Labs
Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.
- highCVE-2026-55245
CVE-2026-55245: Bifrost isPublicIP SSRF Deny-List Bypass via NAT64, 6to4, and CGNAT
Bifrost's AI gateway will fetch internal URLs it should block, including the cloud instance-metadata endpoint, because its IP allow/deny classifier misses CGNAT, IPv6 6to4, NAT64, and deprecated…
- highCVE-2026-55460
CVE-2026-55460: Snipe-IT Authorization Bypass on Bulk User Delete
A logged-in Snipe-IT user with only edit permissions can silently delete other users by bypassing the permission gate that protects the bulk-delete endpoint.
- highCVE-2026-55516
CVE-2026-55516: Snipe-IT Cross-Company Asset Maintenance Re-Parenting via API
An authenticated Snipe-IT API user can move a maintenance record onto an asset belonging to a different company, breaking tenant isolation in multi-company deployments.
- highCVE-2026-55521
CVE-2026-55521: Yamcs Core API Multiple Missing Authorization Checks
Any authenticated Yamcs user, even one with no assigned roles, can read sensitive telemetry indexes, disable satellite COP-1 command links, and manipulate global simulation time because three REST…
- highCVE-2026-55552
CVE-2026-55552: Yamcs Unauthenticated Directory Traversal via Double-Slash URI
A missing path check in Yamcs's built-in web server lets anyone read any file on the host machine without logging in, just by prepending a double slash to the file path in a browser URL.
- criticalCVE-2026-55559
CVE-2026-55559: yamcs-core Remote Code Execution via Instance Template YAML Injection
A flaw in Yamcs lets an attacker inject raw YAML into an instance config file through an unescaped template argument, causing Yamcs to load an attacker-controlled service class and execute arbitrary…
- highCVE-2026-55066
CVE-2026-55066: Vikunja Kanban Move-Task IDOR (Cross-Tenant Task Read and Write)
Any authenticated Vikunja user can read the full contents of every other user's tasks and mark them done by supplying an arbitrary task ID in the kanban move-task request body, bypassing all…
- criticalCVE-2026-55511
CVE-2026-55511: yamcs-core Authenticated RCE via StreamSQL Aggregate Column-Name Injection
An authenticated Yamcs user with archive-management privileges can craft a malicious table column name that gets compiled as raw Java code by the Yamcs query engine, giving the attacker full remote…
- highCVE-2026-54788
CVE-2026-54788: datadog-opentelemetry Unbounded tracestate Parsing DoS
A remote attacker can crash or degrade any Rust service using the datadog-opentelemetry crate by sending a single HTTP request with an oversized or key-pair-flooded W3C tracestate header, forcing the…
- highCVE-2026-55108
CVE-2026-55108: KubeVela Terraform Remote Loader Symlink DoS
An attacker with permission to create a KubeVela ComponentDefinition can point its Terraform remote schematic at a git repo containing a symlink to /dev/zero, causing the vela-core controller to read…
- highCVE-2026-54757
CVE-2026-54757: compliance-trestle Server-Side Template Injection via Markdown Include Tags
A malicious Markdown file placed in a trestle workspace can execute arbitrary operating system commands on the server because the md_clean_include and mdsection_include Jinja2 tags re-parse untrusted…
- criticalCVE-2026-54754
CVE-2026-54754: klever-go Marketplace Settlement Integer Underflow Mints KLV
A flaw in the Klever blockchain marketplace settlement logic lets an attacker set royalty and referral percentages that together exceed 100%, causing the node to pay out more KLV than it collected…