https://blog.securelayer7.net/api-security-testing/ SecureLayer7 en 2026-08-20T11:54:25.000Z Security Testing For API: Types, Best Tools, And Checklist Security News https://blog.securelayer7.net/ai-powered-pentest-vs-ai-native-pentest/ SecureLayer7 en 2026-08-20T06:05:42.000Z AI-Powered Pentest vs AI-Native Pentest: Key Differences Security News https://securelayer7.net/lab/claude-faf-mcp-path-traversal-arbitrary-file-read-write SecureLayer7 en 2026-08-19T20:17:35.837Z claude-faf-mcp Arbitrary File Read/Write via Unconfined Path Argument Security Research https://securelayer7.net/lab/cve-2026-53951-copier-trust-prefix-path-traversal-rce SecureLayer7 en 2026-08-19T20:16:21.297Z CVE-2026-53951: copier Trust-Prefix Bypass via Path Traversal Leads to Arbitrary Command Execution CVE Advisory https://securelayer7.net/lab/cve-2026-53957-contentful-mcp-server-ssrf-host-proxy-pat-exfiltration SecureLayer7 en 2026-08-19T20:04:50.783Z CVE-2026-53957: @contentful/mcp-server SSRF via LLM-Controlled host/proxy Parameters CVE Advisory https://securelayer7.net/lab/cve-2026-53964-document-merge-service-xlsx-ssti-rce SecureLayer7 en 2026-08-19T20:11:48.937Z CVE-2026-53964: document-merge-service Remote Code Execution via SSTI in XLSX Templates CVE Advisory https://securelayer7.net/lab/cve-2026-53965-mcp-sdk-httptransport-sse-buffer-memory-exhaustion SecureLayer7 en 2026-08-19T19:30:42.092Z CVE-2026-53965: mcp/sdk HttpTransport Unbounded SSE Buffer Memory Exhaustion CVE Advisory https://securelayer7.net/lab/cve-2026-53966-xwiki-livedata-livetable-missing-authorization-privilege-escalati SecureLayer7 en 2026-08-19T19:37:41.404Z CVE-2026-53966: XWiki Platform Live Data Live Table Connector Missing Authorization Privilege Escalation CVE Advisory https://securelayer7.net/lab/cve-2026-54061-dgraph-streamextsnapshot-unauthenticated-store-wipe SecureLayer7 en 2026-08-20T17:49:44.806Z CVE-2026-54061: Dgraph Alpha Unauthenticated Remote Group Store Wipe via StreamExtSnapshot CVE Advisory https://securelayer7.net/lab/cve-2026-54167-pipelines-as-code-github-app-jwt-exfiltration-enterprise-host-hea SecureLayer7 en 2026-08-20T19:31:01.063Z CVE-2026-54167: Pipelines-as-Code GitHub App JWT Exfiltration via Untrusted X-GitHub-Enterprise-Host Header CVE Advisory https://securelayer7.net/lab/cve-2026-54175-backpack-crud-unverified-password-change-mass-assignment SecureLayer7 en 2026-08-20T19:28:48.686Z CVE-2026-54175: Laravel Backpack CRUD Unverified Password Change via Mass Assignment CVE Advisory https://securelayer7.net/lab/cve-2026-54178-backpack-crud-arbitrary-file-deletion-upload-multiple SecureLayer7 en 2026-08-20T19:24:38.258Z CVE-2026-54178: Backpack CRUD Arbitrary File Deletion via Unvalidated clear_<attr>[] Input CVE Advisory https://securelayer7.net/lab/cve-2026-54180-laravel-backpack-crud-idor-write-operations SecureLayer7 en 2026-08-20T19:23:21.216Z CVE-2026-54180: Laravel Backpack CRUD Cross-Tenant IDOR on Write Operations CVE Advisory https://securelayer7.net/lab/cve-2026-54182-backpack-crud-os-command-injection-host-header SecureLayer7 en 2026-08-20T19:15:46.249Z CVE-2026-54182: backpack/crud OS Command Injection via Host Header CVE Advisory https://securelayer7.net/lab/cve-2026-54245-fleetdm-okta-conditional-access-sql-injection SecureLayer7 en 2026-08-20T19:04:54.111Z CVE-2026-54245: Fleet SQL Injection in Okta Conditional Access Endpoint CVE Advisory https://securelayer7.net/lab/cve-2026-54251-netty-ohttp-direct-memory-leak-aead-dos SecureLayer7 en 2026-08-20T19:03:38.781Z CVE-2026-54251: netty-incubator-codec-ohttp Native Direct-Memory Leak on AEAD Decryption Failure CVE Advisory https://securelayer7.net/lab/cve-2026-54263-wagtail-reflected-xss-image-url-generator SecureLayer7 en 2026-08-20T19:21:57.257Z CVE-2026-54263: Wagtail Reflected XSS in Dynamic Image URL Generator CVE Advisory https://securelayer7.net/lab/cve-2026-55149-vouch-proxy-multipart-cookie-dos SecureLayer7 en 2026-08-20T17:28:44.276Z CVE-2026-55149: vouch-proxy Unbounded Multipart Cookie Allocation DoS CVE Advisory https://securelayer7.net/lab/cve-2026-61798-netty-ohttp-hpke-private-key-tostring-exposure SecureLayer7 en 2026-08-20T18:56:05.986Z CVE-2026-61798: netty-incubator-codec-ohttp BoringSSL HPKE Private Key Exposure via toString() CVE Advisory https://securelayer7.net/lab/cve-2026-61827-netty-bhttp-parser-oom-variable-length SecureLayer7 en 2026-08-20T18:51:38.823Z CVE-2026-61827: netty-incubator-codec-bhttp BinaryHttpParser Unbounded Memory Allocation (OOM) CVE Advisory https://securelayer7.net/lab/cve-2026-62673-grav-htaccess-case-sensitivity-bypass SecureLayer7 en 2026-08-19T19:42:07.303Z CVE-2026-62673: Grav .htaccess File Extension Filter Case-Sensitivity Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-63124-netty-bhttp-binaryhttpparser-infinite-loop-dos SecureLayer7 en 2026-08-20T18:54:59.236Z CVE-2026-63124: netty-incubator-codec-bhttp BinaryHttpParser Infinite Loop DoS CVE Advisory https://securelayer7.net/lab/cve-2026-63188-logto-tunnel-path-traversal-static-file SecureLayer7 en 2026-08-19T20:28:46.777Z CVE-2026-63188: @logto/tunnel Path Traversal via Unsanitized request.url CVE Advisory https://securelayer7.net/lab/cve-2026-63202-netty-bhttp-binaryhttpparser-infinite-loop-dos SecureLayer7 en 2026-08-20T18:49:59.829Z CVE-2026-63202: netty-incubator-codec-bhttp BinaryHttpParser Infinite Loop DoS CVE Advisory https://securelayer7.net/lab/faf-mcp-path-traversal-arbitrary-file-read-write SecureLayer7 en 2026-08-19T20:23:29.592Z faf-mcp Arbitrary File Read/Write via Unconfined Path Argument Security Research https://securelayer7.net/lab/geolens-authorization-bypass-private-dataset-disclosure SecureLayer7 en 2026-08-19T20:10:28.571Z GeoLens Authorization and Cache-Scope Flaws Disclose Private Dataset Data Security Research https://securelayer7.net/lab/grok-faf-mcp-arbitrary-file-read-unconfined-path SecureLayer7 en 2026-08-19T20:24:52.568Z grok-faf-mcp: Arbitrary File Read via Unconfined Path in FAF Tools Security Research https://securelayer7.net/lab/nocobase-arbitrary-file-write-lfi-rce SecureLayer7 en 2026-08-20T18:57:29.521Z NocoBase: Arbitrary File Write and Local File Inclusion leading to Remote Code Execution Security Research https://securelayer7.net/lab/winter-cms-twig-sandbox-escape-eloquent-call-forwarding-cve-2024-54149-bypass SecureLayer7 en 2026-08-20T18:48:52.120Z Winter CMS: Authenticated Twig Sandbox Escape via Eloquent __call Forwarding (Bypass of CVE-2024-54149) Security Research