Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• high

  pay: Paddle Billing Webhook Signature Timing Oracle (CWE-208)

  The pay gem compared Paddle Billing webhook signatures with Ruby's non-constant-time == operator, letting an attacker recover the real HMAC byte-by-byte from response-time differences and forge…

• highCVE-2026-49987

  CVE-2026-49987: repomix Argument Injection via --remote-branch (RCE)

  A crafted branch name passed to repomix's --remote-branch flag is forwarded to git subprocesses without sanitization, letting an attacker inject git options like --upload-pack and execute arbitrary…

• highCVE-2022-43607

  CVE-2022-43607: Open Babel MOL2 Parser Stack Buffer Overflow

  A crafted MOL2 file with an oversized attribute or value string causes Open Babel to write past a fixed 32-byte stack buffer during parsing, potentially leading to arbitrary code execution.

• highCVE-2022-44451

  CVE-2022-44451: Open Babel MSI Parser Uninitialized Pointer Dereference

  Open Babel's MSI chemistry file parser uses an atom pointer before it is ever assigned, letting an attacker trigger arbitrary code execution by feeding it a crafted MSI file.

• highCVE-2022-46289

  CVE-2022-46289: Open Babel ORCA nAtoms Heap Buffer Overflow

  A crafted ORCA chemistry file can trick Open Babel into allocating a tiny heap buffer and then writing atom coordinates past its end, potentially giving an attacker arbitrary code execution.

• highCVE-2026-49986

  CVE-2026-49986: neuro-cortex-memory Untrusted Project Bootstrap Code Execution

  The Cortex MCP server treats any project directory open in Claude Code as a trusted source of executable code, letting an attacker drop a Python script into a crafted repository and have it run…

• highCVE-2022-46290

  CVE-2022-46290: Open Babel ORCA Parser Heap Buffer Overflow

  A crafted ORCA chemistry file can trick Open Babel into writing past the end of a heap buffer, potentially allowing an attacker to execute arbitrary code on any system that parses untrusted files…

• highCVE-2022-46291

  CVE-2022-46291: Open Babel Gaussian Parser Stack Buffer Overflow via translationVectors

  A crafted Gaussian output file can write past the end of a 3-element stack array in Open Babel's chemistry file parser, potentially giving an attacker arbitrary code execution.

• highCVE-2026-49857

  CVE-2026-49857: auth-fetch-mcp SSRF Protection Bypass via IPv4-mapped IPv6 Loopback

  A flaw in auth-fetch-mcp's private-IP blocklist lets an attacker reach loopback and internal services by disguising the target address as an IPv4-mapped IPv6 literal, which Node.js silently rewrites…

• highCVE-2026-49864

  CVE-2026-49864: wetty DOM XSS via File-Download Filename

  A crafted terminal escape sequence lets anyone who can write output to a wetty session inject HTML into the browser and silently type arbitrary commands into the victim's SSH shell.

• highCVE-2022-46293

  CVE-2022-46293: Open Babel MOPAC Output Parser Stack Buffer Overflow

  Open Babel's MOPAC output reader lets an attacker overflow a fixed-size stack array by placing more than three translation-vector triplets in a crafted 'FINAL POINT AND DERIVATIVES' block, which can…

• highCVE-2022-46294

  CVE-2022-46294: Open Babel MOPAC Cartesian Out-of-Bounds Write

  A crafted MOPAC Cartesian file with more than three Tv (translation-vector) entries overflows a fixed-size stack array in Open Babel, enabling arbitrary code execution in any application that parses…