Labs
Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.
- highCVE-2026-54182
CVE-2026-54182: backpack/crud OS Command Injection via Host Header
An unauthenticated attacker can inject shell commands into the HTTP Host header, which Laravel Backpack CRUD passes unsanitized to exec() on every production request, leading to full remote code…
- highCVE-2026-54245
CVE-2026-54245: Fleet SQL Injection in Okta Conditional Access Endpoint
A flaw in Fleet's Okta conditional access integration lets anyone who controls a single enrolled host inject SQL into the Fleet database, potentially leaking session tokens that can be replayed for…
- highCVE-2026-54251
CVE-2026-54251: netty-incubator-codec-ohttp Native Direct-Memory Leak on AEAD Decryption Failure
An attacker can crash an OHTTP gateway by repeatedly sending requests with a deliberately broken encryption tag, causing the server to leak native memory until it runs out and crashes.
- high
NocoBase: Arbitrary File Write and Local File Inclusion leading to Remote Code Execution
An authenticated NocoBase admin can redirect the file-upload storage root to any path on disk, upload a malicious Node.js file there, then force the server to execute it via the plugin manager…
- highCVE-2026-61798
CVE-2026-61798: netty-incubator-codec-ohttp BoringSSL HPKE Private Key Exposure via toString()
The Netty OHTTP BoringSSL codec leaks raw HPKE private key bytes into log files and exception messages because toString() on key objects renders the full key byte array in plaintext.
- highCVE-2026-63124
CVE-2026-63124: netty-incubator-codec-bhttp BinaryHttpParser Infinite Loop DoS
A crafted Binary HTTP request with a field section that ends exactly on a complete field line causes the Netty BHTTP parser to loop forever, blocking the event-loop thread and taking the service down.
- highCVE-2026-61827
CVE-2026-61827: netty-incubator-codec-bhttp BinaryHttpParser Unbounded Memory Allocation (OOM)
An attacker can crash a server using Netty's Binary HTTP parser by sending a crafted message that claims a field is gigabytes long, causing the parser to buffer data indefinitely until the JVM runs…
- highCVE-2026-63202
CVE-2026-63202: netty-incubator-codec-bhttp BinaryHttpParser Infinite Loop DoS
A 17-byte malformed Binary HTTP message sent inside a normal OHTTP request can permanently pin a Netty event-loop thread at 100% CPU, taking the gateway offline with no authentication required.
- high
Winter CMS: Authenticated Twig Sandbox Escape via Eloquent __call Forwarding (Bypass of CVE-2024-54149)
Authenticated backend users of Winter CMS with template-editing permissions can escape the Twig sandbox by calling Eloquent model methods that the blocklist missed, allowing arbitrary SQL execution…
- criticalCVE-2026-54061
CVE-2026-54061: Dgraph Alpha Unauthenticated Remote Group Store Wipe via StreamExtSnapshot
An unauthenticated attacker who can reach Dgraph Alpha's public gRPC port can wipe or replace any group store, including the one holding access-control data, by calling an unprotected snapshot-import…
- highCVE-2026-55149
CVE-2026-55149: vouch-proxy Unbounded Multipart Cookie Allocation DoS
A single unauthenticated HTTP request with a crafted cookie name can crash vouch-proxy by forcing the Go runtime to attempt a ~160 GB heap allocation, taking down the authentication gateway and any…
- highCVE-2026-63188
CVE-2026-63188: @logto/tunnel Path Traversal via Unsanitized request.url
The @logto/tunnel CLI serves local sign-in UI files without checking that the requested path stays inside the configured directory, so anyone who can reach the tunnel port can read arbitrary files on…