Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• high

  json-repair Circular JSON Schema $ref Infinite Loop DoS

  Passing a self-referencing JSON Schema $ref to json_repair's loads() function causes the schema resolver to loop forever, hanging the process and making any service that exposes this parameter to…

• highCVE-2026-61668

  CVE-2026-61668: DIRAC PilotWrapper Disabled TLS Certificate Validation

  DIRAC's pilot wrapper script intentionally skips TLS certificate verification when downloading the second-stage pilot code, letting a network attacker swap in malicious code that runs with grid…

• highCVE-2026-59954

  CVE-2026-59954: Apollo ConfigService AccessKey Authentication Bypass via Non-Canonical appId

  Apollo ConfigService skips AccessKey signature verification when a request uses a non-canonical appId variant that misses the in-memory secret cache but still resolves to the protected app in the…

• highCVE-2026-54064

  CVE-2026-54064: NukeViet CMS Multiple Anti-XSS Filter Bypasses Leading to Stored XSS

  Two input-filter flaws in NukeViet CMS let any authenticated news author permanently inject JavaScript into articles, putting every site visitor's session and data at risk.

• highCVE-2026-54065

  CVE-2026-54065: NukeViet Path Traversal to Arbitrary File Deletion

  A flaw in NukeViet's comment admin panel lets an authenticated administrator delete any file on the server, including the site's config file, by smuggling a path traversal sequence through the…

• highCVE-2026-55372

  CVE-2026-55372: NukeViet Pre-auth SSRF via X-Forwarded-Host

  Any unauthenticated attacker can make a NukeViet server issue HTTP requests to an arbitrary internal or external host by spoofing the X-Forwarded-Host header, enabling blind port scanning and…

• highCVE-2026-45378

  CVE-2026-45378: decidim-verifications Unauthenticated Access to Signed Identity Document URLs

  Decidim's identity-document verification workflow embeds long-lived signed file URLs directly in admin pages, letting anyone who obtains one of those links download a user's scanned ID without…

• highCVE-2026-45414

  CVE-2026-45414: Decidim JWT Cross-Organization Authentication Bypass

  A valid JWT issued to a user on one Decidim organization can be replayed against a different organization's API just by changing the HTTP Host header, granting unauthorized access to sensitive…

• highCVE-2026-48118

  CVE-2026-48118: NukeViet Unauthenticated Reflected XSS via Base64-Encoded Comment Status Parameter

  Any visitor can inject arbitrary JavaScript into a NukeViet page by passing a base64-encoded XSS payload in a URL parameter, because the anti-forgery token guarding the comment module is static and…

• highCVE-2026-49259

  CVE-2026-49259: NukeViet CMS Stored XSS via Comment Reply Handler

  A registered user on NukeViet CMS can store a JavaScript payload in their profile name, which executes in any visitor's browser when they click the Reply button on that user's comment, including…

• highCVE-2026-54174

  CVE-2026-54174: apko Incomplete APK Data Section Integrity Verification

  Apko verified the signed package index and the control metadata hash, but never checked the data section hash, so an attacker who could tamper with a mirror or intercept a package fetch could…

• critical

  TSDProxy: Internal Auth Token Leaked to Backend Services Enables Management API Takeover

  TSDProxy forwards its internal management authentication token to every proxied backend service, letting any backend on the same host replay that token to gain full admin control over TSDProxy's…