Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• highCVE-2026-53965

  CVE-2026-53965: mcp/sdk HttpTransport Unbounded SSE Buffer Memory Exhaustion

  The MCP PHP SDK HTTP client transport appends Server-Sent Events data to an in-memory buffer with no size limit, letting any server crash the client process by streaming bytes without ever sending…

• highCVE-2026-54347

  CVE-2026-54347: Froxlor Stored XSS in DNS TXT Record Leads to Admin Account Takeover

  A customer-level Froxlor user can store JavaScript in a DNS TXT record that executes in any administrator's browser, handing the attacker full control of the panel.

• highCVE-2026-54348

  CVE-2026-54348: Froxlor Second-Order SQL Injection via Admins.add ipaddress Parameter

  A malicious Froxlor administrator can store a SQL payload in their own account record and trigger it later to dump every admin username and password hash from the database.

• criticalCVE-2026-62988

  CVE-2026-62988: Froxlor API Credential and 2FA Secret Disclosure

  Froxlor's API endpoints return full database rows including password hashes and TOTP seeds, letting any authenticated API user steal credentials and bypass two-factor authentication for customers…

• high

  LibreNMS SSRF-Driven Stored XSS via Oxidized API Response Fields

  An admin can point LibreNMS's Oxidized integration at an attacker-controlled server, which returns HTML-injected JSON fields that LibreNMS renders unescaped on the device config tab, giving any…

• highCVE-2026-17106

  CVE-2026-17106: moby/go-archive Symlink-Following Path Traversal in Tar Extraction

  A crafted tar archive can plant a symlink during extraction to redirect subsequent file writes outside the intended destination directory, letting a malicious Docker container overwrite arbitrary…

• highCVE-2026-70666

  CVE-2026-70666: Lemur ACME Client Server-Side Request Forgery via Server-Controlled URLs

  A user with any role on a Lemur ACME certificate authority can repoint it at a malicious ACME server they control, causing Lemur to make authenticated POST requests to arbitrary internal URLs during…

• highCVE-2026-71303

  CVE-2026-71303: Lemur ACME Authority Update SSRF (Incomplete Fix)

  Lemur's certificate authority update endpoint lets any user with an authority role silently replace the ACME directory URL with an internal address, causing the server to make outbound requests to…

• highCVE-2026-71307

  CVE-2026-71307: Lemur Authenticated Plaintext Destination Credential Exposure

  Any logged-in Lemur user, including read-only accounts, can call the destinations API and get back plaintext SFTP passwords and private-key passphrases that Lemur uses to deploy TLS certificates.

• highCVE-2026-71308

  CVE-2026-71308: Lemur Unauthorized Certificate Hijack via Unchecked replaces Field

  Any authenticated Lemur user can silently take over a production certificate they do not own by listing its ID in the replaces field when uploading or creating their own certificate, disabling the…

• highCVE-2026-71417

  CVE-2026-71417: Lemur Authorization Bypass via Duplicate Certificate Upload Enables Arbitrary CA Revocation

  Any authenticated Lemur user can revoke a certificate they do not own, including live production certificates, by uploading a duplicate database record and revoking it through an authorization check…

• highCVE-2026-55224

  CVE-2026-55224: MineAdmin Path Traversal in Plugin Install/Uninstall

  MineAdmin's app-store plugin service accepts unsanitized directory names from users and plugs them straight into file-system paths, letting any authenticated user read, install, or uninstall content…