Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• criticalCVE-2026-54069

  CVE-2026-54069: SiYuan Unauthenticated Admin API Access via chrome-extension:// Origin Bypass

  Any Chrome or Chromium extension installed on a desktop running SiYuan can call every admin API endpoint without a password, because the kernel blindly trusts all chrome-extension:// origins and…

• criticalCVE-2026-54089

  CVE-2026-54089: File Browser Authentication Bypass via Proxy Header Forgery

  When File Browser is configured to use proxy authentication, anyone who can reach the server directly can impersonate any user, including admin, by sending a single forged HTTP header with no…

• highCVE-2026-49866

  CVE-2026-49866: @libp2p/gossipsub CPU DoS via Oversized IHAVE and IWANT Control Messages

  Any node running @libp2p/gossipsub with default settings can be forced to burn its entire CPU on a single malicious peer's oversized control messages, because the library placed no limit on how many…

• highCVE-2026-49851

  CVE-2026-49851: mistune Quadratic-Time DoS in parse_link_text

  Sending a few thousand open-bracket characters to any app that parses user Markdown with mistune causes the CPU to spin for seconds, making denial-of-service trivially cheap.

• highCVE-2026-48594

  CVE-2026-48594: Tesla Middleware Decompression Bomb (DoS)

  The Tesla HTTP client library for Elixir will blindly decompress any server response with no size limit, so an attacker who controls a server can crash or freeze any app that uses its decompression…

• highCVE-2026-48597

  CVE-2026-48597: Tesla Mint Adapter BEAM Atom Table Exhaustion via Untrusted URL Scheme

  Tesla's Mint adapter converts attacker-controlled URL schemes into permanent BEAM atoms with no validation, letting anyone crash an Elixir application by flooding it with ~1 million unique scheme…

• highCVE-2026-49754

  CVE-2026-49754: Mint HTTP/2 CONTINUATION Flood Memory Exhaustion

  A malicious HTTP/2 server can crash any Elixir process using Mint by sending an endless stream of CONTINUATION frames, filling the client's memory with no limit until the BEAM process dies.

• highCVE-2026-48862

  CVE-2026-48862: Mint HTTP/2 Client Memory Exhaustion via PUSH_PROMISE Flood

  A malicious HTTP/2 server can crash any Elixir process using Mint by flooding it with PUSH_PROMISE frames and never sending the matching response headers, causing unbounded memory growth with no way…

• criticalCVE-2026-52766

  CVE-2026-52766: YesWiki Unauthenticated Arbitrary Page Deletion

  Any anonymous visitor of a default YesWiki install can permanently delete any wiki page, including the front page, by abusing the unguarded spam-cleanup action.

• highCVE-2026-52767

  CVE-2026-52767: YesWiki ActivityPub Signature-Verification Bypass

  A logic flaw in YesWiki's ActivityPub inbox lets any unauthenticated attacker create, update, or delete wiki entries by sending a crafted HTTP request with a junk signature that PHP's openssl_verify…

• highCVE-2026-52769

  CVE-2026-52769: YesWiki Unauthenticated SSRF via ActivityPub Signature keyId

  An unauthenticated attacker can trick YesWiki into making arbitrary outbound HTTP requests to any host, including internal cloud metadata endpoints, by setting the keyId field in an HTTP Signature…

• highCVE-2026-52770

  CVE-2026-52770: YesWiki Bazar API Unauthenticated Boolean-Based SQL Injection

  Any unauthenticated visitor can inject SQL into YesWiki's public Bazar entry-listing API by abusing numeric field filters, turning the API into a boolean oracle that leaks database contents…