Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• criticalCVE-2026-54755

  CVE-2026-54755: klever-go Integer Overflow in Split-Royalty Validation Enables Unbounded KLV Minting

  A uint32 wraparound in Klever's split-royalty validation lets any user create an asset whose royalty percentages overflow to zero on check but pay out astronomically large amounts of KLV to…

• highCVE-2026-54736

  CVE-2026-54736: Phalcon Crypt::decrypt HMAC Timing Side-Channel

  Phalcon's encrypted-payload verification used a non-constant-time string comparison for HMAC tags, letting a remote attacker recover a valid tag byte-by-byte from response timing and forge…

• highCVE-2026-57584

  CVE-2026-57584: Phalcon Router Catastrophic Backtracking (ReDoS)

  A nested quantifier in Phalcon's default MVC and CLI router patterns lets an unauthenticated attacker send a single ~40-byte HTTP request that pins a PHP worker at 100% CPU, taking down any default…

• high

  Crossplane xpkg.CachedClient TOCTOU Signature Verification Bypass

  A malicious OCI registry can serve a properly signed image during cosign verification, then swap in an unsigned image for the actual install, completely bypassing Crossplane's package signature check.

• high

  LibreNMS Stored XSS via Unescaped SNMP and Syslog Data in Legacy Templates

  An attacker who controls a monitored network device can inject JavaScript into LibreNMS by setting a malicious SNMP interface description or syslog program name, which then executes in every…

• criticalCVE-2026-54569

  CVE-2026-54569: senaite.core Unauthenticated Remote Code Execution via Eval Injection in JSON API

  Any unauthenticated attacker who can reach a SENAITE installation can run arbitrary Python commands on the server by sending two plain HTTP requests, with no account or credentials needed.

• highCVE-2026-54591

  CVE-2026-54591: asyncssh SCP Client Path Traversal to Arbitrary File Write

  A malicious SSH server can trick the asyncssh SCP client into writing files anywhere on the victim's filesystem, including shell init files, enabling remote code execution.

• highCVE-2026-54563

  CVE-2026-54563: Cloudreve WebDAV Scoped Credential Path Traversal

  A Cloudreve WebDAV account scoped to a specific folder can escape that folder by sending a percent-encoded dot-dot segment in the request path, letting the credential read, write, or delete files…

• highCVE-2026-54606

  CVE-2026-54606: suneditor Embed Plugin DOM XSS via External Script Element

  A crafted embed payload in SunEditor's Embed plugin lets an attacker append a remote script tag to the live DOM, executing arbitrary JavaScript in any user's browser that opens or previews the saved…

• highCVE-2026-54511

  CVE-2026-54511: @logtape/syslog CRLF Log Injection via Unescaped C0 Control Characters

  A missing escape for newlines and other control characters in the syslog structured data formatter lets an attacker who controls a log property value inject forged syslog records into downstream…

• highCVE-2026-54556

  CVE-2026-54556: http4s-ember-core HTTP/2 HPACK Bomb Denial of Service

  http4s servers and clients using the Ember backend with HTTP/2 enabled can be crashed by a remote attacker who sends a crafted stream of compressed headers that expand to gigabytes of memory, causing…

• criticalCVE-2026-54523

  CVE-2026-54523: Kyverno NamespacedMutatingPolicy Missing Authorization in generator.apply()

  A tenant with permission to create a NamespacedMutatingPolicy in their own namespace can trick Kyverno's admission controller into writing resources into any namespace, including kube-system, using…