Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• highCVE-2026-49857

  CVE-2026-49857: auth-fetch-mcp SSRF Protection Bypass via IPv4-mapped IPv6 Loopback

  A flaw in auth-fetch-mcp's private-IP blocklist lets an attacker reach loopback and internal services by disguising the target address as an IPv4-mapped IPv6 literal, which Node.js silently rewrites…

• highCVE-2026-49864

  CVE-2026-49864: wetty DOM XSS via File-Download Filename

  A crafted terminal escape sequence lets anyone who can write output to a wetty session inject HTML into the browser and silently type arbitrary commands into the victim's SSH shell.

• highCVE-2022-46293

  CVE-2022-46293: Open Babel MOPAC Output Parser Stack Buffer Overflow

  Open Babel's MOPAC output reader lets an attacker overflow a fixed-size stack array by placing more than three translation-vector triplets in a crafted 'FINAL POINT AND DERIVATIVES' block, which can…

• highCVE-2022-46294

  CVE-2022-46294: Open Babel MOPAC Cartesian Out-of-Bounds Write

  A crafted MOPAC Cartesian file with more than three Tv (translation-vector) entries overflows a fixed-size stack array in Open Babel, enabling arbitrary code execution in any application that parses…

• highCVE-2022-46295

  CVE-2022-46295: Open Babel MSI Parser Stack Buffer Overflow

  A crafted MSI chemistry file can overflow a fixed-size stack array in Open Babel's MSI parser, letting an attacker write arbitrary data past the end of the buffer and potentially execute code.

• highCVE-2026-46487

  CVE-2026-46487: GeoNetwork Elasticsearch Search ACL Bypass via Missing Query Field

  An unauthenticated attacker can retrieve restricted metadata records from GeoNetwork by sending a search request that omits the query field, causing the access-control filter injection to be skipped…

• highCVE-2025-10997

  CVE-2025-10997: Open Babel Heap Buffer Overflow in ChemKin Parser

  A crafted ChemKin reaction file can corrupt heap memory in Open Babel's species-lookup code, crashing any application that parses untrusted chemistry files.

• highCVE-2022-37331

  CVE-2022-37331: Open Babel Gaussian Output Parser Stack Buffer Overflow

  A crafted Gaussian output file can overflow a fixed-size stack buffer in Open Babel's orientation block parser, letting an attacker write arbitrary data onto the stack and potentially execute code.

• highCVE-2022-42885

  CVE-2022-42885: Open Babel GRO Parser Uninitialized Pointer Dereference

  A crafted GROMACS .gro file can make Open Babel dereference an uninitialized residue pointer while parsing atom records, crashing the process and potentially enabling arbitrary code execution.

• highCVE-2025-10996

  CVE-2025-10996: Open Babel SMILES Parser Heap Buffer Overflow

  Open Babel's SMILES parser reads past the end of a heap buffer when given a crafted molecule string, which can crash or corrupt memory in any application that converts chemistry file formats.

• high

  Kahi Supervisor Privilege Drop and Socket Permission Issues

  Kahi's process supervisor silently failed to apply configured user credentials to child processes, left supplementary groups intact after dropping privileges, and exposed FastCGI Unix sockets to all…

• highCVE-2026-49473

  CVE-2026-49473: @cedar-policy/authorization-for-expressjs Authorization Bypass via Query String

  A query string appended to a request URL tricks the Cedar middleware into evaluating a less restrictive authorization policy while Express routes the request to a more privileged endpoint, letting…