https://blog.securelayer7.net/continuous-penetration-testing/ SecureLayer7 en 2026-09-02T11:20:18.000Z Continuous Penetration Testing: Process And Benefits Security News https://securelayer7.net/lab/cve-2026-19418-typo3-backend-referrer-bypass-csrf-xss SecureLayer7 en 2026-09-01T21:50:49.252Z CVE-2026-19418: TYPO3 CMS Backend Broken Referrer Enforcement Allows CSRF via XSS CVE Advisory https://securelayer7.net/lab/cve-2026-59724-engine-io-webtransport-prototype-dos SecureLayer7 en 2026-08-31T21:49:01.189Z CVE-2026-59724: engine.io WebTransport Prototype Lookup DoS CVE Advisory https://securelayer7.net/lab/cve-2026-59832-siyuan-snippets-path-traversal-secret-leak SecureLayer7 en 2026-09-02T14:29:25.128Z CVE-2026-59832: SiYuan Authenticated Path Traversal in /snippets/ Handler CVE Advisory https://securelayer7.net/lab/cve-2026-59834-siyuan-sql-injection-block-search-paths SecureLayer7 en 2026-09-02T14:30:39.049Z CVE-2026-59834: SiYuan SQL Injection via Block Search paths Parameter CVE Advisory https://securelayer7.net/lab/cve-2026-62388-nltk-pathsec-enforce-false-security-bypass SecureLayer7 en 2026-09-02T15:56:00.468Z CVE-2026-62388: NLTK pathsec Insecure Default Allows Security Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-62680-orval-ssrf-lfi-openapi-ref SecureLayer7 en 2026-09-02T15:01:59.336Z CVE-2026-62680: Orval Generation-Time SSRF and Local File Inclusion via Unvalidated $ref CVE Advisory https://securelayer7.net/lab/cve-2026-64850-grav-blueprint-dynamicdata-rce SecureLayer7 en 2026-09-02T14:57:33.711Z CVE-2026-64850: Grav CMS Remote Code Execution via Unrestricted Callable in Blueprint::dynamicData() CVE Advisory https://securelayer7.net/lab/cve-2026-71415-kirby-cms-chunked-upload-missing-authorization SecureLayer7 en 2026-08-31T22:28:49.524Z CVE-2026-71415: Kirby CMS Unauthenticated Chunked Upload Storage Exhaustion CVE Advisory https://securelayer7.net/lab/cve-2026-71866-orval-zod-property-name-rce SecureLayer7 en 2026-09-02T15:16:25.135Z CVE-2026-71866: orval Import-time RCE via Zod Object Property Name Injection CVE Advisory https://securelayer7.net/lab/cve-2026-72920-seaweedfs-unauthenticated-iam-grpc SecureLayer7 en 2026-09-02T14:56:13.828Z CVE-2026-72920: SeaweedFS Unauthenticated IAM gRPC Service CVE Advisory https://securelayer7.net/lab/cve-2026-73086-nanoid-integer-overflow-csprng-pool-corruption SecureLayer7 en 2026-09-01T19:29:11.673Z CVE-2026-73086: nanoid Integer Overflow Corrupts CSPRNG Pool CVE Advisory https://securelayer7.net/lab/cve-2026-73089-browserslist-unbounded-cache-oom-dos SecureLayer7 en 2026-09-01T16:49:06.476Z CVE-2026-73089: browserslist Unbounded Cache Memory Exhaustion (DoS) CVE Advisory https://securelayer7.net/lab/cve-2026-75899-fast-uri-ssrf-double-percent-decoding SecureLayer7 en 2026-09-02T15:51:46.465Z CVE-2026-75899: fast-uri SSRF via Double Hostname Percent-Decoding CVE Advisory https://securelayer7.net/lab/cve-2026-75931-fast-uri-idn-scheme-relative-host-confusion SecureLayer7 en 2026-09-02T15:49:07.232Z CVE-2026-75931: fast-uri Host Confusion via Skipped IDN Canonicalization on Scheme-Relative References CVE Advisory https://securelayer7.net/lab/cve-2026-75975-fast-uri-ipv6-ssrf-normalization SecureLayer7 en 2026-09-02T15:50:26.393Z CVE-2026-75975: fast-uri SSRF via Malformed IPv6 Normalization CVE Advisory https://securelayer7.net/lab/cve-2026-76172-fast-uri-scheme-host-confusion SecureLayer7 en 2026-09-02T15:54:49.588Z CVE-2026-76172: fast-uri Host Confusion via Percent-Encoded Scheme Normalization CVE Advisory https://securelayer7.net/lab/cve-2026-78680-nltk-uncontrolled-search-path-graphviz-dot SecureLayer7 en 2026-09-01T20:51:31.034Z CVE-2026-78680: NLTK Uncontrolled Search Path via Graphviz dot Binary CVE Advisory https://securelayer7.net/lab/cve-2026-79675-nltk-jvm-argument-injection-per-call-options SecureLayer7 en 2026-09-01T20:49:02.002Z CVE-2026-79675: NLTK JVM Argument Injection via Per-Call Options (Stanford Wrappers) CVE Advisory https://securelayer7.net/lab/cve-2026-80206-nltk-tgrep-redos-user-regex SecureLayer7 en 2026-09-02T15:17:40.652Z CVE-2026-80206: nltk tgrep ReDoS via User-Supplied Regex Security Research https://securelayer7.net/lab/cve-2026-81726-nltk-model-artifact-pathsec-bypass SecureLayer7 en 2026-09-02T15:11:45.204Z CVE-2026-81726: NLTK Model-Artifact APIs Path Traversal Bypass (pathsec sandbox escape) CVE Advisory https://securelayer7.net/lab/cve-2026-81889-elfinder-ssrf-dns-rebinding-fsock SecureLayer7 en 2026-08-31T20:49:03.684Z CVE-2026-81889: elFinder SSRF Protection Bypass via DNS Rebinding CVE Advisory https://securelayer7.net/lab/cve-2026-81891-elfinder-zip-extract-mime-bypass-rce SecureLayer7 en 2026-09-02T14:51:16.647Z CVE-2026-81891: elFinder ZIP Extraction MIME Filter Bypass Leading to RCE CVE Advisory https://securelayer7.net/lab/cve-2026-81892-easyadmin-routename-access-control-bypass SecureLayer7 en 2026-09-02T14:48:57.457Z CVE-2026-81892: EasyAdmin Custom-Action Dispatcher Authorization Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-82392-pnpm-virtual-store-lockfile-path-traversal SecureLayer7 en 2026-09-02T15:04:36.232Z CVE-2026-82392: pnpm Virtual Store Linker Path Traversal via Crafted Lockfile CVE Advisory https://securelayer7.net/lab/cve-2026-82393-pnpm-scoped-name-path-traversal-arbitrary-file-write SecureLayer7 en 2026-09-02T15:10:13.604Z CVE-2026-82393: pnpm Scoped-Name Path Traversal Arbitrary File Write CVE Advisory https://securelayer7.net/lab/cve-2026-82397-tornado-urlencoded-max-num-fields-dos SecureLayer7 en 2026-09-02T14:50:03.611Z CVE-2026-82397: tornado Urlencoded Body Parsing DoS via Unbounded Field Count CVE Advisory https://securelayer7.net/lab/cve-2026-84304-grpc-go-http2-data-frame-oom SecureLayer7 en 2026-09-01T21:49:17.387Z CVE-2026-84304: gRPC-Go Heap Memory Exhaustion via HTTP/2 DATA Frame Fragmentation CVE Advisory https://securelayer7.net/lab/league-commonmark-attributesextension-form-feed-xss-bypass SecureLayer7 en 2026-09-01T20:29:50.909Z league/commonmark AttributesExtension on* Filter Bypass via U+000C Form Feed (XSS) Security Research https://securelayer7.net/lab/mlflow-statsmodels-pickle-deserialization-bypass-rce SecureLayer7 en 2026-09-01T17:08:59.428Z mlflow statsmodels flavor MLFLOW_ALLOW_PICKLE_DESERIALIZATION bypass RCE Security Research https://securelayer7.net/lab/mysql2-auth-plugin-downgrade-cleartext-credential-leak SecureLayer7 en 2026-09-01T16:51:18.586Z mysql2: Auth Plugin Downgrade Leaks Plaintext Credentials Security Research https://securelayer7.net/lab/pnpm-pacquet-trust-lockfile-dependency-alias-path-traversal SecureLayer7 en 2026-09-01T19:09:20.494Z pnpm pacquet: Trust-Lockfile Dependency Alias Path Traversal Security Research https://securelayer7.net/lab/pnpm-workspace-yaml-proxy-env-secret-exfiltration SecureLayer7 en 2026-09-01T19:30:22.182Z pnpm Environment Secret Exfiltration via Proxy Settings in pnpm-workspace.yaml Security Research