'Open' and 'Execute'
Microsoft's bulletin for CVE-2025-24054 names the user interaction required to trigger the bug by listing the two interactions that do NOT trigger it: opening the file, and executing the file.
- CVE-2026-27760: OpenCATS' Install Lock Is a File Every Release Ships Without
CVE-2026-27760: OpenCATS' Install Lock Is a File Every Release Ships Without
OpenCATS' installer is one AJAX endpoint that reads four POST parameters and writes them, by literal string concatenation, into the PHP source file that every entry point includes. The action is install:databaseConnectivity. The destination is config.php.
- CVE-2026-39973: Apktool's Path Check Was Replaced With a Name Check. The Path Has Two Names.
CVE-2026-39973: Apktool's Path Check Was Replaced With a Name Check. The Path Has Two Names.
The audience for apktool d is, by occupation, the audience that cannot trust the file it is about to run the command against. Reverse engineers pulling a sample from VirusTotal. Malware analysts staring at a stripped APK out of a customer's compromised phone.
- CVE-2026-42228: n8n's Chat WebSocket Treated Existence As Authorization
CVE-2026-42228: n8n's Chat WebSocket Treated Existence As Authorization
n8n's chat WebSocket handler accepts a connection on /chat, parses three query parameters, and calls a function literally named checkIfExecutionExists. If the execution row is present in the database, the connection stays open and starts streaming the workflow…
- CVE-2026-42231: xml2js Used defineProperty So __proto__ Wouldn't Mutate. The Property It Wrote Is The Pollution.
CVE-2026-42231: xml2js Used defineProperty So __proto__ Wouldn't Mutate. The Property It Wrote Is The Pollution.
n8n's body parser registers a single xml2js Parser at module load. The configuration is four flags.
- CVE-2025-1094: PQescapeLiteral Asks How Long. It Does Not Ask Whether.
CVE-2025-1094: PQescapeLiteral Asks How Long. It Does Not Ask Whether.
PostgreSQL's PQescapeLiteral walks its input one byte at a time. When a byte has the high bit set, the function asks pgencodingmblen how many bytes the character occupies and consumes that many bytes verbatim.
- CVE-2026-42036: Axios's maxContentLength Lived Inside the Buffered Branch's Counter. The Streaming Branch Did Not Buffer.
CVE-2026-42036: Axios's maxContentLength Lived Inside the Buffered Branch's Counter. The Streaming Branch Did Not Buffer.
The Axios README tells you to set maxContentLength and promises the library will enforce it chunk-by-chunk during streaming decompression. That sentence has been in the docs for years. It has never been true for callers using responseType: 'stream'.
- CVE-2026-40466: HTTP Discovery Was Row Two Of A Fourteen-Row Deny List
CVE-2026-40466: HTTP Discovery Was Row Two Of A Fourteen-Row Deny List
Apache ActiveMQ pull request [#1918](https://github.com/apache/activemq/pull/1918) merged on 2026-04-14, twenty-seven days after 5.19.4 closed CVE-2026-34197.
- CVE-2026-5865: Maglev's BuildCheckSmi Took a Parameter Named `elidable` and Did Not Read It
CVE-2026-5865: Maglev's BuildCheckSmi Took a Parameter Named `elidable` and Did Not Read It
The patch for CVE-2026-5865 is one boolean operand. Maglev's BuildCheckSmi is the function that emits a runtime "is this value a small integer" check before code that depends on the answer.
- CVE-2026-5718: The Drag-and-Drop CF7 Nonce Mint Blocks One Caller, And Its Name Is curl
CVE-2026-5718: The Drag-and-Drop CF7 Nonce Mint Blocks One Caller, And Its Name Is curl
CVE-2026-5718 names an unauthenticated arbitrary file upload in Drag and Drop Multiple File Upload for Contact Form 7, the codedropz plugin that adds drag-and-drop attachment fields to Contact Form 7 on hundreds of thousands of WordPress sites.
- CVE-2025-68664: LangChain's Dumper Forwarded `lc`. Its Loader Trusted It.
CVE-2025-68664: LangChain's Dumper Forwarded `lc`. Its Loader Trusted It.
PR [#34455](https://github.com/langchain-ai/langchain/pull/34455) lands a new file. libs/core/langchaincore/load/validation.py, 191 lines, sentinel constant LCESCAPEDKEY = "lcescaped".
- CVE-2025-33053 Was the WorkingDirectory Half. The Other Half Got a Documentation Edit.
CVE-2025-33053 Was the WorkingDirectory Half. The Other Half Got a Documentation Edit.
On May 7, 2026, [Will Dormann](https://infosec.exchange/@wdormann/116533862391306228) published a screen recording of a Windows 11 desktop with no internet connectivity launching a remote binary from a WebDAV server.
- CVE-2026-26336: Alfresco's Path Blacklist Has Never Blocked ..;/
CVE-2026-26336: Alfresco's Path Blacklist Has Never Blocked ..;/
Hyland Alfresco Share's dispatchResource opens with one line of authorization: if (!isAllowedResourcePath(path)). The path it tests is whatever Spring's URL handler mapping extracted from the /share/page/resource/ route.
- CVE-2026-2441: The Vulnerable Chrome Binary Is a 404, the Heap Leak Is Math.random()
CVE-2026-2441: The Vulnerable Chrome Binary Is a 404, the Heap Leak Is Math.random()
The README declares CVSS 8.8, Renderer RCE in a sandboxed Chrome, active in-the-wild exploitation. The exploit-chain diagram names NSO Pegasus, Intellexa Predator, and APT-28. The vulnerability is real.
- CVE-2026-42222: Nginx-UI's /api/install Was on the Public Router. The Gate Was a Clock.
CVE-2026-42222: Nginx-UI's /api/install Was on the Public Router. The Gate Was a Clock.
Yesterday the gate was on /api/restore. The same gate, on the canonical caller, is POST /api/install. CVE-2026-42222 is the original. The same April 18 commit, [25dea9f](https://github.com/0xJacky/nginx-ui/commit/25dea9f6207ad6e55e855e5a7a951cf300acc202), clos…
- CVE-2026-39363: Vite's /@fs Route Returns 403. The HMR WebSocket Returns the File.
CVE-2026-39363: Vite's /@fs Route Returns 403. The HMR WebSocket Returns the File.
Someone on your team ran vite --host so they could load the app on their phone. That is the supported way to do it; the Vite docs tell you to. The dev server is now listening on 0.0.0.0:5173, and anyone who can reach that port can read any file the dev-server…
- CVE-2026-0300: seven PoCs, four defenders, two placeholders, one missing patch
CVE-2026-0300: seven PoCs, four defenders, two placeholders, one missing patch
CISA's patch deadline for CVE-2026-0300 was yesterday. Palo Alto Networks ships the fix in four days. The seven public PoCs a federal PAN-OS administrator can pull off GitHub today are four defensive tools, two buffer-overflow stubs whose default return addres…
- CVE-2026-7482: Ollama's Heap OOB Read Returns Your Memory After a 4-Bit Quantizer
CVE-2026-7482: Ollama's Heap OOB Read Returns Your Memory After a 4-Bit Quantizer
Two independent reproductions of CVE-2026-7482 land in public the same week. Both ship truncated GGUF files to Ollama's /api/create quantization path, both reach a heap out-of-bounds read in quantizer.WriteTo, both confirm bytes leave the server, and both note…
- CVE-2025-68645: Zimbra's RestFilter Treated `javax.servlet.include.*` Like Form Fields
CVE-2025-68645: Zimbra's RestFilter Treated `javax.servlet.include.*` Like Form Fields
The Zimbra Classic UI ships a servlet filter named RestFilter whose pre-patch doFilter body is six lines: read the request's parameter map, iterate, and for each entry call request.setAttribute(key, value). The key is whatever the URL chose.
- CVE-2026-42298: The Postiz Commit That Turned the PR Builder Into RCE Was Titled "Add Environment"
CVE-2026-42298: The Postiz Commit That Turned the PR Builder Into RCE Was Titled "Add Environment"
Postiz's .github/workflows/pr-docker-build.yml lived in the gitroomhq/postiz-app repo for 267 days. For 203 of them, the workflow docker build'd every fork pull request's Dockerfile inside a job declaring permissions: write-all against the base repository.
- CVE-2026-32743: PX4's Sixty-Byte Filepath, And A Temporal Cascade That Is A For Loop
CVE-2026-32743: PX4's Sixty-Byte Filepath, And A Temporal Cascade That Is A For Loop
CVE-2026-32743 is sixty bytes of stack and one missing width specifier in PX4 Autopilot's MavlinkLogHandler. An adjacent attacker creates a directory under /fs/microsd/log/ whose name is longer than sixty bytes, sends MAVCMDREQUESTLOGLIST, and the autopilot's…
- CVE-2026-21858: n8n's req.body.files Was Formidable's Output. The JSON Parser Used the Same Name.
CVE-2026-21858: n8n's req.body.files Was Formidable's Output. The JSON Parser Used the Same Name.
n8n's Form node reads (context.getBodyData().files as IDataObject) ?? {}, iterates each entry, and copies each entry's filepath from disk into the workflow's binary store.
- CVE-2025-6440: WooCommerce Designer Pro Takes the File and the Extension as Separate Fields
CVE-2025-6440: WooCommerce Designer Pro Takes the File and the Extension as Separate Fields
WooCommerce Designer Pro is a paid CodeCanyon plugin that lets WordPress shoppers customize printed merchandise, T-shirts, mugs, business cards, before they check out. Customers upload artwork in a canvas editor.
- CVE-2025-32966: DataEase's RCE Precondition Was a Length Check
CVE-2025-32966: DataEase's RCE Precondition Was a Length Check
The Nuclei template for CVE-2025-32966 forges its JWT with HS256 and the secret string "ChrisJr404". ChrisJr404 is the template's author. The string is the author's own handle, used as an HMAC key against the DataEase server, and the server accepts it.
- CVE-2026-0545: MLflow's basic-auth Only Gated Flask. Three FastAPI Routers Were Open.
CVE-2026-0545: MLflow's basic-auth Only Gated Flask. Three FastAPI Routers Were Open.
CVE-2026-0545 names an authentication bypass on POST /ajax-api/3.0/jobs/ in MLflow when basic-auth is enabled. The route is registered on a FastAPI sub-app. The basic-auth gate is a Flask beforerequest hook on the Flask app that FastAPI mounts at /.
- CVE-2026-22679: Weaver E-cology's Endpoint Was Named `debug`. The Patch Is a Deletion.
CVE-2026-22679: Weaver E-cology's Endpoint Was Named `debug`. The Patch Is a Deletion.
Weaver (Fanwei) E-cology 10.0 ships a debug endpoint at POST /papi/esearch/data/devops/dubboApi/debug/method. The URL is the controller's name in the source tree. devops is the package, dubboApi is the namespace, debug is the controller, method is the action.
- CVE-2023-27351: PaperCut's SecurityRequestFilter Read the URI the Client Sent. The Servlet Container Routed on the One It Had Parsed.
CVE-2023-27351: PaperCut's SecurityRequestFilter Read the URI the Client Sent. The Servlet Container Routed on the One It Had Parsed.
CISA added CVE-2023-27350 to its Known Exploited Vulnerabilities catalog on April 21, 2023. The federal patch deadline was May 12, eight working days away. The advisory had been public for thirty-eight days, in-wild exploitation by a Cl0p-affiliated actor had…
- CVE-2025-9242: WatchGuard's iked Buffer Is 512 Bytes. The Build Number Comes Before the Overflow.
CVE-2025-9242: WatchGuard's iked Buffer Is 512 Bytes. The Build Number Comes Before the Overflow.
The watchTowr PoC for CVE-2025-9242 ships with a single-entry gadget table, keyed on the string 12.11.3. The exploit looks up gadgets by firmware version. It does not need to guess.
- CVE-2025-6216: Allegra's Password-Reset Token Was the SHA-256 of Its Own Expiration Date
CVE-2025-6216: Allegra's Password-Reset Token Was the SHA-256 of Its Own Expiration Date
Allegra 8.1.3.32 ships a password-reset endpoint whose token is SHA-256(String.valueOf(expirationTimestampInMilliseconds)). The expiration is currentTimeMillis() + 28800000, eight hours forward from the moment the handler runs.
- CVE-2025-22457: Ivanti's End-of-Life Branch Was UNC5221's Lab
CVE-2025-22457: Ivanti's End-of-Life Branch Was UNC5221's Lab
Ivanti released ICS 22.7R2.6 on February 11, 2025, fixing a buffer overflow in the X-Forwarded-For header parser. The advisory called it a low-risk denial of service: the input is constrained to characters matching [0-9.], "evaluated and determined not to be e…
- CVE-2024-9487: GHES Extracted Signatures Before Decryption. The Inner Assertion's Was Never Extracted.
CVE-2024-9487: GHES Extracted Signatures Before Decryption. The Inner Assertion's Was Never Extracted.
A GitHub Enterprise Server administrator enables Encrypted Assertions because the GHES SAML hardening checklist lists the feature as defense in depth. After that switch, every signed SAML response arriving at /saml/consume carries two cryptographic signatures:…
- CVE-2026-34197: ActiveMQ's 5.19.4 Patch Denied One Scheme. Six Weeks Later, the Same Line Denies Fourteen.
CVE-2026-34197: ActiveMQ's 5.19.4 Patch Denied One Scheme. Six Weeks Later, the Same Line Denies Fourteen.
The patch that closes CVE-2026-34197 in Apache ActiveMQ Classic 5.19.4 is a four-line method called validateAllowedScheme whose body is if (scheme.equals("vm")) { throw new IllegalArgumentException("VM scheme is not allowed"); }. One scheme name.
- CVE-2026-26332: vm2 Wraps Every Error the Sandbox Throws. SuppressedError Carries the Two V8 Threw.
CVE-2026-26332: vm2 Wraps Every Error the Sandbox Throws. SuppressedError Carries the Two V8 Threw.
vm2 v3.10.4 ships a Proxy bridge that wraps every Error object it sees the sandbox construct. CVE-2026-26332 escapes through two Error objects vm2 did not see the sandbox construct, because the sandbox did not construct them.
- CVE-2026-26956: vm2's Transformer Rewrites Every catch It Parses. WebAssembly's try_table Is Bytecode.
CVE-2026-26956: vm2's Transformer Rewrites Every catch It Parses. WebAssembly's try_table Is Bytecode.
The patch for CVE-2026-26956 is twenty lines. Nineteen are comment. The functional change is a single deletion: localReflectDeleteProperty(WebAssembly, 'JSTag') inside the sandbox bootstrapper.
- CVE-2026-24118: vm2's Patch Names Its Sibling. resetPromiseSpecies Was 2023.
CVE-2026-24118: vm2's Patch Names Its Sibling. resetPromiseSpecies Was 2023.
vm2 closed CVE-2026-24118 on April 24, 2026, with one commit that adds 306 lines to lib/bridge.js. The commit's title in the git log is "block Array species self-return sandbox escape." The commit's title in its own comment header is something else.
- CVE-2026-0073: adbd's EVP_PKEY_cmp Was the 2020 OpenIKED Bug
CVE-2026-0073: adbd's EVP_PKEY_cmp Was the 2020 OpenIKED Bug
if (EVPPKEYcmp(knownevp.get(), evppkey.get())) is the gate daemon/auth.cpp uses to authenticate wireless ADB clients. EVPPKEYcmp returns 1, 0, -1, or -2. Three of those four values are truthy in C++. Two of them mean no.
- CVE-2026-24120: vm2's README Already Admits the Bug Class Is the Design
CVE-2026-24120: vm2's README Already Admits the Bug Class Is the Design
The vm2 README has a section called "Important Security Disclaimer." It runs four paragraphs and contains this sentence: "Despite our best efforts, researchers and security professionals continuously discover new ways to escape the vm2 sandbox." The maintainer…
- CVE-2026-39339: ChurchCRM's Auth Check Asks Whether "api/public" Is in the URI. The Bypass Writes It in the Query.
CVE-2026-39339: ChurchCRM's Auth Check Asks Whether "api/public" Is in the URI. The Bypass Writes It in the Query.
ChurchCRM's API authentication middleware decides whether to skip auth by asking whether the substring api/public appears anywhere in the request URI. The path. The query string. The fragment.
- CVE-2026-34975: Plunk's CRLF Patch Lives in the Schema. The Schema Missed Two of Eight Fields.
CVE-2026-34975: Plunk's CRLF Patch Lives in the Schema. The Schema Missed Two of Eight Fields.
apps/api/src/services/SESService.ts builds outbound MIME by interpolating caller-controlled fields into a string template. Eight of those fields are arbitrary strings the API receives as JSON.
- CVE-2026-27825: mcp-atlassian's Path Patch Guarded Every Write. open(file_path, "rb") Is a Read.
CVE-2026-27825: mcp-atlassian's Path Patch Guarded Every Write. open(file_path, "rb") Is a Read.
mcp-atlassian shipped commit 52b9b099 on 2026-02-24 to fix GHSA-xjgw-4wvw-rgm4. The diff added a validatesafepath helper, imported it into src/mcpatlassian/confluence/attachments.py and src/mcpatlassian/jira/attachments.py, and called it on the functions that…
- CVE-2026-33980: adx-mcp-server's Three "Safe" Tools All Call execute. The Approval Policy Was the Tool's Name.
CVE-2026-33980: adx-mcp-server's Three "Safe" Tools All Call execute. The Approval Policy Was the Tool's Name.
adx-mcp-server is an MCP server that wraps Azure Data Explorer. It registers four tools with the model: executequery, gettableschema, sampletabledata, and gettabledetails.
- CVE-2026-1368: The Patch Is Two Characters. The Line Was in the File.
CVE-2026-1368: The Patch Is Two Characters. The Line Was in the File.
The patch for CVE-2026-1368 in the Video Conferencing with Zoom API WordPress plugin is two characters. The two characters are //, removed from the start of one line in includes/admin/class-zvc-admin-ajax.php.
- CVE-2025-58179: Astro Shipped Two /_image Endpoints. Only One Read the Allowlist.
CVE-2025-58179: Astro Shipped Two /_image Endpoints. Only One Read the Allowlist.
Astro ships two implementations of the /image endpoint. One lives in packages/astro/src/assets/endpoint/generic.ts, used by the dev server and by deployments running Astro's default image pipeline.
- CVE-2025-56132: The LiquidFiles Lockout Reads the Bug It Was Supposed to Close
CVE-2025-56132: The LiquidFiles Lockout Reads the Bug It Was Supposed to Close
LiquidFiles is a managed file transfer product. CVE-2025-56132 is a user enumeration in its password reset endpoint: versions before 4.2 return a distinguishable response when the submitted email does not exist.
- CVE-2026-42167: ProFTPD's is_escaped_text Was Correct For One Caller. mod_sql Asked It About Every Caller.
CVE-2026-42167: ProFTPD's is_escaped_text Was Correct For One Caller. mod_sql Asked It About Every Caller.
ProFTPD's modsql resolves every logging-format variable, %U, %{basename}, %r, %m, into a SQL string by appending each piece to a buffer. Before each append, the resolver asks one question: does this text look already-escaped? If yes, skip sqlescapestring.
- CVE-2026-33715: install.ajax.php Was Install-Only By Filename. The Filename Was the Gate.
CVE-2026-33715: install.ajax.php Was Install-Only By Filename. The Filename Was the Gate.
Chamilo's runtime AJAX directory at public/main/inc/ajax/ holds about thirty handlers. Every one of them opens with the same line: requireonce DIR.'/../global.inc.php'. That include is what gates the file.
- CVE-2026-6644: ASUSTOR Escaped the Credentials. The Server Reached /bin/sh.
CVE-2026-6644: ASUSTOR Escaped the Credentials. The Server Reached /bin/sh.
ASUSTOR's PPTP VPN client config is generated by a single function in vpn.cgi. The function takes three fields from the admin's request and writes them into a pppd peer config: username, password, server address. It quote-escapes the first two.
- CVE-2026-42208: hashed_token Was a Parameter Name. The Function Trusted the Name.
CVE-2026-42208: hashed_token Was a Parameter Name. The Function Trusted the Name.
LiteLLM's vulnerable function computed the hash. On line 2970 of litellm/proxy/utils.py, getdata calls hashtokenifneeded(token=token) and assigns the result to a local named hashedtoken.
- CVE-2026-7567: Temporary Login's Token Field Is a Filter. WordPress's Meta Query Drops Empty Filters.
CVE-2026-7567: Temporary Login's Token Field Is a Filter. WordPress's Meta Query Drops Empty Filters.
The Temporary Login plugin lets a WordPress administrator click a button and produce a single-use URL of the form ?temp-login-token=<64 hex chars>. Hand the URL to a developer who needs admin access for the day. They click. They are an administrator.
- CVE-2026-42779: Apache MINA Shipped the Fix on One Branch. The Same Day, Two Other Branches Shipped the Bug.
CVE-2026-42779: Apache MINA Shipped the Fix on One Branch. The Same Day, Two Other Branches Shipped the Bug.
On 2026-04-24, Apache MINA released three versions on the same day: 2.0.28, 2.1.11, and 2.2.6. One of them contained a fix for a deserialization filter bypass. The other two shipped the bug.
- CVE-2025-59528: Flowise's convertToValidJSONString Is eval. The Patch Is JSON5.
CVE-2025-59528: Flowise's convertToValidJSONString Is eval. The Patch Is JSON5.
Flowise's Custom MCP server config is a JS-style object literal. The canvas accepts trailing commas, unquoted keys, and single-quoted strings. The function that lifts that string into something JSON.parse will accept is named convertToValidJSONString.
- CVE-2025-32432: Craft Patched the Caller. The Yii Fix Was Already Out.
CVE-2025-32432: Craft Patched the Caller. The Yii Fix Was Already Out.
Craft CMS's actions/assets/generate-transform endpoint is on the allowAnonymous list by design. The bug isn't that an unauthenticated caller can reach it. The bug is that the handle body parameter, documented as a string handle, also reaches new AssetTransform…
- CVE-2026-30824: Flowise's Auth-Bypass Whitelist Has No Criterion. The 3.0.13 Patch Removes Three Lines.
CVE-2026-30824: Flowise's Auth-Bypass Whitelist Has No Criterion. The 3.0.13 Patch Removes Three Lines.
Flowise's auth middleware reads WHITELISTURLS first. Any inbound /api/v1/... request whose path matches startsWith(entry) for any entry on that list gets next() called on it before any token, cookie, or API key is examined.
- CVE-2026-1306: midi-Synth's Empty masterAPIkey Is the Payload
CVE-2026-1306: midi-Synth's Empty masterAPIkey Is the Payload
midi-Synth is a WordPress plugin that converts MIDI files to MP3 by handing the work off to a third-party SaaS at api2convert.com. The conversion runs server-side.
- CVE-2025-58434: Flowise Sent the Reset Token to the Inbox. It Also Sent It to the Caller.
CVE-2025-58434: Flowise Sent the Reset Token to the Inbox. It Also Sent It to the Caller.
Password reset works because the secret travels out of band. You ask the server to reset, the server emails a token to the inbox, and the in-band response says nothing useful. The caller has to read the inbox to finish the flow.
- CVE-2026-33017: Langflow's flow_id Authorized. The data Parameter Ran.
CVE-2026-33017: Langflow's flow_id Authorized. The data Parameter Ran.
Langflow is an AI workflow editor whose components are Python source. Users author Python classes in the UI; the server compiles them with exec() to instantiate the components and run the flow.
- CVE-2026-32202: The Trust Check Runs at the Click. The Coercion Runs at the Icon.
CVE-2026-32202: The Trust Check Runs at the Click. The Coercion Runs at the Icon.
In April 2026, Microsoft shipped a patch for CVE-2026-21510, the Windows Shell zero-day APT28 had been using to coerce NTLMv2 hashes out of victims who opened a folder containing a malicious .lnk.
- CVE-2012-1823: The 2024 Patch Removed The Feature The 2012 Patch Filtered
CVE-2012-1823: The 2024 Patch Removed The Feature The 2012 Patch Filtered
The nuclei template for CVE-2012-1823 still gets hits in 2026. PHP shipped one patch for it on May 3, 2012, and a second patch for the same primitive on June 6, 2024, after Orange Tsai of DEVCORE found a Windows-specific bypass.
- CVE-2024-12356: Treasury Was the Proof of Concept
CVE-2024-12356: Treasury Was the Proof of Concept
BeyondTrust ships a product called Privileged Remote Access. CVE-2024-12356 lets an unauthenticated remote attacker get privileged remote access to it. The product description and the attack description are the same four words.
- CVE-2026-35273: PeopleSoft's Environment Hub Deserializes Anyone Because It Was Built to Deserialize Its Agents
CVE-2026-35273: PeopleSoft's Environment Hub Deserializes Anyone Because It Was Built to Deserialize Its Agents
On June 10, 2026, Oracle shipped an out-of-band Security Alert for CVE-2026-35273, an unauthenticated 9.8 in PeopleSoft PeopleTools that UNC6240 (ShinyHunters) had already been running against universities since May 27.
- CVE-2026-6643: ASUSTOR's vpnupload.cgi Has Eight Buffer Overflows on a Binary With Zero Mitigations
CVE-2026-6643: ASUSTOR's vpnupload.cgi Has Eight Buffer Overflows on a Binary With Zero Mitigations
ASUSTOR's NAS appliances run ADM, an embedded Linux distribution with a web administration panel. The home-office user who configured WireGuard for remote access on their ASUSTOR did it by uploading a .conf file through that panel.
- CVE-2026-50751: Check Point's Gateway Reads One Vendor-ID Bit to Decide Whether It Verifies the Certificate. The Attacker Sets the Bit.
CVE-2026-50751: Check Point's Gateway Reads One Vendor-ID Bit to Decide Whether It Verifies the Certificate. The Attacker Sets the Bit.
Check Point's IKE daemon carries a function called verifyMessagePhase1. It checks the signature on the certificate a Remote Access VPN client presents, the one cryptographic step that proves the client holds the private key its certificate names.
- CVE-2026-5366: Prefect's GitRepository Skipped The End-Of-Options Separator The Same Patch Added One Function Down
CVE-2026-5366: Prefect's GitRepository Skipped The End-Of-Options Separator The Same Patch Added One Function Down
GitRepository.init in Prefect's src/prefect/runner/storage.py accepts a commitsha keyword, raises if the caller also passes branch, then stores the value at self.commitsha.
- CVE-2026-55199: libssh2's EXT_INFO Loop Skipped the Return Check the Rest of the File Was Running
CVE-2026-55199: libssh2's EXT_INFO Loop Skipped the Return Check the Rest of the File Was Running
libssh2packetadd() in libssh2's src/packet.c handles SSHMSGEXTINFO in a loop, reading (name, value) pairs off the wire until the server-supplied extension count reaches zero.
- CVE-2026-55200: libssh2's chacha20-poly1305 Branch Skipped the Precheck Its Sibling Already Had
CVE-2026-55200: libssh2's chacha20-poly1305 Branch Skipped the Precheck Its Sibling Already Had
libssh2transportread in libssh2's src/transport.c forks on whether the negotiated cipher requires full-packet decryption. The non-AEAD branch reads packetlength off the wire, rejects it if it exceeds LIBSSH2PACKETMAXPAYLOAD (35000, the RFC 4253 ceiling), then…
- CVE-2026-40517: fN Was the One r2 Command That Skipped the base64 Envelope
CVE-2026-40517: fN Was the One r2 Command That Skipped the base64 Envelope
The radare2 PDB parser's printgvars function emits two lines of r2 commands per global symbol when running in RAD mode. The first line interpolates the symbol name through rnamefilterdup.
- CVE-2026-26210: KTransformers' Only Scheduler-RPC Caller Was Already on Localhost
CVE-2026-26210: KTransformers' Only Scheduler-RPC Caller Was Already on Localhost
The scheduler RPC server in KTransformers binds to tcp://: on a port the default config sets to 56441. The legitimate client of that server, defined six classes down in the same file, connects to tcp://localhost:56441. There is one caller.
- CVE-2026-34910: UniFi's Auth Gate Read The Raw URI. Nginx Routed The Normalized One.
CVE-2026-34910: UniFi's Auth Gate Read The Raw URI. Nginx Routed The Normalized One.
CISA added CVE-2026-34910 to KEV with a federal civilian remediation deadline of June 26, 2026, three days from today. The CVE is described, by NVD and by Ubiquiti's advisory, as a single bug: improper input validation in UniFi OS, leading to command injection…
- CVE-2026-11645: Three Public PoCs For The V8 KEV Bug. None Of Them Read Or Write Out Of Bounds.
CVE-2026-11645: Three Public PoCs For The V8 KEV Bug. None Of Them Read Or Write Out Of Bounds.
CVE-2026-11645 is a Chrome V8 out-of-bounds read and write. Google's advisory describes "execute arbitrary code inside a sandbox via a crafted HTML page" against Chrome before 149.0.7827.103.
- CVE-2026-32136: AdGuard Home Authenticated the Upgrade, Not the Streams
CVE-2026-32136: AdGuard Home Authenticated the Upgrade, Not the Streams
The patch swaps two lines. Before, AdGuard Home wrapped web.auth.middleware() around h2c.NewHandler. After, it wraps h2c.NewHandler around web.auth.middleware(). The two configurations look symmetric. They are not.
- CVE-2026-21636: --allow-net Permitted UDS Because UDS Is Not Net
CVE-2026-21636: --allow-net Permitted UDS Because UDS Is Not Net
Node 25 ships an experimental permission model. Run a process with --permission and no --allow-net, and outbound network is denied. The denial is one line in TCPWrap::Connect. It was not in PipeWrap::Connect.
- CVE-2026-34413: Xerte's Auth Check Issued the Redirect, Then Did the Upload
CVE-2026-34413: Xerte's Auth Check Issued the Redirect, Then Did the Upload
The exploit script for CVE-2026-34413 expects every successful request to come back as HTTP 302. Anything else, the script prints Failed to upload file and exits. The 302 is the redirect Xerte's connector.php sends when a caller did not authenticate.
- CVE-2026-54420: LiteSpeed cPanel's `generateEcCert` Raced With `packageUserSize`. Namecheap Reported From Production.
CVE-2026-54420: LiteSpeed cPanel's `generateEcCert` Raced With `packageUserSize`. Namecheap Reported From Production.
LiteSpeed's June 1 patch advisory ships with a detection signature: grep -rE 'cpaneljsonapifunc=(generateEcCert|packageUserSize)|certactionentry .geneccert' /usr/local/cpanel/logs/.
- CVE-2024-21182: WebLogic Denied `ForeignOpaqueReference`. `AggregatableOpaqueReference` Reaches The Same JNDI Lookup.
CVE-2024-21182: WebLogic Denied `ForeignOpaqueReference`. `AggregatableOpaqueReference` Reaches The Same JNDI Lookup.
Oracle's patch for CVE-2023-21839 added a guard against weblogic.jndi.internal.ForeignOpaqueReference. A T3 client could no longer bind() that class into a WebLogic server's JNDI tree to coerce a server-side lookup against an attacker-controlled LDAP URL.
- CVE-2026-22812: OpenCode Patched the CORS, Not the Auth
CVE-2026-22812: OpenCode Patched the CORS, Not the Auth
The CVE description names the bug. OpenCode prior to 1.0.216 starts an HTTP server on 127.0.0.1:4096 that exposes arbitrary shell execution to any local process and to any browser tab via permissive CORS. CVSS 8.8. CWE-306.
- CVE-2026-6279: Avada Builder's call_user_func Has No Allowlist. PHP Has No Conditional-Tag Table.
CVE-2026-6279: Avada Builder's call_user_func Has No Allowlist. PHP Has No Conditional-Tag Table.
Avada Builder's FusionBuilderConditionalRenderHelper::getvalue() runs calluserfunc( $value['function'], $value['args'] ) in its wpconditionaltags branch at line 1531 of class-fusion-builder-conditional-render-helper.php.
- CVE-2026-20253: Splunk Hardcoded `-h localhost`. The `database` Field Is A libpq Connection String.
CVE-2026-20253: Splunk Hardcoded `-h localhost`. The `database` Field Is A libpq Connection String.
Splunk advisory SVD-2026-0603, published 2026-06-10, describes CVE-2026-20253 as missing authentication on the PostgreSQL sidecar's /v1/postgres/recovery/backup and /restore endpoints.
- CVE-2026-24061: The CVE Names One Variable. The Patch Sanitized Seven.
CVE-2026-24061: The CVE Names One Variable. The Patch Sanitized Seven.
GNU InetUtils telnetd through 2.7 lets an unauthenticated remote caller log in as root by setting the USER environment variable to -f root and sending it over the telnet NEW-ENVIRON option. The CVE record names that one variable.
- CVE-2026-45247: KEV Says Exploited, The Public PoC Cannot Unserialize
CVE-2026-45247: KEV Says Exploited, The Public PoC Cannot Unserialize
CISA added CVE-2026-45247 to the Known Exploited Vulnerabilities catalog on June 3, 2026 with a federal-agency patch deadline of June 6. Today is June 11. The two PoCs published against the CVE number are HORKimhab's CVE-2026-45247, whose README's "Simple Usag…
- CVE-2017-8046: PathToSpEL Did What Its Name Said
CVE-2017-8046: PathToSpEL Did What Its Name Said
A class named PathToSpEL.java is not a bug. It is a contract. The class header states it and every method states it again: this class translates a JSON Patch path into a SpEL expression, and that expression is what Spring will evaluate.
- CVE-2026-10520: Ivanti Patched The Argument To handleMessage, Not The Call
CVE-2026-10520: Ivanti Patched The Argument To handleMessage, Not The Call
Ivanti Sentry's patch for CVE-2026-10520 makes one change to ConfigServiceController.handleMessage. The call to this.configService.handleMessage(...) is still there. The return value is still assigned to the same String result. The patch keeps the call.
- CVE-2025-34291: Langflow's CORS Middleware Warns It Is Exploitable, Then Installs The Exploit
CVE-2025-34291: Langflow's CORS Middleware Warns It Is Exploitable, Then Installs The Exploit
Langflow 1.6.9's src/backend/base/langflow/main.py defines a function called warnaboutfuturecorschanges. Its body logs one line at server startup, verbatim: "SECURITY NOTICE: Current CORS configuration allows all origins with credentials." The next function in…
- CVE-2025-57819: FreePBX's Ajax Dispatcher Asked PHP If The Class Existed. PHP Loaded The File.
CVE-2025-57819: FreePBX's Ajax Dispatcher Asked PHP If The Class Existed. PHP Loaded The File.
FreePBX's BMO Ajax dispatcher takes three actions in order. It validates the module parameter the caller sent. It loads the module's PHP class. It checks the caller's Referer and session.
- CVE-2026-28318: SolarWinds Patched The Path To The Decoder, Not The Decoder
CVE-2026-28318: SolarWinds Patched The Path To The Decoder, Not The Decoder
SolarWinds Serv-U 15.5.4 Hotfix 1 fixes CVE-2026-28318 by changing how Serv-U dispatches POST requests carrying Content-Encoding: deflate. Customers who cannot install the hotfix are told to configure their reverse proxy to strip the same header from inbound P…
- CVE-2026-3300: Everest Forms Pro Sanitized Form Fields For HTML. The Calculation Addon Fed Them To eval().
CVE-2026-3300: Everest Forms Pro Sanitized Form Fields For HTML. The Calculation Addon Fed Them To eval().
The Everest Forms free plugin defines a filter hook called everestformsprocessfilter. Line 584 of includes/class-evf-form-task.php dispatches it. The Pro plugin's Calculation Addon attaches a callback named processfilter() to that hook.
- CVE-2025-32433: Erlang/OTP's SSH Server Tracked Authentication. The Dispatcher Never Read the Field.
CVE-2025-32433: Erlang/OTP's SSH Server Tracked Authentication. The Dispatcher Never Read the Field.
The Erlang/OTP #ssh record has a field called authenticated. It is declared in lib/ssh/src/ssh.hrl with default value false. The user authentication protocol flips it to true after a successful login.
- CVE-2026-34220: MikroORM's Raw-SQL Brand Was a Property Name
CVE-2026-34220: MikroORM's Raw-SQL Brand Was a Property Name
MikroORM has a primitive called RawQueryFragment. The ORM mints one at internal call sites that have already assembled a SQL string and want the rest of the codebase to inline that string into a query unquoted.
- CVE-2025-54309: The AS2 Receiver Authenticated the Admin
CVE-2025-54309: The AS2 Receiver Authenticated the Admin
The wiki page CrushFTP wrote to document this CVE is reachable at Wiki.jsp?page=CompromiseJuly2025. The page was created on July 18, 2025. MITRE assigned CVE-2025-54309 four days later.
- CVE-2026-8732: WP Maps Pro's Temp-Access Endpoint Creates Administrators. The Vendor's Email Is Hardcoded.
CVE-2026-8732: WP Maps Pro's Temp-Access Endpoint Creates Administrators. The Vendor's Email Is Hardcoded.
WP Maps Pro 6.1.0 ships a handler called wpgmptempaccessajaxcallback. The handler is registered via wpajaxnoprivwpgmptempaccessajax, callable without a session. Its first action is checkajaxreferer( 'fc-call-nonce', 'nonce' ).
- CVE-2026-0257: PAN-OS Encrypted GlobalProtect's Auth-Override Cookie With The TLS Certificate
CVE-2026-0257: PAN-OS Encrypted GlobalProtect's Auth-Override Cookie With The TLS Certificate
PAN-OS ships a GlobalProtect feature called authentication override cookies. After a user signs in, the portal hands them a cookie that lets them skip the login page on their next VPN session. The cookie is an RSA-PKCS1v15-encrypted blob.
- CVE-2025-29927: The Recursion Guard Was the Auth Bypass
CVE-2025-29927: The Recursion Guard Was the Auth Bypass
Open the Next.js documentation page for Middleware. Scroll to "Use Cases." The first bullet is "Authentication and authorization." Vercel ships middleware as the place to put your auth check.
- CVE-2026-8832: WPCode Ships A Custom Capability System. The Post Type Was Registered Without It.
CVE-2026-8832: WPCode Ships A Custom Capability System. The Post Type Was Registered Without It.
WPCode 2.3.5's includes/post-type.php calls registerposttype('wpcode', ...) with three keys: public, showui, canexport. capabilitytype is not one of them. The plugin also ships its own custom capability system in includes/capabilities.php: wpcodeeditphpsnippet…
- CVE-2026-40453: Camel Patched One Header Filter In 2025. Five More Needed The Same Line.
CVE-2026-40453: Camel Patched One Header Filter In 2025. Five More Needed The Same Line.
The patch for CVE-2025-27636 was one line. setLowerCase(true);, added to HttpHeaderFilterStrategy.initialize() in March 2025. Apache Camel ships six classes that extend DefaultHeaderFilterStrategy and apply it to inbound headers.
- CVE-2026-45321: TanStack's bundle-size.yml Poisoned the Cache. release.yml Restored It.
CVE-2026-45321: TanStack's bundle-size.yml Poisoned the Cache. release.yml Restored It.
TanStack's compromised workflow was bundle-size.yml. The workflow that published 84 malicious versions across 42 @tanstack/ packages on May 11 was release.yml.
- CVE-2025-8061: LnvMSRIO Does What Its Name Says
CVE-2025-8061: LnvMSRIO Does What Its Name Says
LnvMSRIO.sys is a Lenovo kernel driver named after what it does. Lenovo, Model-Specific Register, Input/Output. Read MSR. Write MSR. Read physical memory. Write physical memory.
- CVE-2026-41242: protobufjs's Type Name Was JavaScript
CVE-2026-41242: protobufjs's Type Name Was JavaScript
The patch is one line in the Type constructor. name = name.replace(/\W/g, "");. It strips every character that is not a letter, a digit, or an underscore from anything passed as a protobuf type name.
- CVE-2025-25279: Mattermost's fileId Was Never An ID
CVE-2025-25279: Mattermost's fileId Was Never An ID
CVE-2025-25279's description names the mechanism: improper validation of board blocks during import and export. The student PoC the scanner surfaced opens with curl /plugins/focalboard/api/v2/boards, creates a card, attaches a block whose fileId field is the l…
- CVE-2026-5118: Divi Form Builder's Role Check Asked Whether the Role Existed. Administrator Existed.
CVE-2026-5118: Divi Form Builder's Role Check Asked Whether the Role Existed. Administrator Existed.
The Divi Form Builder 5.1.3 changelog, dated 13 April 2026, reads: "Registration forms always assign the role chosen in the form settings, so new accounts cannot be given a higher role than the one you configured." The word doing work in that sentence is "alwa…
- CVE-2026-9082: The Comment Said Use the Array Values. A 2020 Refactor Started Using the Keys.
CVE-2026-9082: The Comment Said Use the Array Values. A 2020 Refactor Started Using the Keys.
Drupal's patch for CVE-2026-9082 is one function call: arrayvalues(), wrapped around a foreach in the PostgreSQL Entity Query condition translator. The comment two lines above that foreach has named that exact function since June 30, 2015.
- CVE-2010-0249: The KEV Deadline for Aurora Is a Census
CVE-2010-0249: The KEV Deadline for Aurora Is a Census
CISA added CVE-2010-0249 to the Known Exploited Vulnerabilities catalog on May 20, 2026, with a federal remediation deadline of June 3. The bug is sixteen years old.
- CVE-2026-21877: The Helper That Stops This Bug Was Already in n8n
CVE-2026-21877: The Helper That Stops This Bug Was Already in n8n
The patch for CVE-2026-21877 adds eight lines to n8n's Git node and one line to a helper interface. The eight lines are a single if statement: ask whether the path is blocked, throw if it is.
- CVE-2025-27407: graphql-ruby Loaded the Schema by Compiling It
CVE-2025-27407: graphql-ruby Loaded the Schema by Compiling It
The graphql-ruby fix for CVE-2025-27407 ships in three pieces. It validates field and argument names against /^[a-zA-Z][a-zA-Z0-9]$/, so a name with a newline raises InvalidNameError before reaching anything else.
- CVE-2026-33937: Handlebars Trusts Its Own AST
CVE-2026-33937: Handlebars Trusts Its Own AST
The PoC for CVE-2026-33937 is a JSON file. The application's HTTP handler deserializes the body, hands the resulting object to Handlebars.compile, and gets back a function. When the function is called, it stringifies process.env into the rendered email.
- CVE-2026-20182: The PoC Is the README. The Exploit Is a Bitcoin Address.
CVE-2026-20182: The PoC Is the README. The Exploit Is a Bitcoin Address.
CVE-2026-20182 was published by Cisco on May 14, 2026. CISA added it to the Known Exploited Vulnerabilities Catalog the same week with a federal civilian remediation deadline of May 17.
- CVE-2026-42897: EOMT Deploys to Outbound Rules. Health Checker Reads Inbound.
CVE-2026-42897: EOMT Deploys to Outbound Rules. Health Checker Reads Inbound.
CVE-2026-42897 is a cross-site scripting bug in Outlook Web Access. Microsoft published it on May 15. CISA added it to KEV the same week with a remediation deadline of May 29.
- CVE-2026-42945: The Other Half of the 2012 Patch
CVE-2026-42945: The Other Half of the 2012 Patch
On 22 April 2026, Roman Arutyunyan committed one line to ngxhttpscript.c. The line was e->isargs = 0;. It went directly above an existing line, e->quote = 0;, that had been sitting in the same function since May 2005.
- CVE-2026-0740: Ninja Forms Shipped the Patch on February 10. The Bug Shipped Until March 19.
CVE-2026-0740: Ninja Forms Shipped the Patch on February 10. The Bug Shipped Until March 19.
Ninja Forms File Uploads 3.3.25 shipped on February 10, 2026 as a security fix for CVE-2026-0740. Ninja Forms File Uploads 3.3.27 shipped on March 19, 2026 as a security fix for CVE-2026-0740. The first one did not fix it. The second one did.
- CVE-2026-34159: The Deserializer Three CVEs Have Not Patched
CVE-2026-34159: The Deserializer Three CVEs Have Not Patched
The patch is three lines. The bug is in the function none of the three patches changed.
- CVE-2024-22120: Zabbix's Audit Log Is the Read Primitive
CVE-2024-22120: Zabbix's Audit Log Is the Read Primitive
Zabbix Server's trapper port accepts a command request from authenticated users who have permission to execute a global script on a host they can see. When the request lands, the server runs the script and inserts a row into the auditlog table recording who, w…
- CVE-2026-25604: The PoC Tests /login. The Bug Is on /login_callback.
CVE-2026-25604: The PoC Tests /login. The Bug Is on /login_callback.
The PoC for CVE-2026-25604 runs a Flask mock. The mock builds the SAML AssertionConsumerService URL from the Host request header and shows an AuthnRequest that instructs AWS IAM Identity Center to redirect the SAML response to attacker.com:9090.
- CVE-2026-42238: Nginx-UI's Backup Signature Is Signed By Whoever Sends the Backup
CVE-2026-42238: Nginx-UI's Backup Signature Is Signed By Whoever Sends the Backup
Nginx-UI v2.3.7 ships a backup-restore endpoint at POST /api/restore whose authentication gate is a clock. The gate checks two booleans: InstallLockStatus() returns true if the JWT secret is set or if SkipInstallation is true, and IsInstallTimeoutExceeded() re…
- CVE-2026-23918: m->spurge Was an h2_ihash. The Array That Replaced It Kept the Assertion, Not the Dedup.
CVE-2026-23918: m->spurge Was an h2_ihash. The Array That Replaced It Kept the Assertion, Not the Dedup.
The Apache HTTP Server 2.4.67 release notes credit r1930444 and r1930796 for closing CVE-2026-23918. Both backport one upstream commit, [icing/modh2#312](https://github.com/icing/modh2/commit/b18fc7d2f8f5efe1336ba05ef25ada52fdaf3967), titled "stream purge." Th…
- Dirty Frag: the patched half is the half Ubuntu already mitigated
Dirty Frag: the patched half is the half Ubuntu already mitigated
CVE-2026-43284 patches a branch added to espinput in January 2017. The branch was correct in 2017. It was correct again in 2018. It was correct in 2020 and in 2022.
- CVE-2026-43284 + CVE-2026-43500: The Flag Was on TCP. UDP Did Not Set It.
CVE-2026-43284 + CVE-2026-43500: The Flag Was on TCP. UDP Did Not Set It.
On May 5, 2026, commit f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4 landed in the upstream Linux kernel. Author Kuan-Ting Chen, committer Steffen Klassert. Title: xfrm: esp: avoid in-place decrypt on shared skb frags.
- CVE-2023-50094: The CVE Number Is a Drawer, and reNgine Put Seven Bugs In It
CVE-2023-50094: The CVE Number Is a Drawer, and reNgine Put Seven Bugs In It
The Nuclei template CVE-2023-50094.yaml authenticates to reNgine, sends POST /scan-engine/update with JSON {"nmapcmd": "curl {{interactsh-url}}"}, and treats a DNS callback as confirmation.
- CVE-2026-39987: The Only WebSocket in Marimo Without an Auth Check Was the One That Forks a Shell
CVE-2026-39987: The Only WebSocket in Marimo Without an Auth Check Was the One That Forks a Shell
Marimo is a Python notebook server. Started with marimo edit, it binds HTTP and WebSocket routes for the editor, the kernel, LSP proxying, and, as of a feature added in July 2024, an in-browser terminal. The terminal endpoint lives at /terminal/ws.
- CVE-2017-9822: The Patch Encrypted the Cookie. The Deserializer Is Still Public.
CVE-2017-9822: The Patch Encrypted the Cookie. The Deserializer Is Still Public.
CVE-2017-9822 was assigned in 2017. The fix shipped in fifteen lines touching one method. CISA later added the entry to the KEV catalog. EPSS percentile sits at 99.94, the top hundredth of CVEs by predicted exploitation, and that percentile has not moved.
- CVE-2025-23211: bleach Is An HTML Sanitizer. Jinja2 Does Not Read HTML.
CVE-2025-23211: bleach Is An HTML Sanitizer. Jinja2 Does Not Read HTML.
Tandoor Recipes renders every recipe step through jinja2.Template(). The template engine is not sandboxed, has full access to Python builtins, and has been configured that way since January 5, 2021.
- CVE-2025-9209: The RestroPress JWT Is Not Forged. The Plugin Signs It For You.
CVE-2025-9209: The RestroPress JWT Is Not Forged. The Plugin Signs It For You.
The RestroPress WordPress plugin registers a REST route at /wp-json/rp/v1/auth and calls it authentication. The handler reads the Authorization header, stashes whatever value is there, and uses it as the HMAC key to sign a JWT.
- CVE-2026-41940: cPanel's Session File Is a Bus. The Basic Auth Password Wrote a Line to It.
CVE-2026-41940: cPanel's Session File Is a Bus. The Basic Auth Password Wrote a Line to It.
cPanel's session state for an in-flight login lives in a file at /var/cpanel/sessions/raw/:<id>. The file is a flat key=value list, one record per line. The internal-auth handler sets successfulinternalauthwithtimestamp by appending a line to it.
- CVE-2026-31431: authencesn Has Been Writing Those Four Bytes for Nine Years. The Patch Is Not in authencesn.
CVE-2026-31431: authencesn Has Been Writing Those Four Bytes for Nine Years. The Patch Is Not in authencesn.
AFALG is the Linux kernel's userspace door into its in-tree crypto API. An unprivileged process opens a socket, names an algorithm, sends bytes through, gets ciphertext or plaintext back.
- CVE-2026-3854: rails_env Is a Header Field. The Header Took User Input.
CVE-2026-3854: rails_env Is a Header Field. The Header Took User Input.
babeld is the proxy at the front of GitHub Enterprise Server's git push pipeline. gitrpcd is the RPC server downstream. Between them, babeld writes a single header named X-Stat that gitrpcd parses as the source of truth for what code to run and whether to sand…
- CVE-2024-47575: FortiManager's get auth Command Does Not Authenticate
CVE-2024-47575: FortiManager's get auth Command Does Not Authenticate
FortiManager's fgfm protocol listens on TCP port 541. A FortiGate registers itself by opening a TLS connection and sending a command named get auth. The command does not authenticate. It is a question the server answers, not a challenge it issues.
- CVE-2026-33634: The Scanner Ran. So Did Their Code.
CVE-2026-33634: The Scanner Ran. So Did Their Code.
The security scanner that tells you what is wrong with your infrastructure needs access to your infrastructure. That is the product working as designed. TeamPCP read the job description.
- CVE-2024-45409: The SignatureValue Verified. The DigestValue Compared Was Not in the Signature.
CVE-2024-45409: The SignatureValue Verified. The DigestValue Compared Was Not in the Signature.
Ruby-SAML verified the SignatureValue. The cryptographic operation over SignedInfo was correct, the certificate chained to the IdP, the XMLDSig was real. The problem was not there.
- CVE-2026-0827: LdeApi.Server.exe Assumes It Creates the Directory First
CVE-2026-0827: LdeApi.Server.exe Assumes It Creates the Directory First
LdeApi.Server.exe runs as SYSTEM and writes MP27AM7Westimation.json to C:\ProgramData\Lenovo\LDE\SYSTEM. On a fresh Lenovo install, that directory does not exist.
- CVE-2026-3844: The Gravatar Fetcher Fetched Anything
CVE-2026-3844: The Gravatar Fetcher Fetched Anything
The CVE description names one missing check: file type validation. The patch added four. It now refuses any URL whose host is not gravatar.com, refuses any filename whose extension is not in an image allowlist, refuses any HTTP response whose detected content-…
- CVE-2026-41651: Polkit Authorized the Slot, Not the Value
CVE-2026-41651: Polkit Authorized the Slot, Not the Value
I cloned both public PoCs of CVE-2026-41651 yesterday morning. They are byte-for-byte identical except for the ASCII banner. One README ends with "This repository is for educational and defensive security purposes only.
- Seventeen Green Checkmarks
Seventeen Green Checkmarks
I was scouting CVEs for this site when I read the description.
- CVE-2026-40261: The Injection Is in syncCodeBase, Not generateP4Command
CVE-2026-40261: The Injection Is in syncCodeBase, Not generateP4Command
The PoC repository's package description says it demonstrates "shell injection in Perforce generateP4Command." The two payload files agree: vector 1 injects through the port flag, vector 2 through the user flag. Those are CVE-2026-40176.
- CVE-2026-34621 Revisited: The 136-Day Detection Lie
CVE-2026-34621 Revisited: The 136-Day Detection Lie
On November 28, 2025, someone uploaded a PDF to VirusTotal. The filename was Invoice540.pdf. Thirteen of sixty-four antivirus engines flagged it. The other fifty-one saw a document.
- CVE-2026-3891: The Capability Check Is Missing Because the Nonce Check Was Never a Capability Check
CVE-2026-3891: The Capability Check Is Missing Because the Nonce Check Was Never a Capability Check
The C6 Bank integration for Pix for WooCommerce 1.5.0 exposes two AJAX endpoints. The first generates a WordPress nonce for the C6 settings context. The second accepts certificate file uploads and verifies that nonce before writing to disk.
- CVE-2026-34486: EncryptInterceptor Only Encrypts Messages That Survive Decryption
CVE-2026-34486: EncryptInterceptor Only Encrypts Messages That Survive Decryption
The Tomcat cluster port at TCP 4000 has one access control mechanism when EncryptInterceptor is configured: if your message cannot be decrypted with the cluster's AES key, it gets dropped. That is the contract the configuration implies.
- CVE-2026-39808: One curl to Root on the Box That's Supposed to Catch Malware
CVE-2026-39808: One curl to Root on the Box That's Supposed to Catch Malware
The device that receives your suspicious files, detonates them in an isolated VM, and tells your SOC whether they're malicious, that device is running an unauthenticated root shell endpoint.
- CVE-2026-34621: Adobe Acrobat's Privilege Gate Inherits What It Checks
CVE-2026-34621: Adobe Acrobat's Privilege Gate Inherits What It Checks
The PDF arrives as an invoice. It runs its JavaScript before you see the first page. The first thing it does is tell Object.prototype what to say when asked whether it's trusted.
- BlueHammer: What the Researcher Commented Out
BlueHammer: What the Researcher Commented Out
cfreg.ProviderName = L"IHATEMICROSOFT";
- UnDefend: What Chaotic Eclipse Held Back This Time
UnDefend: What Chaotic Eclipse Held Back This Time
Line 209 of UnDefend.cpp, inside WDKillerCallback, reads:
- The Trust Inversion
The Trust Inversion
A researcher called Chaotic Eclipse tried to do the right thing. They found a zero-day in Windows Defender, a SYSTEM write through the antivirus's own remediation engine. They reported it. Someone violated the disclosure agreement. So they published.
- RedSun: How Windows Defender's Remediation Became a SYSTEM File Write
RedSun: How Windows Defender's Remediation Became a SYSTEM File Write
The comment is on the line where the Cloud Files provider name is set.
- SAP NetWeaver CVE-2025-31324: When CVSS 10.0 Means What It Says
SAP NetWeaver CVE-2025-31324: When CVSS 10.0 Means What It Says
CVSS 10.0 is supposed to be a number that appears rarely enough to mean something. The scoring rubric requires everything to go wrong simultaneously: the vulnerability must be network-reachable, require no authentication, require no user interaction, and produ…
- Axios, Sapphire Sleet, and 70 Million Weekly Installs
Axios, Sapphire Sleet, and 70 Million Weekly Installs
On March 31, 2026, the axios npm package was compromised. Two malicious versions, 1.14.1 and 0.30.4, were published through the primary maintainer account, "jasonsaayman." Both looked like routine version bumps.
- TeamPCP Came for the Scanners
TeamPCP Came for the Scanners
Your CI pipeline runs Trivy. It scans containers, scans IaC, flags vulnerable dependencies. It's the canary. It's trusted. It runs early in the pipeline with elevated access to secrets because that's what security tooling needs to function.
- Oracle Cloud: The Breach They Technically Didn't Deny
Oracle Cloud: The Breach They Technically Didn't Deny
"There has been no breach of Oracle Cloud. The published credentials are not for the Oracle Cloud. No Oracle Cloud customers experienced a breach or lost any data."
- Prompt Injection Is a Supply Chain Attack
Prompt Injection Is a Supply Chain Attack
The security community is debating prompt injection as an AI safety problem. Some frame it as an alignment failure, the model is doing something it shouldn't. Neither framing is right, and the wrong frame means the wrong fix.
- MCP Servers: The New npm Left-Pad
MCP Servers: The New npm Left-Pad
In March 2016, Azer Koçulu unpublished 273 npm packages. One of them, left-pad, was eleven lines of string-padding utility. It brought down React, Babel, and the builds of thousands of projects that had never heard of it.
- Shai-Hulud: The First npm Worm
Shai-Hulud: The First npm Worm
September 14, 2025. Researchers named it Shai-Hulud, after the sandworm in Dune. By the time npm's incident team finished revoking tokens and yanking versions, 500+ package releases had been compromised, some of them carrying millions of weekly downloads.
- xrpl.js: The Official Package Was the Threat
xrpl.js: The Official Package Was the Threat
The XRP Ledger's official JavaScript SDK, xrpl on npm, published by the XRPL Foundation, 4.2 million weekly downloads, shipped a backdoor in late April 2025. Versions 4.2.1 through 4.2.4, plus 2.14.2 on the legacy branch.
- CLFS: Ransomware's Favorite Kernel Driver
CLFS: Ransomware's Favorite Kernel Driver
Five exploited-in-wild local privilege escalation vulnerabilities from a single kernel driver in three years. That's not a run of bad luck. That's a structural condition Microsoft keeps patching at the wrong scope.
- CrushFTP CVE-2025-31161: MFT Is the Target Now
CrushFTP CVE-2025-31161: MFT Is the Target Now
CrushFTP just shipped a patch for CVE-2025-31161: authentication bypass in the WebInterface component, CVSS 9.8, unauthenticated, network-accessible, low complexity.
- tj-actions: Mutable Tags Were Always a Lie
tj-actions: Mutable Tags Were Always a Lie
When you write uses: tj-actions/changed-files@v45 in a workflow, you're not pinning to a version. You're trusting that a stranger won't move the tag. That's not a pin. That's a prayer.
- Bybit: $1.5B via a JavaScript Injection Nobody Was Looking For
Bybit: $1.5B via a JavaScript Injection Nobody Was Looking For
On February 21, 2025, Bybit lost 401,347 ETH, approximately $1.46 billion at execution price, in a single transaction. Not a smart contract exploit. Not a bridge attack. Not a flash loan cascade.
- Ivanti: The Vulnerability Subscription
Ivanti: The Vulnerability Subscription
Ivanti disclosed CVE-2025-0282 on January 8, 2025. Mandiant's retrospective analysis placed active exploitation in December 2024, at least 12 days prior. During that window, organizations running Ivanti Connect Secure had no patch to apply, no advisory to act…