Labs
Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.
- highCVE-2026-69213
CVE-2026-69213: http4s Ember HTTP/2 Unbounded Outbound Frame Queue DoS
A single unauthenticated HTTP/2 connection can exhaust the server's heap by flooding it with tiny control frames (PINGs, SETTINGS) faster than the server can write ACKs out, because the internal…
- highCVE-2026-61544
CVE-2026-61544: libp2p-quic Remote Panic via Certificate Expiry Race
A remote attacker can crash any application running a libp2p QUIC listener by presenting a short-lived TLS certificate and deliberately delaying the final handshake packet until the certificate…
- highCVE-2026-69218
CVE-2026-69218: http4s Ember HTTP/2 Unbounded CONTINUATION Frame Memory Exhaustion
An attacker can crash any http4s Ember server or client with HTTP/2 enabled by streaming CONTINUATION frames forever, exhausting the JVM heap with no authentication required.
- highCVE-2026-88975
CVE-2026-88975: http4s Ember HTTP/2 Frame Size Memory Exhaustion
An unauthenticated attacker can crash an http4s Ember server by sending a single HTTP/2 frame that claims to be 16 MiB, tricking the server into buffering that memory before it ever checks its own…
- highCVE-2026-56668
CVE-2026-56668: ZITADEL OAuth2 Token Exchange Missing Authorization
A flaw in ZITADEL's token exchange endpoint lets an attacker swap a low-privilege access token for one with elevated permissions at a completely different application, bypassing all role and scope…
- criticalCVE-2026-59178
CVE-2026-59178: esphome-device-builder Silent Authentication Bypass on Upgrade
Upgrading the ESPHome Device Builder dashboard silently drops password protection for any deployment that used the old USERNAME and PASSWORD environment variables, leaving the dashboard open to…
- criticalCVE-2026-61534
CVE-2026-61534: yayson Prototype Pollution via JSON:API Type Deserialization
The yayson JSON:API client lets an attacker send a crafted document whose resource type is '__proto__', silently writing arbitrary properties onto every object in the Node.js process.
- highCVE-2026-59973
CVE-2026-59973: mcp-from-openapi OpenAPI $ref SSRF Filter Bypass
The SSRF hostname denylist added in mcp-from-openapi 2.3.0 can be bypassed using DNS names that resolve to loopback, HTTP redirects, or IPv4-mapped IPv6 addresses, letting an attacker reach internal…
- highCVE-2026-59148
CVE-2026-59148: @mockoon/commons-server Unauthenticated Admin API + Wildcard CORS
Mockoon's built-in admin API had no authentication and replied with Access-Control-Allow-Origin: * on every endpoint, letting anyone who could reach the mock server port, including a malicious…
- highCVE-2026-56828
CVE-2026-56828: shopper/framework Privilege Escalation via Livewire Misconfigured Authorization
A staff user with only read-level access to the Shopper admin panel can grant themselves full admin permissions, create new admin accounts, or delete roles, because three Livewire components guard…
- highCVE-2026-56829
CVE-2026-56829: Shopper VariantStock Missing Authorization
Any logged-in Shopper admin panel user, even one with read-only permissions, can silently adjust inventory levels for any product variant in the database by tampering with a single unprotected…
- highCVE-2026-56825
CVE-2026-56825: Shopper CollectionProducts Missing Authorization
Any logged-in admin panel user, even one with read-only access, can silently remove all products from any collection in the store by forging a Livewire wire payload, because the CollectionProducts…