Labs
Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.
- highCVE-2026-72695
CVE-2026-72695: Grav CMS Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion
A path traversal bug in Grav CMS lets any authenticated user with media permissions delete files anywhere on the server, including config and account files, by slipping ../ sequences into a media…
- highCVE-2026-68523
CVE-2026-68523: fulgur Unbounded Page Slicing Denial of Service
A tiny HTML snippet with an oversized CSS height value can force the fulgur HTML-to-PDF library to generate hundreds of thousands of page fragments, locking up the server's CPU and memory until it…
- highCVE-2026-77404
CVE-2026-77404: amqp091-go TLS Path Query Parameter Injection
The RabbitMQ Go AMQP client builds connection URIs by pasting raw TLS file paths into the query string without URL-encoding them, so a path containing '&' or '=' can silently overwrite connection…
- criticalCVE-2026-77405
CVE-2026-77405: amqp091-go TLS Version Downgrade via Missing MinVersion
The RabbitMQ Go AMQP client built on legacy Go runtimes could silently accept TLS 1.0 or 1.1 connections because the library never pinned a minimum TLS version, letting a network attacker downgrade…
- highCVE-2026-77406
CVE-2026-77406: amqp091-go Signed-to-Unsigned Integer Overflow in Qos
Passing a negative prefetch value to the RabbitMQ Go client's Qos method silently wraps it to the maximum unsigned integer, causing the broker to flood the consumer with messages and crash it.
- highCVE-2026-86039
CVE-2026-86039: @libp2p/peer-store Certified Address Poisoning via Forged PeerRecord
A flaw in js-libp2p lets an attacker poison another peer's certified address book entry by signing a PeerRecord with their own key while placing a victim's peer ID in the payload, causing nodes to…
- criticalCVE-2026-77408
CVE-2026-77408: amqp091-go Silent Data Truncation via shortstr Integer Overflow
The RabbitMQ Go client silently truncates message metadata fields longer than 255 bytes instead of returning an error, corrupting routing identifiers and breaking RPC correlation without any signal…
- highCVE-2026-65608
CVE-2026-65608: Grav FlexDirectory Unsafe Reflection RCE
A missing safety check in Grav's Flex blueprint engine lets any authenticated user with only a single directory's create or update permission run arbitrary shell commands on the server.
- highCVE-2026-73247
CVE-2026-73247: Kestra Unauthenticated SSRF via Pebble http() Function
Kestra's built-in Pebble http() function passes attacker-controlled URLs directly to the server's HTTP client with no filtering, letting anyone with network access reach internal services or cloud…
- highCVE-2026-86038
CVE-2026-86038: @libp2p/gossipsub StrictSign RSA Peer ID Author Spoofing
A flaw in the gossipsub signature validator lets an attacker forge messages that appear to come from any RSA-keyed peer on the network, breaking message origin trust under the default signing policy.
- highCVE-2026-85731
CVE-2026-85731: oras-go Symlink-Chain Path Traversal in tar Extraction
A crafted OCI artifact can trick oras-go into writing files anywhere on disk, bypassing the sandbox that is supposed to keep extracted content inside a safe directory.
- highCVE-2026-69089
CVE-2026-69089: Grav CMS Path Traversal via ImageMedium::watermark()
A Grav CMS editor can read image files anywhere on the server by pointing the watermark action at a relative path like ../secret.png, and the composited result ends up cached at a public URL any…