Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• criticalCVE-2026-62988

  CVE-2026-62988: Froxlor API Credential and 2FA Secret Disclosure

  Froxlor's API endpoints return full database rows including password hashes and TOTP seeds, letting any authenticated API user steal credentials and bypass two-factor authentication for customers…

• high

  LibreNMS SSRF-Driven Stored XSS via Oxidized API Response Fields

  An admin can point LibreNMS's Oxidized integration at an attacker-controlled server, which returns HTML-injected JSON fields that LibreNMS renders unescaped on the device config tab, giving any…

• highCVE-2026-17106

  CVE-2026-17106: moby/go-archive Symlink-Following Path Traversal in Tar Extraction

  A crafted tar archive can plant a symlink during extraction to redirect subsequent file writes outside the intended destination directory, letting a malicious Docker container overwrite arbitrary…

• highCVE-2026-70666

  CVE-2026-70666: Lemur ACME Client Server-Side Request Forgery via Server-Controlled URLs

  A user with any role on a Lemur ACME certificate authority can repoint it at a malicious ACME server they control, causing Lemur to make authenticated POST requests to arbitrary internal URLs during…

• highCVE-2026-71303

  CVE-2026-71303: Lemur ACME Authority Update SSRF (Incomplete Fix)

  Lemur's certificate authority update endpoint lets any user with an authority role silently replace the ACME directory URL with an internal address, causing the server to make outbound requests to…

• highCVE-2026-71307

  CVE-2026-71307: Lemur Authenticated Plaintext Destination Credential Exposure

  Any logged-in Lemur user, including read-only accounts, can call the destinations API and get back plaintext SFTP passwords and private-key passphrases that Lemur uses to deploy TLS certificates.

• highCVE-2026-71308

  CVE-2026-71308: Lemur Unauthorized Certificate Hijack via Unchecked replaces Field

  Any authenticated Lemur user can silently take over a production certificate they do not own by listing its ID in the replaces field when uploading or creating their own certificate, disabling the…

• highCVE-2026-71417

  CVE-2026-71417: Lemur Authorization Bypass via Duplicate Certificate Upload Enables Arbitrary CA Revocation

  Any authenticated Lemur user can revoke a certificate they do not own, including live production certificates, by uploading a duplicate database record and revoking it through an authorization check…

• highCVE-2026-55224

  CVE-2026-55224: MineAdmin Path Traversal in Plugin Install/Uninstall

  MineAdmin's app-store plugin service accepts unsanitized directory names from users and plugs them straight into file-system paths, letting any authenticated user read, install, or uninstall content…

• high

  MeshCentral Stored XSS via Unsanitized Agent Fields

  A rogue or compromised MeshAgent can inject arbitrary JavaScript into the MeshCentral admin dashboard by sending malicious HTML in its OS description field, potentially giving attackers full control…

• criticalCVE-2026-55107

  CVE-2026-55107: kobako Sandbox Escape via Unguarded public_send Dispatcher

  A guest mruby script running inside a kobako sandbox can call any Ruby method on the host process, including eval, by pivoting through the dispatcher's unguarded public_send call to reach Kernel…

• criticalCVE-2026-55211

  CVE-2026-55211: surfio Out-of-Bounds Read in IRAP Binary Parser

  A crafted IRAP surface file with inflated size fields can trick surfio into reading past the end of its allocated buffer, crashing or exposing process memory in any service that parses untrusted…