Labs
Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.
- highCVE-2026-85756
CVE-2026-85756: SSH.NET ScpClient OS Command Injection via Unquoted Remote Path
SSH.NET's ScpClient passes caller-supplied file paths directly into a shell command on the remote server, and its default path escaping leaves dollar-sign subshell syntax intact, letting an attacker…
- highCVE-2026-85721
CVE-2026-85721: async-http-client Decompression Bomb DoS
A rogue or intercepted server can send a tiny gzip-compressed HTTP response that expands without limit inside the Java client, crashing the JVM with OutOfMemoryError.
- highCVE-2026-77410
CVE-2026-77410: amqp091-go Resource Exhaustion via Unbounded Body Buffer Allocation
A malicious RabbitMQ broker can crash any connected Go client by declaring a huge message body size, forcing the client to try to allocate exabytes of memory instantly.
- criticalCVE-2026-77411
CVE-2026-77411: amqp091-go Protocol Desynchronization via Oversized longstr
A flaw in the RabbitMQ Go AMQP client lets a malicious broker send a single oversized string length that silently breaks the protocol parser, allowing attacker-controlled bytes to be interpreted as…
- highCVE-2026-77412
CVE-2026-77412: amqp091-go Denial of Service via Negative Byte-Array Length
A malicious RabbitMQ broker can crash any connected Go client instantly by sending a single malformed frame that tricks the client into allocating a slice of negative length.
- highCVE-2026-86043
CVE-2026-86043: Skipper opaAuthorizeRequestWithBody OPA Authorization Bypass via Chunked Body
Sending an oversized request body with chunked transfer encoding (no Content-Length header) to a Skipper proxy causes its OPA body-inspection filter to incorrectly report the body as not truncated…
- highCVE-2026-69197
CVE-2026-69197: Umbraco.Cms Delivery API Protected Content Disclosure via Property Expansion
Umbraco's Content Delivery API leaks member-gated content to anonymous callers because access checks are only applied to the directly requested node, not to protected nodes pulled in through Content…
- highCVE-2026-85715
CVE-2026-85715: exifreader iloc Box Memory Exhaustion DoS
A tiny crafted HEIC or AVIF file can force ExifReader to allocate billions of JavaScript objects, exhausting Node.js heap memory and crashing the process.
- highCVE-2026-63459
CVE-2026-63459: @vendure/dashboard Stored XSS via innerHTML in Admin Dashboard
A lower-privilege Vendure administrator can store a crafted product or collection description that runs arbitrary JavaScript in any other administrator's browser when they view the affected list…
- highCVE-2026-63460
CVE-2026-63460: Vendure Unauthenticated ReDoS via SQLite Regex Filter
An unauthenticated attacker can send a single GraphQL request with a catastrophically backtracking regex to a Vendure shop running on SQLite, freezing the Node.js event loop and taking the entire…
- criticalCVE-2026-63472
CVE-2026-63472: @vendure/core External Authentication Account Takeover
Vendure stores using social or OAuth login can have any customer account silently hijacked by an attacker who presents the victim's email address through an external authentication provider, without…
- highCVE-2026-71538
CVE-2026-71538: @cyclonedx/cyclonedx-npm Windows Shell Injection via --workspace
The cyclonedx-npm CLI passes the --workspace argument directly into a Windows shell command without escaping, letting anyone who controls that value run arbitrary OS commands on the host.