Labs
Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.
- criticalCVE-2026-77413
CVE-2026-77413: jsonata Arbitrary Code Execution via Prototype Chain Escape
A crafted JSONata expression can escape the expression sandbox and run arbitrary operating system commands on the server, because the property lookup function never checked whether inherited…
- highCVE-2026-63135
CVE-2026-63135: YOURLS Stored XSS via Crafted Referer Header in Statistics Chart
An unauthenticated attacker can poison a YOURLS short link's referrer log with a crafted HTTP Referer header, causing arbitrary JavaScript to execute in an administrator's browser when they view that…
- highCVE-2026-68508
CVE-2026-68508: hydra-core Unsafe Instantiation Code Injection
Passing untrusted configuration to hydra.utils.instantiate() lets an attacker pick any Python callable as the target and supply its arguments, resulting in arbitrary code execution inside the…
- criticalCVE-2026-77414
CVE-2026-77414: jsonata Arbitrary Code Execution via hasOwnProperty Bypass
A crafted JSONata expression can escape the expression sandbox and run arbitrary operating system commands on the server by bypassing a prototype-property guard in the evaluator.
- criticalCVE-2026-77415
CVE-2026-77415: jsonata Arbitrary Code Execution via Crafted Expression
A crafted JSONata expression can chain three logic flaws to escape the expression sandbox and run arbitrary operating system commands on the server.
- criticalCVE-2026-76904
CVE-2026-76904: GeoTools gt-jdbc-postgis Unauthenticated SQL Injection via jsonArrayContains
A missing escaping step in GeoTools' PostGIS filter code lets anyone with access to a public GeoServer map endpoint inject arbitrary SQL, and potentially execute OS commands, without logging in.
- highCVE-2026-63462
CVE-2026-63462: unleash-server Unauthenticated DoS via Recursive JSON Serialization
A single unauthenticated HTTP request containing deeply-nested JSON can crash the entire Unleash feature-flag server permanently, taking all dependent applications offline.
- highCVE-2026-54167
CVE-2026-54167: Pipelines-as-Code GitHub App JWT Exfiltration via Untrusted X-GitHub-Enterprise-Host Header
An unauthenticated attacker who can reach the Pipelines-as-Code webhook endpoint can trick it into sending a freshly signed GitHub App JWT to an attacker-controlled server by spoofing the…
- highCVE-2026-54175
CVE-2026-54175: Laravel Backpack CRUD Unverified Password Change via Mass Assignment
A flaw in Backpack for Laravel lets any attacker who has stolen an admin session cookie permanently take over the account by injecting a new password into the account-info form, with no knowledge of…
- highCVE-2026-54178
CVE-2026-54178: Backpack CRUD Arbitrary File Deletion via Unvalidated clear_<attr>[] Input
A low-privilege Backpack admin can delete any file on the storage disk by injecting arbitrary paths into the clear_<attribute>[] form parameter when editing any record that uses the upload_multiple…
- highCVE-2026-54180
CVE-2026-54180: Laravel Backpack CRUD Cross-Tenant IDOR on Write Operations
An authenticated user of any privilege level can update, delete, or reorder records belonging to other tenants by simply guessing or knowing a record's numeric ID, bypassing any row-level access…
- highCVE-2026-54263
CVE-2026-54263: Wagtail Reflected XSS in Dynamic Image URL Generator
A low-privilege Wagtail editor can craft a link to the admin image URL generator that injects JavaScript into the browser of any higher-privileged admin who opens it.