Labs
Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.
- highCVE-2026-81515
CVE-2026-81515: Steeltoe.Discovery.Eureka Registry Fetch DoS via Malformed Instance Fields
Any service that can register with a Eureka server can crash the registry fetch for all connected .NET Steeltoe clients by including a bad enum value, a non-boolean flag, or a junk timestamp in its…
- high
djust: mark_safe Context Key Inheritance XSS
djust's template engine tracks which variable names are HTML-safe by name rather than by value, so rebinding a safe name to attacker-controlled input causes raw HTML to be rendered without escaping.
- highCVE-2026-81875
CVE-2026-81875: HAPI FHIR SHCParser Unbounded DEFLATE Decompression DoS
HAPI FHIR's Smart Health Card parser will decompress attacker-supplied DEFLATE payloads without any size limit, letting a kilobyte-sized JWT balloon into gigabytes of heap and crash the server.
- highCVE-2026-81516
CVE-2026-81516: Steeltoe.Discovery.Consul Malformed 'secure' Metadata DoS
A service registered in Consul with a non-boolean 'secure' metadata value (like 'yes' or '1') crashes Steeltoe's discovery client mid-enumeration, making every affected service unreachable until the…
- high
djust: Six Template-Layer XSS Defects via Broken Auto-Escape
Six independent bugs in djust's template engine cause attacker-controlled input to bypass Django's HTML escaping and execute as live JavaScript in the browser, affecting common patterns like filter…
- highCVE-2026-74907
CVE-2026-74907: Grav CMS Unauthenticated Path Traversal via plugin-asset-map.php
A missing directory-boundary check in Grav's fast static asset server lets unauthenticated attackers read files from sibling directories that were never meant to be public, with no login required.
- criticalCVE-2026-75827
CVE-2026-75827: Grav CMS Arbitrary File Write via Blueprint error_log Injection
A gap in Grav's blueprint dynamic-data validation lets any user with page-edit access call PHP's error_log function to write attacker-controlled PHP code to a web-accessible file, resulting in remote…
- highCVE-2026-75837
CVE-2026-75837: Grav Group Blueprint Missing Authorization Allows Privilege Escalation to Super-Admin
A delegated Grav admin who can manage users but is not a super-admin can edit a user group to grant themselves full super-admin rights, because the group permission form never checks whether the…
- highCVE-2026-72819
CVE-2026-72819: Grav CMS Remote Code Execution via ZIP Upload
A logged-in Grav CMS user can upload a ZIP containing a PHP web shell and use a flaw in Flex Objects blueprint validation to unpack it into the web root, giving full remote code execution on the…
- highCVE-2026-82399
CVE-2026-82399: CoreDNS Unauthenticated Memory Exhaustion via Compressed DNS Section Counts
Sending a single crafted 65 KB DNS-over-HTTPS request to CoreDNS can cause it to allocate over 10 MiB of memory; 32 concurrent requests are enough to OOM-kill the process and take down DNS for every…
- highCVE-2026-84997
CVE-2026-84997: react/http ChunkedDecoder Infinite Loop DoS
Sending a malformed chunked HTTP body to a ReactPHP server (or receiving one from a malicious server) traps the single-threaded PHP process in an infinite loop, pinning a CPU core and making the…
- highCVE-2026-86003
CVE-2026-86003: CoreDNS Confused Deputy via RFC 2136 UPDATE over DoH/DoQ/gRPC
CoreDNS accepted DNS UPDATE messages over its encrypted transports (DoH, DoH3, DoQ, gRPC) and silently forwarded them to upstream servers, letting an unauthenticated attacker manipulate DNS records…