https://blog.securelayer7.net/autonomous-penetration-testing-complete-guide-2026/ SecureLayer7 en 2026-08-25T18:45:36.000Z Autonomous Penetration Testing: Complete Guide 2026 Security News https://blog.securelayer7.net/shadow-ai/ SecureLayer7 en 2026-08-25T08:22:23.000Z Shadow AI: Risks, How It Works and How to Protect Security News https://securelayer7.net/lab/cve-2026-45018-chainlit-mcp-stdio-command-injection-rce SecureLayer7 en 2026-08-25T19:30:11.793Z CVE-2026-45018: Chainlit Unauthenticated Remote Code Execution via MCP stdio Command Injection CVE Advisory https://securelayer7.net/lab/cve-2026-45019-chainlit-mcp-ssrf-internal-network SecureLayer7 en 2026-08-25T19:29:02.230Z CVE-2026-45019: Chainlit SSRF via MCP SSE and Streamable-HTTP Transports CVE Advisory https://securelayer7.net/lab/cve-2026-48853-elixir-grpc-erlpack-unsafe-deserialization-rce SecureLayer7 en 2026-08-25T18:37:53.869Z CVE-2026-48853: erlang/grpc Unsafe Deserialization Leading to RCE and DoS CVE Advisory https://securelayer7.net/lab/cve-2026-48854-elixir-grpc-unbounded-body-memory-exhaustion SecureLayer7 en 2026-08-25T18:31:34.898Z CVE-2026-48854: elixir-grpc Unbounded Request Body Memory Exhaustion CVE Advisory https://securelayer7.net/lab/cve-2026-49757-ash-authentication-oauth2-oidc-account-takeover-email-spoofing SecureLayer7 en 2026-08-25T18:29:04.496Z CVE-2026-49757: ash_authentication OAuth2/OIDC Account Takeover via Email Spoofing CVE Advisory https://securelayer7.net/lab/cve-2026-53430-elixir-grpc-gzip-decompression-bomb-dos SecureLayer7 en 2026-08-25T18:30:13.786Z CVE-2026-53430: elixir-grpc Unbounded gzip Decompression Bomb (DoS) CVE Advisory https://securelayer7.net/lab/cve-2026-54049-sakai-conversations-stored-xss-unsanitized-messages SecureLayer7 en 2026-08-24T19:50:19.285Z CVE-2026-54049: Sakai Conversations Stored XSS via Unsanitized Topic and Post Messages CVE Advisory https://securelayer7.net/lab/cve-2026-54623-django-cms-move-plugin-cyclic-reparenting-dos SecureLayer7 en 2026-08-24T20:28:49.690Z CVE-2026-54623: django-cms Plugin Move Endpoint Cyclic Reparenting DoS CVE Advisory https://securelayer7.net/lab/cve-2026-55099-icalendar-component-equality-dos SecureLayer7 en 2026-08-25T19:48:49.929Z CVE-2026-55099: icalendar Algorithmic Complexity Denial of Service in Component Equality CVE Advisory https://securelayer7.net/lab/cve-2026-55477-3x-ui-arbitrary-file-write-xray-log-path SecureLayer7 en 2026-08-24T21:08:56.562Z CVE-2026-55477: 3X-UI Authenticated Arbitrary File Write via Xray Log Path CVE Advisory https://securelayer7.net/lab/cve-2026-55523-praisonaiagents-web-crawl-ssrf-redirect-bypass SecureLayer7 en 2026-08-25T14:29:01.586Z CVE-2026-55523: praisonaiagents web_crawl SSRF via Unvalidated Redirect Target CVE Advisory https://securelayer7.net/lab/cve-2026-55524-praisonaiagents-ssrf-web-crawl-redirect-dns-rebinding SecureLayer7 en 2026-08-25T14:49:14.600Z CVE-2026-55524: praisonaiagents SSRF via Redirect and DNS Rebinding in web_crawl CVE Advisory https://securelayer7.net/lab/cve-2026-55525-praisonaiagents-web-crawl-ssrf-redirect-bypass SecureLayer7 en 2026-08-25T14:09:13.909Z CVE-2026-55525: praisonaiagents web_crawl SSRF via Redirect Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-55526-praisonaiagents-ssrf-dns-bypass-spider-tools SecureLayer7 en 2026-08-25T14:51:00.533Z CVE-2026-55526: praisonaiagents SSRF Protection Bypass via Wildcard DNS Hostname CVE Advisory https://securelayer7.net/lab/cve-2026-55528-praisonaiagents-agentserver-missing-authentication SecureLayer7 en 2026-08-25T14:52:09.340Z CVE-2026-55528: praisonaiagents AgentServer Missing Authentication CVE Advisory https://securelayer7.net/lab/cve-2026-55532-praisonai-mcp-origin-csrf-bypass SecureLayer7 en 2026-08-25T15:31:08.480Z CVE-2026-55532: PraisonAI MCP HTTP Server Origin Validation Bypass (CSRF) CVE Advisory https://securelayer7.net/lab/cve-2026-55536-praisonai-websocket-origin-regex-bypass SecureLayer7 en 2026-08-25T15:30:01.275Z CVE-2026-55536: PraisonAI WebSocket Origin Validation Bypass via Unanchored Regex CVE Advisory https://securelayer7.net/lab/cve-2026-55537-praisonai-webhook-ssrf-dns-fail-open-toctou SecureLayer7 en 2026-08-25T15:10:11.732Z CVE-2026-55537: PraisonAI Webhook SSRF via DNS Fail-Open and TOCTOU Race CVE Advisory https://securelayer7.net/lab/cve-2026-55538-praisonai-serve-agents-api-key-auth-bypass SecureLayer7 en 2026-08-25T15:11:31.693Z CVE-2026-55538: PraisonAI serve agents --api-key Authentication Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-55539-praisonai-jobs-api-missing-authentication SecureLayer7 en 2026-08-25T15:35:37.308Z CVE-2026-55539: PraisonAI Jobs API Missing Authentication CVE Advisory https://securelayer7.net/lab/cve-2026-55541-praisonai-serve-api-key-missing-authorization SecureLayer7 en 2026-08-25T15:08:58.250Z CVE-2026-55541: PraisonAI serve --api-key Flag Missing Authorization CVE Advisory https://securelayer7.net/lab/cve-2026-55546-qwed-mcp-sympy-parse-expr-rce SecureLayer7 en 2026-08-25T15:28:43.436Z CVE-2026-55546: qwed-mcp Remote Code Execution via Unsafe SymPy parse_expr() CVE Advisory https://securelayer7.net/lab/cve-2026-55553-urllib-cross-origin-redirect-credential-leakage SecureLayer7 en 2026-08-25T16:30:13.085Z CVE-2026-55553: urllib Cross-Origin Redirect Credential Leakage CVE Advisory https://securelayer7.net/lab/cve-2026-55571-djust-liveview-websocket-auth-bypass SecureLayer7 en 2026-08-25T16:14:52.083Z CVE-2026-55571: djust LiveView WebSocket Authentication Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-55580-mcp-shell-command-injection-security-disabled-default-shell-inter SecureLayer7 en 2026-08-25T15:49:03.237Z CVE-2026-55580: mcp-shell OS Command Injection via Security-Disabled Default and Shell Interpreter in Allowlist CVE Advisory https://securelayer7.net/lab/cve-2026-55581-mcp-shell-allowlist-bypass-bash-command-injection SecureLayer7 en 2026-08-25T15:50:13.471Z CVE-2026-55581: mcp-shell Secure Mode Allowlist Bypass via /bin/bash -c CVE Advisory https://securelayer7.net/lab/cve-2026-55582-mcp-shell-git-alias-command-injection SecureLayer7 en 2026-08-25T15:51:22.523Z CVE-2026-55582: mcp-shell Secure Mode Allowlist Bypass via Git Shell Alias CVE Advisory https://securelayer7.net/lab/cve-2026-55585-qwed-authenticated-rce-sympy-parse-expr SecureLayer7 en 2026-08-25T16:28:58.191Z CVE-2026-55585: qwed Authenticated Remote Code Execution via Unsafe SymPy parse_expr() CVE Advisory https://securelayer7.net/lab/cve-2026-55596-platejs-media-embed-stored-xss-provider-metadata SecureLayer7 en 2026-08-25T16:48:48.260Z CVE-2026-55596: @platejs/media Media Embed Stored XSS via Serialized Provider Metadata CVE Advisory https://securelayer7.net/lab/cve-2026-55604-deepseek-mcp-server-session-hijack SecureLayer7 en 2026-08-25T18:48:47.330Z CVE-2026-55604: @arikusi/deepseek-mcp-server Cross-Session Authorization Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-55620-eml-parser-dos-nested-parens-received-header SecureLayer7 en 2026-08-25T18:36:08.765Z CVE-2026-55620: eml_parser ReDoS via Deeply Nested Parentheses in Received Headers CVE Advisory https://securelayer7.net/lab/cve-2026-55629-whistle-arbitrary-file-read-path-traversal SecureLayer7 en 2026-08-25T18:34:53.706Z CVE-2026-55629: whistle Arbitrary File Read via Path Traversal CVE Advisory https://securelayer7.net/lab/cve-2026-55637-genieacs-mcp-dns-rebinding-origin-validation SecureLayer7 en 2026-08-25T18:08:49.899Z CVE-2026-55637: genieacs-mcp DNS Rebinding via Missing Host and Origin Validation CVE Advisory https://securelayer7.net/lab/cve-2026-55640-nextcloud-mcp-server-unauthenticated-webhook-vector-deletion SecureLayer7 en 2026-08-25T16:09:19.454Z CVE-2026-55640: nextcloud-mcp-server Unauthenticated Webhook Allows Arbitrary Vector Data Deletion CVE Advisory https://securelayer7.net/lab/cve-2026-55677-echo-encoded-slash-route-bypass-static-file-disclosure SecureLayer7 en 2026-08-25T16:31:27.091Z CVE-2026-55677: Echo v5 Encoded Slash Route-Bypass Exposes Static Files CVE Advisory https://securelayer7.net/lab/cve-2026-56777-phpmyfaq-group-permissions-privilege-escalation SecureLayer7 en 2026-08-25T17:50:34.647Z CVE-2026-56777: phpMyFAQ GroupController Privilege Escalation via Missing Self-Rights Constraint Security Research https://securelayer7.net/lab/cve-2026-9769-justhtml-uncontrolled-recursion-dos-nested-html SecureLayer7 en 2026-08-25T16:50:51.995Z CVE-2026-9769: justhtml Uncontrolled Recursion DoS via Deeply Nested HTML Security Research https://securelayer7.net/lab/mcp-contextforge-gateway-ssti-jinja2-rce-prompt-service SecureLayer7 en 2026-08-25T17:48:45.446Z mcp-contextforge-gateway Server-Side Template Injection (SSTI) leading to RCE Security Research https://securelayer7.net/lab/pickem-terminal-escape-sequence-injection-unsanitized-labels SecureLayer7 en 2026-08-25T16:10:32.974Z pickem Terminal Escape-Sequence Injection via Unsanitized Item Labels Security Research https://securelayer7.net/lab/postgres-protocol-scram-iteration-count-dos SecureLayer7 en 2026-08-24T19:49:03.531Z postgres-protocol: Unbounded SCRAM Iteration Count CPU Exhaustion DoS Security Research https://securelayer7.net/lab/utcp-http-oauth2-tokenurl-ssrf-credential-theft SecureLayer7 en 2026-08-25T16:11:36.956Z utcp-http OAuth2 tokenUrl Trust Boundary Bypass (SSRF and Credential Theft) Security Research https://securelayer7.net/lab/utcp-http-ssrf-unvalidated-redirect-call-tool SecureLayer7 en 2026-08-25T16:16:10.987Z utcp-http SSRF via Unvalidated HTTP Redirect in call_tool Security Research