Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• highCVE-2026-45049

  CVE-2026-45049: OpenAM CDCServlet Session Token Exfiltration via Unvalidated goto Redirect

  OpenAM's cross-domain SSO servlet will POST a logged-in user's raw session token to any URL supplied in the goto parameter, letting an attacker steal the session by tricking the victim into visiting…

• criticalCVE-2026-54350

  CVE-2026-54350: @budibase/server Anonymous NoSQL Operator Injection via Query Templates

  Any anonymous visitor of a published Budibase app can read or overwrite every document in the backing database by injecting MongoDB operators through an unescaped query parameter, with no login…

• highCVE-2026-53925

  CVE-2026-53925: Glances Arbitrary File Write via secure_popen Operator Injection in AMP Configuration

  Glances lets AMP module commands reach an internal shell-operator parser without any sanitization, so anyone who can write to glances.conf can overwrite arbitrary files or chain commands on the host.

• highCVE-2026-55441

  CVE-2026-55441: mise Tera exec() Injection via Untrusted Task-Include Files

  Cloning a repo that contains only a mise-tasks/ folder and running any task-listing command executes arbitrary OS commands silently, because mise renders Tera templates in task files before checking…

• highCVE-2026-54512

  CVE-2026-54512: jackson-databind PolymorphicTypeValidator Bypass via Generic Type Parameters

  jackson-databind's type allow-list can be completely bypassed by smuggling a dangerous class inside the generic parameter of a permitted container type, enabling arbitrary class instantiation and…

• highCVE-2026-54513

  CVE-2026-54513: jackson-databind BasicPolymorphicTypeValidator Array Subtype Allowlist Bypass

  A flaw in jackson-databind's polymorphic type validator lets attackers slip a disallowed class past the allowlist by wrapping it in an array, defeating the security control that was supposed to…

• highCVE-2026-54134

  CVE-2026-54134: OctoPrint File Exfiltration via Upload Parameter Injection

  A flaw in OctoPrint's upload pipeline lets an authenticated attacker smuggle internal-only file path fields into any upload request, tricking the server into moving arbitrary host files into the…

• highCVE-2026-55488

  CVE-2026-55488: motionEye Absolute Path Traversal in Media File Handlers

  motionEye's media playback and download endpoints accept a user-supplied filename that can be an absolute path, letting anyone with access read arbitrary files off the server.

• critical

  motionEye LFI to Unauthenticated RCE Chain (CVSS 9.8)

  Four chained bugs in motionEye let a network attacker read any file on the server, steal the admin password hash, upload a malicious script via a tar restore, and execute it without any credentials…

• critical

  motionEye Unauthenticated Admin Credential Theft via Path Traversal

  A path traversal bug in motionEye's media playback handler lets a zero-credential attacker read the server's config file, steal the admin password hash, and immediately replay it for full admin…

• highCVE-2026-48126

  CVE-2026-48126: Algernon Host Header Path Traversal to Arbitrary File Read and Lua RCE

  A missing validation on the HTTP Host header in Algernon's domain mode lets any unauthenticated attacker read files outside the web root and, in common configurations, execute shell commands on the…

• highCVE-2026-48507

  CVE-2026-48507: Snipe-IT Bulk User Edit Incorrect Authorization

  A low-privileged Snipe-IT user with only the 'users.edit' permission can bulk-disable the 'activated' and 'ldap_import' flags on every admin account, locking all administrators out of the instance…