Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• highCVE-2026-69149

  CVE-2026-69149: @angular/platform-server SSR Fallback Raw-Content XSS

  Angular's server-side rendering layer fails to escape closing tags inside iframe, noembed, noframes, and noscript elements, letting attackers inject and execute arbitrary scripts in any visitor's…

• highCVE-2026-69151

  CVE-2026-69151: @angular/compiler i18n Event-Handler Attribute XSS

  A flaw in Angular's i18n compiler pipeline lets a malicious translation file inject arbitrary JavaScript into event-handler attributes like onerror, bypassing Angular's own attribute safety checks.

• highCVE-2026-68945

  CVE-2026-68945: @angular/common HttpTransferCache Cache-Key Ambiguity Leads to State Poisoning

  Angular's server-side rendering cache treats two structurally different HTTP requests as identical, letting an attacker-controlled response be silently served in place of a legitimate one during…

• highCVE-2026-54910

  CVE-2026-54910: FileBrowser Quantum Path Traversal in Subtitle Handler

  Any logged-in user of FileBrowser Quantum can read arbitrary files from the server's filesystem, including /etc/passwd and SSH keys, by passing directory-traversal sequences to the subtitle API…

• criticalCVE-2026-53609

  CVE-2026-53609: ApostropheCMS Server-Side Prototype Pollution via $pullAll Leading to Authorization Bypass

  An authenticated editor in ApostropheCMS can poison the Node.js process's global Object.prototype with a single PATCH request, permanently disabling authorization checks on all REST API endpoints…

• highCVE-2026-53608

  CVE-2026-53608: @apostrophecms/seo Stored XSS via Unsanitized Google Analytics ID

  Any editor-level user in ApostropheCMS can inject arbitrary JavaScript into every page on the site by setting the Google Analytics or Tag Manager ID field to a malicious value, because the package…

• highCVE-2026-53599

  CVE-2026-53599: REDAXO Mediapool Multi-Segment Filename Extension Bypass RCE

  A logic regression in REDAXO's file-upload extension check lets an authenticated editor upload a PHP webshell disguised as a JPEG by using a three-part filename like shell.php.any.jpg, which the…

• criticalCVE-2026-52887

  CVE-2026-52887: NocoBase plugin-notification-in-app-message SQL Injection to RCE

  Any signed-up user on a default NocoBase install can inject raw SQL into the in-app notifications API and, on the default PostgreSQL setup, run shell commands inside the database container.

• highCVE-2026-53501

  CVE-2026-53501: thumbor HMAC Signature Validation Bypass via Repeated URL Segments

  Thumbor's signed-URL protection can be completely bypassed by embedding extra copies of a valid HMAC signature inside the image path, tricking the server into validating a different URL than the one…

• highCVE-2026-58263

  CVE-2026-58263: Jodit Editor Mutation XSS via MathML/style Rawtext Carrier

  Jodit's HTML sanitizer can be tricked by a specially crafted MathML structure that hides a script-bearing image element during the safety check, allowing that element to survive into the editor's…

• highCVE-2026-53503

  CVE-2026-53503: thumbor convolution filter remote divide-by-zero DoS

  Passing columns=0 to thumbor's convolution filter triggers a fatal divide-by-zero crash in native C code, letting any attacker with URL access take down the image-processing server.

• highCVE-2026-53504

  CVE-2026-53504: thumbor ReDoS in convolution Filter

  A crafted image URL with many semicolon-separated convolution values causes thumbor's regex parser to spin indefinitely, blocking all image processing on the server.