Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• highCVE-2026-55830

  CVE-2026-55830: RestrictedPython Guard Hook Shadow via Positional-Only Arguments

  Sandboxed code in RestrictedPython can replace the library's own security hooks by naming a positional-only function parameter after them, making every attribute or item access bypass the policy the…

• highCVE-2026-55848

  CVE-2026-55848: MapFish Print XXE via GML Layer URL

  MapFish Print fetches and parses GML layer XML without disabling external entities, letting an unauthenticated attacker read arbitrary server files or hit internal services by pointing the layer URL…

• highCVE-2026-55764

  CVE-2026-55764: klever-go SFT Add-Quantity int64 Overflow Bypasses Per-Nonce MaxSupply

  A missing overflow guard in klever-go's SFT mint path lets anyone with a mint role bypass a nonce's declared maximum supply and mint up to ~9.2 quintillion tokens in a single transaction.

• highCVE-2026-55841

  CVE-2026-55841: Graylog FortiGate Syslog Parser Field Injection

  An attacker who can influence syslog messages reaching Graylog can embed fake key-value pairs inside quoted field values to silently overwrite real log fields or cause messages to be discarded…

• highCVE-2026-55874

  CVE-2026-55874: SeaweedFS S3 Gateway Cross-Bucket Path Traversal via X-Amz-Copy-Source

  A flaw in SeaweedFS lets an attacker who controls one bucket read objects from any other bucket on the same instance by smuggling dot-dot segments in the S3 copy-source header, bypassing bucket-level…

• highCVE-2026-55784

  CVE-2026-55784: free5GC AUSF Authentication Context Race Condition

  The free5GC AUSF stores per-subscriber authentication state under a key that is only the subscriber identifier, so flooding it with concurrent authentication requests for the same subscriber…

• highCVE-2026-55761

  CVE-2026-55761: Portainer Unauthenticated Admin Takeover via Initialization Endpoints

  A freshly deployed Portainer instance exposes its admin-creation and database-restore endpoints to anyone on the network for up to five minutes after startup, letting an attacker silently claim full…

• highCVE-2026-55584

  CVE-2026-55584: phpSysInfo IP Allowlist Bypass via Spoofed Headers

  Any remote attacker can bypass phpSysInfo's IP-based access restriction by faking a trusted address in the X-Forwarded-For or Client-IP HTTP header, exposing full system information to the internet.

• highCVE-2026-55638

  CVE-2026-55638: 9router Unauthenticated LLM Proxy Access via /codex Rewrite Authorization Bypass

  A missing path in 9router's middleware allow-list lets anyone hit the LLM proxy without an API key, draining the operator's provider credits.

• highCVE-2026-55641

  CVE-2026-55641: 9router Authentication Bypass via Host Header Spoofing and SSRF

  9router's local-request check trusts the client-supplied Host header instead of the actual TCP peer address, so any remote attacker who can reach the port can forge Host: localhost to skip API-key…

• criticalCVE-2026-55634

  CVE-2026-55634: Pimcore DataObject Field Name Remote Code Execution and SQL Injection

  A content editor with standard DataObjects permission can import a crafted class definition whose field name injects arbitrary PHP into Pimcore's generated class files, giving full remote code…

• highCVE-2026-55484

  CVE-2026-55484: alos-http Unauthenticated Remote Denial of Service via Malformed Path

  A single HTTP request with a path starting with '?' crashes the entire alos-http server process due to an unchecked index into an empty string, taking down all connections instantly.