Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• highCVE-2026-40187

  CVE-2026-40187: EGroupware Authenticated RCE via eTemplate eval Injection

  An authenticated EGroupware administrator can upload a malicious XML template file that causes the server to execute arbitrary OS commands, taking full control of the underlying system.

• highCVE-2026-35341

  CVE-2026-35341: uu_mkfifo Unauthorized Permission Overwrite on Existing Files

  A missing 'continue' in uutils mkfifo lets a failed FIFO creation silently overwrite the permissions of whatever file was already at that path, potentially making private files like SSH keys…

• highCVE-2026-55794

  CVE-2026-55794: Craft CMS Authenticated RCE via Twig Injection in Referer Header

  A logged-in Craft CMS editor can run arbitrary server commands by placing Twig template code in the HTTP Referer header when saving an entry, because the redirect URL is rendered without sandboxing.

• criticalCVE-2026-55500

  CVE-2026-55500: 9router Unprotected Database Export/Import Credential Theft

  Any authenticated 9router user can dump the entire database in plaintext (all API keys, OAuth tokens, and OIDC secrets) or silently overwrite it with attacker-controlled data, including a new admin…

• highCVE-2026-55501

  CVE-2026-55501: 9router Login Rate-Limit Bypass via X-Forwarded-For Spoofing

  The 9router dashboard login page lets attackers bypass its brute-force lockout entirely by rotating a spoofed X-Forwarded-For header on each request, giving every attempt a fresh rate-limit counter.

• highCVE-2026-54641

  CVE-2026-54641: OpenRemote Manager Cross-Realm User Information Disclosure

  A tenant admin in one OpenRemote realm can read the full profile and role assignments of any user in any other realm, including the privileged master realm, by supplying an arbitrary user UUID to…

• critical

  9router: Unauthenticated CRUD on Provider API and Full API Key Leak

  Any unauthenticated user on the network can read, create, modify, or delete all AI provider connections in 9router and retrieve plaintext API keys, because the Next.js middleware never guards the…

• criticalCVE-2026-55615

  CVE-2026-55615: langroid Neo4jChatAgent Prompt-to-Cypher Injection (RCE)

  Langroid's Neo4jChatAgent passes LLM-generated Cypher queries directly to the Neo4j driver with no validation, letting anyone who can influence the agent's prompt read or destroy all graph data and…

• highCVE-2026-55790

  CVE-2026-55790: Craft CMS DOM XSS via Poisoned GitHub Issue Title in CraftSupport Widget

  A Craft CMS admin's control panel can be hijacked by anyone with a GitHub account who plants a JavaScript payload in a craftcms/cms issue title, which the CraftSupport widget renders directly as raw…

• highCVE-2026-55431

  CVE-2026-55431: Coder CLI Session Token Exfiltration via External App URLs

  A malicious Coder workspace template can register an external app whose URL contains the $SESSION_TOKEN placeholder, causing the CLI to send the user's live session token to an attacker-controlled…

• highCVE-2026-55426

  CVE-2026-55426: linuxfabrik-lib OS Command Injection via shell_exec

  Linuxfabrik monitoring plugins pass user-supplied arguments directly into a shell command string, letting a nagios user inject pipe-separated OS commands and escalate to root via sudoers entries.

• criticalCVE-2026-54496

  CVE-2026-54496: halo2_gadgets Variable-Base Scalar Multiplication Under-Constrained Base Point

  A missing copy constraint in Zcash's halo2_gadgets ECC gadget let a malicious prover substitute an arbitrary base point into the Orchard Action circuit, bypassing the integrity check that ties a…