Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• highCVE-2026-59185

  CVE-2026-59185: Identrail Cross-Tenant IDOR via Unverified GitHub App installation_id

  Any authenticated Identrail tenant can hijack another customer's GitHub App installation by supplying that customer's installation ID in a single API call, then read their private repositories.

• highCVE-2026-59176

  CVE-2026-59176: functype-mcp-server set_functype_version Package Alias RCE

  The functype-mcp-server MCP tool accepts a raw version string and pipes it straight into a pnpm install command, letting anyone who can talk to the server install an arbitrary local or remote package…

• highCVE-2026-59177

  CVE-2026-59177: esphome-device-builder Unauthenticated Dashboard Access via Unrestricted Ingress Bind

  The ESPHome Device Builder Home Assistant add-on exposed its password-free dashboard to every device on the local network because the internal ingress site accidentally listened on all network…

• highCVE-2026-59179

  CVE-2026-59179: @openhop/server Path Traversal in Flow ID File Operations

  The @openhop/server package passes unsanitized route parameters directly into filesystem path construction, letting any unauthenticated caller read or permanently delete arbitrary YAML files outside…

• highCVE-2026-55864

  CVE-2026-55864: GeoNetwork Unauthenticated SSRF in SLD Tool

  Any anonymous user can make a GeoNetwork server silently fetch arbitrary internal URLs by abusing the SLD map-styling endpoint, allowing internal network reconnaissance and data disclosure with no…

• highCVE-2026-85730

  CVE-2026-85730: smol-toml Denial of Service via Infinite Loop in Parser

  Feeding smol-toml a TOML array or inline table whose comment has no trailing newline causes the parser to loop forever, pinning the CPU and hanging any Node.js service that processes untrusted input.

• high

  CVE-2026-69439: Microsoft.DiaSymReader.Native Heap-Based Buffer Overflow (EoP)

  A heap-based buffer overflow in the .NET symbol-reader component lets a network attacker elevate privileges by feeding it a crafted Portable PDB file.

• high

  CVE-2026-71328: Microsoft.DiaSymReader.Native Heap-Based Buffer Overflow via Malformed Portable PDB

  A crafted Portable PDB debug file can trigger a heap buffer overflow in the .NET symbol reader, letting a remote attacker run arbitrary code on any machine that opens or loads the malicious file.

• highCVE-2026-71328

  CVE-2026-71328: Microsoft.DiaSymReader.Native Heap Buffer Overflow via Malformed MSFZ PDB

  A crafted MSFZ-format PDB file can trigger an out-of-bounds heap write inside Microsoft.DiaSymReader.Native, letting an attacker execute arbitrary code on any Windows machine that opens the file.

• highCVE-2026-69439

  CVE-2026-69439: Microsoft.DiaSymReader.Native Heap-Based Buffer Overflow

  A crafted Portable PDB file can trigger an out-of-bounds heap write in the .NET symbol-reader library, letting an attacker escalate privileges on any Windows machine that loads the file.

• highCVE-2026-69522

  CVE-2026-69522: Microsoft.DiaSymReader.Native Heap-based Buffer Overflow RCE

  A heap-based buffer overflow in the .NET PDB reader lets an attacker trigger remote code execution by supplying a crafted PDB file to any application that loads debug symbols.

• high

  CVE-2026-69522: Microsoft.DiaSymReader.Native Heap-based Buffer Overflow RCE

  A heap-based buffer overflow in the native PDB symbol-reader library shipped with .NET and Visual Studio lets a network-reachable attacker execute arbitrary code on any machine that opens a malicious…