Labs
Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.
- high
Poweradmin: IDOR Broken Access Control in DNS Record Edit
Any authenticated Poweradmin user who owns at least one DNS zone can overwrite records in zones they have no access to, by sending a victim's record ID alongside their own zone ID in a crafted POST…
- high
Poweradmin OIDC sub Collation Bypass Account Takeover
An attacker who controls an OIDC account can hijack a victim's Poweradmin session by registering a subject identifier that differs only by an accented character, tricking MySQL's case-insensitive…
- high
frp SSH Tunnel Gateway Unauthenticated Remote Denial of Service via Integer Overflow
A one-packet integer overflow in frp's SSH Tunnel Gateway lets any unauthenticated attacker crash the entire frps process instantly, dropping every active tunnel for every user.
- critical
sm-crypto: Predictable SM2 Key Generation via Weak PRNG in Node.js
The sm-crypto npm package generates SM2 private keys and signing secrets using Math.random() and wall-clock time in Node.js, making every key it produces by default guessable by an attacker.
- highCVE-2026-14257
CVE-2026-14257: brace-expansion Unbounded Expansion Length DoS (OOM Crash)
Passing a string of 1,500 chained brace groups to brace-expansion's expand() causes an uncatchable out-of-memory crash in Node.js, taking down any server that processes user-supplied glob patterns.
- high
Pheditor Terminal Command-Allowlist Bypass via Argument Injection (RCE)
Pheditor's web terminal restricts commands to an allowlist but checks only the prefix, so anyone with terminal access can run arbitrary OS commands by passing dangerous flags to allowlisted binaries…
- critical
OpenDJ DSMLv2 Gateway Unauthenticated SSRF and Local File Read
The DSMLv2 SOAP gateway in OpenDJ unconditionally dereferences any URL a caller supplies in an XML attribute, letting an unauthenticated attacker read local files, hit internal services, or crash the…
- critical
OpenDJ SASL PLAIN authzid Proxy ACI Authorization Bypass
OpenDJ's SASL PLAIN handler let any account with the proxied-auth privilege impersonate arbitrary directory users by supplying an authzid at bind time, skipping the proxy ACI check that every other…
- critical
Budibase MySQL Integration SQL Injection via multipleStatements
Budibase's MySQL connector was configured with multipleStatements enabled, letting anyone who can submit a query string run additional arbitrary SQL commands against the database.
- high
Budibase MongoDB Datasource Filesystem Read Oracle via Unvalidated TLS Certificate Paths
A builder account on Budibase Cloud can supply any absolute server path as a MongoDB TLS certificate field, causing the server to read that file and leak its existence or content through differing…
- high
Budibase S3 Presigned URL Authorization Regression (BASIC User Escalation)
A regression in Budibase's attachment upload endpoint lets any basic app user generate S3 PutObject presigned URLs using the platform's stored IAM credentials, and write to any bucket those…
- critical
Budibase OIDC SSO Account Takeover via Unverified Email Claim
Budibase's OIDC login links an incoming SSO identity to an existing account by email address alone, without checking the email_verified claim, letting an attacker on a trusted IdP hijack any Budibase…