Labs
Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.
- highCVE-2026-55071
CVE-2026-55071: stata-mcp Stata Command Injection via Unsanitized Package Name
The stata-mcp package lets an attacker run arbitrary operating system commands by embedding newline characters in a package name passed to the Stata package installer, because the input is never…
- highCVE-2026-46369
CVE-2026-46369: nimiq-blockchain Validity Store Off-by-One Transaction Replay
An off-by-one error in nimiq-blockchain's transaction replay-protection store lets an attacker submit the same signed transaction twice, debiting the sender and crediting the recipient a second time…
- highCVE-2026-48798
CVE-2026-48798: SSH.NET ScpClient Recursive Download Path Traversal
A malicious or man-in-the-middle SCP server can trick the SSH.NET client into writing files anywhere on the local filesystem by returning directory entries with path-traversal sequences in their…
- highCVE-2026-32257
CVE-2026-32257: Winter CMS Stored XSS via Backend Brand Settings Custom Styles
An admin with permission to customize the Winter CMS backend appearance can inject a JavaScript payload into the custom styles field that runs on every backend page for every user.
- highCVE-2026-62897
CVE-2026-62897: .NET WPF Integer Overflow Remote Code Execution
A crafted font or document fed to a WPF application can trigger an integer overflow in the Windows Presentation Foundation native runtime, letting an attacker run arbitrary code on the victim's…
- highCVE-2026-62871
CVE-2026-62871: WPF .NET Desktop Runtime Heap Buffer Overflow Elevation of Privilege
A heap-based buffer overflow in the Windows Presentation Foundation (WPF) layer of the .NET Desktop Runtime lets a local attacker gain elevated privileges by tricking a user into opening a crafted…
- highCVE-2026-70354
CVE-2026-70354: .NET WPF Out-of-Bounds Write Remote Code Execution
A crafted file opened in a WPF application can trigger an out-of-bounds memory write in the .NET Windows Presentation Foundation runtime, letting an attacker run arbitrary code as the current user.
- highCVE-2026-62901
CVE-2026-62901: .NET System.Net.WebSockets Denial of Service via Unchecked Loop Condition
A flaw in .NET's managed WebSocket implementation lets an unauthenticated attacker flood a server with crafted control frames, trapping the receive loop in an infinite spin and taking the process…
- highCVE-2026-62886
CVE-2026-62886: WPF TrueType Font Subsetter Integer Overflow Elevation of Privilege
A crafted TrueType font embedded in an XPS document or XAML content can trigger an integer wraparound in WPF's native font subsetter, causing a heap buffer overflow that lets a local attacker gain…
- highCVE-2026-62898
CVE-2026-62898: .NET MsQuic Use After Free Information Disclosure
A use-after-free bug in the native MsQuic library bundled with .NET lets any remote attacker read process memory over the network, leaking potentially sensitive data without any authentication.
- criticalCVE-2026-73080
CVE-2026-73080: SeaweedFS Unauthenticated SSRF via VolumeServer.FetchAndWriteNeedle
Any unauthenticated user who can reach a SeaweedFS volume server's gRPC port can force the server to fetch any URL, including cloud metadata endpoints, and read the response back, exposing IAM…
- highCVE-2026-15895
CVE-2026-15895: jsii-diff OS Command Injection via npm: Package Argument
jsii-diff passes user-supplied npm package specifiers directly to a shell command without sanitization, letting anyone who controls its arguments run arbitrary OS commands.