Labs
Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.
- highCVE-2026-53505
CVE-2026-53505: thumbor proportion filter Remote Denial of Service
Thumbor's proportion filter accepts arbitrarily large multiplier values, letting any attacker trigger a massive image resize that exhausts CPU and memory and crashes the server.
- highCVE-2026-53502
CVE-2026-53502: thumbor Path Traversal via Post-Validation URL Decode in file_loader
Thumbor's file loader checks the resolved path for safety before decoding percent-encoded characters, letting an attacker use encoded dot-sequences to slip past the check and read any file on the…
- highCVE-2026-53500
CVE-2026-53500: thumbor ALLOWED_SOURCES Regex Wildcard SSRF Bypass
A missing re.escape() call in thumbor's HTTP loader means every dot in a plain-string ALLOWED_SOURCES entry acts as a regex wildcard, letting an attacker fetch images from arbitrary hosts and bypass…
- highCVE-2026-54737
CVE-2026-54737: @phun-ky/defaults-deep Prototype Pollution via Unsafe Recursive Merge
A flaw in the @phun-ky/defaults-deep library lets an attacker inject properties into JavaScript's global Object prototype by passing crafted input to the defaultsDeep() function, which can silently…
- criticalCVE-2026-54725
CVE-2026-54725: vault-secrets-webhook Annotation SSRF and ServiceAccount Token Theft
The bank-vaults webhook blindly uses an attacker-supplied Vault address from a ConfigMap or Secret annotation, letting anyone who can create those resources force the webhook to make arbitrary HTTP…
- highCVE-2026-12072
CVE-2026-12072: NLTK NKJPCorpusReader Path Traversal Arbitrary File Read
A path traversal bug in NLTK's NKJPCorpusReader lets an attacker read any file on the server by passing a crafted directory path as a corpus file ID, even when NLTK's strict security sandbox is…
- highCVE-2026-12061
CVE-2026-12061: NLTK ReviewsCorpusReader Quadratic ReDoS
A crafted review line with no bracketed annotation can hang NLTK's ReviewsCorpusReader for tens of seconds to minutes, letting anyone who can supply a corpus file deny service with no authentication.
- highCVE-2026-12075
CVE-2026-12075: nltk DNS-Rebinding SSRF Filter Bypass
NLTK's built-in SSRF filter can be defeated by a DNS rebinding attack, letting an attacker read responses from internal services or cloud metadata endpoints even when the documented strict ENFORCE…
- highCVE-2026-56819
CVE-2026-56819: netty-codec-http2 HTTP/2 Decompression ByteBuf Reference-Count Leak (OOM DoS)
Sending HTTP/2 DATA frames to a Netty server with decompression enabled leaks one off-heap buffer per frame after the stream's decompressor is closed, eventually crashing the JVM with…
- highCVE-2026-54729
CVE-2026-54729: dssrf SSRF Bypass via DNS NXDOMAIN on 1.1.1.1
A bug in the dssrf npm library lets an attacker reach internal services like localhost when the server uses the 1.1.1.1 DNS resolver, because the library skips a safety check whenever DNS returns no…
- highCVE-2026-55100
CVE-2026-55100: hashi-vault-js Path Traversal and Query Parameter Injection
The hashi-vault-js npm library passes user-supplied identifiers directly into Vault API URLs without encoding, letting an attacker redirect requests to arbitrary Vault endpoints or inject extra query…
- highCVE-2026-41695
CVE-2026-41695: Spring Data Commons Unbounded Property-Path Cache DoS
Spring Data Commons permanently caches every property-path string an attacker sends, including invalid ones, with no size limit, so a loop of unique random sort parameters can exhaust the JVM heap…