Labs
Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.
- highCVE-2026-55621
CVE-2026-55621: Incus Project Restriction Bypass via Custom Volume Copy
A restricted Incus user can copy a custom storage volume out of a project they have no access to, potentially exposing secrets stored in that volume.
- criticalCVE-2026-55247
CVE-2026-55247: plone.app.event iCalendar Import DoS, SSRF, and Stored XSS
A logged-in editor on a Plone site can crash the server, probe internal network services, read local files, or plant JavaScript in calendar events, all by abusing the built-in iCalendar import form.
- highCVE-2026-55207
CVE-2026-55207: Pimcore Studio Backend Bundle Account Takeover via Password Reset URL Injection
An unauthenticated attacker can hijack any Pimcore admin account by injecting their own server URL into the password reset request, causing Pimcore to mail the victim a real recovery token that lands…
- highCVE-2026-55215
CVE-2026-55215: mariadb (npm) Cleartext Password Leak to MitM via Late SSL Fingerprint Check
The MariaDB Node.js connector sends your database password to the network peer before checking whether the server is actually who it claims to be, so anyone in a position to intercept the connection…
- highCVE-2026-55208
CVE-2026-55208: Pimcore Studio Backend Bundle SQL Injection via DateFilter Column Key
An authenticated Pimcore user can break out of a backtick-wrapped SQL identifier in the DateFilter and inject arbitrary SQL, including time-based blind queries that extract admin password hashes and…
- highCVE-2026-55212
CVE-2026-55212: Pimcore Studio Backend Bundle Privilege Escalation via Incorrect Permission Guard on Class Definition Creation
A wrong permission check on Pimcore's Studio API lets any content editor create class definitions (a schema-level admin operation) without ever having admin rights.
- highCVE-2026-55673
CVE-2026-55673: powsybl-computation-local OS Command Injection via LocalCommandExecutor
PowSyBl Core's local command executors build shell command strings by concatenating user-supplied arguments and environment variable values, then pass them to bash -c or cmd /c, letting an attacker…
- highCVE-2026-55622
CVE-2026-55622: Incus Project Restriction Bypass in Instance Copy
A restricted Incus user who knows the name of a project and instance they should not be able to access can copy that instance into a project they do control, exposing any secrets stored inside it.
- highCVE-2026-55175
CVE-2026-55175: Spinnaker rosco-manifests Unsafe YAML Deserialization RCE
A crafted kustomization.yaml file fed to Spinnaker's Kustomize bake stage can trigger SnakeYAML unsafe deserialization and execute arbitrary code inside the rosco pod.
- highCVE-2026-55228
CVE-2026-55228: Weblate GroupViewSet IDOR Allows Unauthorized Private Project Access
A logged-in project manager can trick Weblate's team API into granting themselves read and write access to any private project they should not be able to see, just by editing a group's project list…
- criticalCVE-2026-55248
CVE-2026-55248: plone.app.portlets RSS Portlet DoS, SSRF, and Stored XSS
A site member with portlet management rights can point Plone's built-in RSS portlet at a malicious URL to exhaust server memory, probe internal network hosts, or inject JavaScript that runs in every…
- highCVE-2026-55520
CVE-2026-55520: Protego ReDoS via robots.txt Wildcard Directive
Protego's robots.txt parser can be frozen indefinitely by a crafted Disallow directive containing many asterisks, because each wildcard becomes a lazy regex piece that causes catastrophic exponential…