Labs
Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.
- critical
FacturaScripts Path Traversal to Remote Code Execution via UploadedFile::move()
An authenticated FacturaScripts user can upload a file whose name contains ../ sequences to escape the intended upload directory, write an Apache .htaccess override and a disguised PHP file into a…
- highCVE-2026-61699
CVE-2026-61699: nebula-mesh Certificate Blocklist Never Enforced on Mesh Peers
Blocking a host in nebula-mesh has no effect on the network: the revocation blocklist is never written into any peer's config, so a blocked or compromised host keeps full mesh access until its…
- high
nebula-mesh: Non-Admin SSRF via Unguarded allow_private Webhook Flag
A low-privilege operator in nebula-mesh can set a single flag on their own webhook subscription to make the server send HTTP requests to loopback and private addresses, bypassing the built-in SSRF…
- highCVE-2026-61549
CVE-2026-61549: Woodpecker CI Kubernetes Backend Privilege Escalation via serviceAccountName
Any user with push access to a repository connected to Woodpecker's Kubernetes backend could set an arbitrary ServiceAccount on their pipeline pods, inheriting that account's full cluster RBAC…
- highCVE-2026-54087
CVE-2026-54087: EasyAdmin Bundle Stored XSS via FileField and ImageField Upload
A low-privileged admin user can upload a JavaScript-bearing SVG or HTML file through EasyAdmin's file upload fields, and when another admin opens the stored file from the same origin it executes in…
- highCVE-2026-44891
CVE-2026-44891: netty-codec-stomp Unbounded Header Count DoS
Netty's STOMP decoder accepts an unlimited number of headers per frame, so an attacker can flood a server with tiny headers until the JVM runs out of memory and crashes.
- highCVE-2026-54629
CVE-2026-54629: Anyquery Local File Read via Unrestricted SQLite Virtual Table Modules
When Anyquery is run in server mode, any unauthenticated remote client can read arbitrary local files by creating a SQLite virtual table that points to a sensitive path like /etc/passwd or…
- highCVE-2026-54448
CVE-2026-54448: Trivy Helm Chart Tar Bomb OOM via Unbounded io.ReadAll
Trivy's Helm chart scanner reads every archive entry into memory with no size limit, so a crafted .tgz that expands to gigabytes can crash the Trivy process and take down a CI runner.
- critical
TidGi Desktop Remote Code Execution via Malicious TiddlyWiki Repository Import
Importing a crafted TiddlyWiki Git repository into TidGi Desktop automatically executes attacker-supplied JavaScript with full Node.js access, giving an attacker complete control over the victim's…
- high
Ech0: Accept-Language `_` Separator Bypass Causes ~70x CPU Amplification DoS
Ech0's i18n middleware passes the raw Accept-Language HTTP header directly into a Go language parser on every request, and a 1 MB header full of underscore separators bypasses an existing DoS guard…
- highCVE-2026-54628
CVE-2026-54628: Anyquery SSRF via Unrestricted SQLite Virtual Table Modules in Server Mode
Anyquery's MySQL-compatible server mode lets unauthenticated remote clients create SQLite virtual tables that fetch any URL, including cloud metadata endpoints and internal services, leaking…
- highCVE-2026-50158
CVE-2026-50158: yutu Arbitrary File Write via MCP caption-download
A missing path check in yutu's caption-download MCP tool lets any caller write files anywhere on disk, bypassing the sandbox boundary that every other file operation in the tool respects.