https://blog.securelayer7.net/ai-sandbox/ SecureLayer7 en 2026-09-03T07:35:45.000Z AI Sandbox: Security Risks, Benefits & Best Practices Security News https://blog.securelayer7.net/continuous-penetration-testing/ SecureLayer7 en 2026-09-02T11:20:18.000Z Continuous Penetration Testing: Process And Benefits Security News https://securelayer7.net/lab/cve-2026-56811-phoenix-unbounded-channel-join-dos SecureLayer7 en 2026-09-03T20:50:31.125Z CVE-2026-56811: Phoenix Unbounded Channel Join DoS CVE Advisory https://securelayer7.net/lab/cve-2026-59832-siyuan-snippets-path-traversal-secret-leak SecureLayer7 en 2026-09-02T14:29:25.128Z CVE-2026-59832: SiYuan Authenticated Path Traversal in /snippets/ Handler CVE Advisory https://securelayer7.net/lab/cve-2026-59834-siyuan-sql-injection-block-search-paths SecureLayer7 en 2026-09-02T14:30:39.049Z CVE-2026-59834: SiYuan SQL Injection via Block Search paths Parameter CVE Advisory https://securelayer7.net/lab/cve-2026-61556-liquidjs-strip-html-infinite-loop-dos SecureLayer7 en 2026-09-03T17:48:48.994Z CVE-2026-61556: LiquidJS strip_html Infinite Loop (DoS) CVE Advisory https://securelayer7.net/lab/cve-2026-61704-link-preview-js-dns-rebinding-ssrf-bypass SecureLayer7 en 2026-09-02T21:49:02.194Z CVE-2026-61704: link-preview-js DNS Rebinding SSRF Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-62388-nltk-pathsec-enforce-false-security-bypass SecureLayer7 en 2026-09-02T15:56:00.468Z CVE-2026-62388: NLTK pathsec Insecure Default Allows Security Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-62669-grav-cms-2fa-bypass-secret-rotation SecureLayer7 en 2026-09-02T22:08:58.656Z CVE-2026-62669: Grav CMS 2FA Bypass via Unauthenticated Secret Rotation CVE Advisory https://securelayer7.net/lab/cve-2026-62675-omnigent-callable-tool-runner-rce SecureLayer7 en 2026-09-02T22:16:45.022Z CVE-2026-62675: Omnigent Authenticated Runner RCE via Python Callable Tool in Uploaded Agent Bundle CVE Advisory https://securelayer7.net/lab/cve-2026-62676-omnigent-shell-parser-fails-open-policy-bypass SecureLayer7 en 2026-09-02T22:48:58.922Z CVE-2026-62676: omnigent Shell-Command Parser Fails Open, Allowing Policy Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-62677-omnigent-os-env-cwd-path-traversal SecureLayer7 en 2026-09-02T22:10:12.178Z CVE-2026-62677: Omnigent Path Traversal via Unvalidated os_env.cwd in Agent Bundle CVE Advisory https://securelayer7.net/lab/cve-2026-62680-orval-ssrf-lfi-openapi-ref SecureLayer7 en 2026-09-02T15:01:59.336Z CVE-2026-62680: Orval Generation-Time SSRF and Local File Inclusion via Unvalidated $ref CVE Advisory https://securelayer7.net/lab/cve-2026-62682-orval-server-url-template-literal-rce SecureLayer7 en 2026-09-03T19:09:04.581Z CVE-2026-62682: Orval Remote Code Execution via Unescaped Server URL in Template Literal CVE Advisory https://securelayer7.net/lab/cve-2026-63376-toml-node-prototype-pollution-proto-desync SecureLayer7 en 2026-09-03T21:11:04.599Z CVE-2026-63376: toml Prototype Pollution via __proto__ Key-Path Desynchronization CVE Advisory https://securelayer7.net/lab/cve-2026-63490-handlebars-springmvc-arbitrary-file-read-fragment-bypass SecureLayer7 en 2026-09-02T22:14:56.466Z CVE-2026-63490: handlebars-springmvc Arbitrary File Read via URL Fragment Suffix Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-64850-grav-blueprint-dynamicdata-rce SecureLayer7 en 2026-09-02T14:57:33.711Z CVE-2026-64850: Grav CMS Remote Code Execution via Unrestricted Callable in Blueprint::dynamicData() CVE Advisory https://securelayer7.net/lab/cve-2026-65842-platejs-docx-io-ssrf-remote-image-fetch SecureLayer7 en 2026-09-02T22:28:58.816Z CVE-2026-65842: @platejs/docx-io Server-Side Request Forgery via Remote Image Fetch CVE Advisory https://securelayer7.net/lab/cve-2026-67445-mailpit-smtp-command-line-memory-exhaustion SecureLayer7 en 2026-09-02T23:51:27.707Z CVE-2026-67445: Mailpit SMTP Command Parser Unbounded Memory Allocation (DoS) CVE Advisory https://securelayer7.net/lab/cve-2026-67446-mailpit-thumbnail-image-decompression-dos SecureLayer7 en 2026-09-02T23:58:06.989Z CVE-2026-67446: Mailpit Thumbnail Handler Uncontrolled Memory Allocation via Oversized Image Dimensions CVE Advisory https://securelayer7.net/lab/cve-2026-68584-siyuan-publish-password-auth-bypass-heading-dom SecureLayer7 en 2026-09-03T21:29:01.205Z CVE-2026-68584: SiYuan Publish Password Authentication Bypass via Unprotected Content Endpoints Security Research https://securelayer7.net/lab/cve-2026-68586-siyuan-getbacklinkdoc-publish-access-bypass SecureLayer7 en 2026-09-03T21:30:18.174Z CVE-2026-68586: SiYuan Missing Publish-Access Filter on Backlink Content Endpoints CVE Advisory https://securelayer7.net/lab/cve-2026-68587-siyuan-getheading-transaction-publish-disclosure SecureLayer7 en 2026-09-03T21:31:43.871Z CVE-2026-68587: SiYuan getHeading*Transaction Publish-Disabled Document Disclosure CVE Advisory https://securelayer7.net/lab/cve-2026-69086-siyuan-attributeview-avid-path-traversal SecureLayer7 en 2026-09-03T20:49:08.090Z CVE-2026-69086: SiYuan Attribute-View Path Traversal via Unvalidated avID CVE Advisory https://securelayer7.net/lab/cve-2026-71428-unstructured-ssrf-url-partition SecureLayer7 en 2026-09-03T17:09:04.126Z CVE-2026-71428: unstructured Full-Read SSRF via url= Parameter CVE Advisory https://securelayer7.net/lab/cve-2026-71866-orval-zod-property-name-rce SecureLayer7 en 2026-09-02T15:16:25.135Z CVE-2026-71866: orval Import-time RCE via Zod Object Property Name Injection CVE Advisory https://securelayer7.net/lab/cve-2026-72920-seaweedfs-unauthenticated-iam-grpc SecureLayer7 en 2026-09-02T14:56:13.828Z CVE-2026-72920: SeaweedFS Unauthenticated IAM gRPC Service CVE Advisory https://securelayer7.net/lab/cve-2026-72921-seaweedfs-filer-jwt-allowed-prefixes-bypass SecureLayer7 en 2026-09-02T23:56:50.403Z CVE-2026-72921: SeaweedFS Filer JWT allowed_prefixes Authorization Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-73222-claude-code-templates-studio-rce-command-injection SecureLayer7 en 2026-09-03T20:10:23.148Z CVE-2026-73222: claude-code-templates Unauthenticated OS Command Injection (RCE) in Studio Server CVE Advisory https://securelayer7.net/lab/cve-2026-73292-semaphore-ui-csrf-password-takeover SecureLayer7 en 2026-09-03T19:30:11.523Z CVE-2026-73292: Semaphore UI CSRF Password Takeover CVE Advisory https://securelayer7.net/lab/cve-2026-73293-semaphore-ui-manager-owner-privilege-escalation-role-slug SecureLayer7 en 2026-09-03T19:29:08.482Z CVE-2026-73293: Semaphore UI Manager-to-Owner Privilege Escalation via Custom Role Slug Collision CVE Advisory https://securelayer7.net/lab/cve-2026-73841-openchoreo-cross-project-exec-wirelogs-authz-bypass SecureLayer7 en 2026-09-02T23:55:42.427Z CVE-2026-73841: OpenChoreo Cross-Project Authorization Bypass in exec and wirelogs Endpoints CVE Advisory https://securelayer7.net/lab/cve-2026-73843-openchoreo-cluster-gateway-unauthenticated-rce SecureLayer7 en 2026-09-02T23:50:20.186Z CVE-2026-73843: OpenChoreo cluster-gateway Unauthenticated Data-Plane RCE CVE Advisory https://securelayer7.net/lab/cve-2026-75899-fast-uri-ssrf-double-percent-decoding SecureLayer7 en 2026-09-02T15:51:46.465Z CVE-2026-75899: fast-uri SSRF via Double Hostname Percent-Decoding CVE Advisory https://securelayer7.net/lab/cve-2026-75931-fast-uri-idn-scheme-relative-host-confusion SecureLayer7 en 2026-09-02T15:49:07.232Z CVE-2026-75931: fast-uri Host Confusion via Skipped IDN Canonicalization on Scheme-Relative References CVE Advisory https://securelayer7.net/lab/cve-2026-75975-fast-uri-ipv6-ssrf-normalization SecureLayer7 en 2026-09-02T15:50:26.393Z CVE-2026-75975: fast-uri SSRF via Malformed IPv6 Normalization CVE Advisory https://securelayer7.net/lab/cve-2026-76172-fast-uri-scheme-host-confusion SecureLayer7 en 2026-09-02T15:54:49.588Z CVE-2026-76172: fast-uri Host Confusion via Percent-Encoded Scheme Normalization CVE Advisory https://securelayer7.net/lab/cve-2026-77465-toml-node-uncontrolled-recursion-dos SecureLayer7 en 2026-09-03T21:09:40.258Z CVE-2026-77465: toml Uncontrolled Recursion (DoS) CVE Advisory https://securelayer7.net/lab/cve-2026-79921-amqp091-go-frame-max-memory-exhaustion SecureLayer7 en 2026-09-03T20:30:01.194Z CVE-2026-79921: amqp091-go Broker-Controlled Memory Exhaustion via Oversized Frame CVE Advisory https://securelayer7.net/lab/cve-2026-80206-nltk-tgrep-redos-user-regex SecureLayer7 en 2026-09-02T15:17:40.652Z CVE-2026-80206: nltk tgrep ReDoS via User-Supplied Regex Security Research https://securelayer7.net/lab/cve-2026-81726-nltk-model-artifact-pathsec-bypass SecureLayer7 en 2026-09-02T15:11:45.204Z CVE-2026-81726: NLTK Model-Artifact APIs Path Traversal Bypass (pathsec sandbox escape) CVE Advisory https://securelayer7.net/lab/cve-2026-81891-elfinder-zip-extract-mime-bypass-rce SecureLayer7 en 2026-09-02T14:51:16.647Z CVE-2026-81891: elFinder ZIP Extraction MIME Filter Bypass Leading to RCE CVE Advisory https://securelayer7.net/lab/cve-2026-81892-easyadmin-routename-access-control-bypass SecureLayer7 en 2026-09-02T14:48:57.457Z CVE-2026-81892: EasyAdmin Custom-Action Dispatcher Authorization Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-82392-pnpm-virtual-store-lockfile-path-traversal SecureLayer7 en 2026-09-02T15:04:36.232Z CVE-2026-82392: pnpm Virtual Store Linker Path Traversal via Crafted Lockfile CVE Advisory https://securelayer7.net/lab/cve-2026-82393-pnpm-scoped-name-path-traversal-arbitrary-file-write SecureLayer7 en 2026-09-02T15:10:13.604Z CVE-2026-82393: pnpm Scoped-Name Path Traversal Arbitrary File Write CVE Advisory https://securelayer7.net/lab/cve-2026-82397-tornado-urlencoded-max-num-fields-dos SecureLayer7 en 2026-09-02T14:50:03.611Z CVE-2026-82397: tornado Urlencoded Body Parsing DoS via Unbounded Field Count CVE Advisory https://securelayer7.net/lab/cve-2026-82404-toon-format-prototype-pollution-decode SecureLayer7 en 2026-09-03T20:09:05.457Z CVE-2026-82404: @toon-format/toon Prototype Pollution via Untrusted Decode CVE Advisory https://securelayer7.net/lab/cve-2026-84366-scrapy-s3downloadhandler-plaintext-aws-credentials SecureLayer7 en 2026-09-02T23:08:58.117Z CVE-2026-84366: Scrapy S3DownloadHandler Cleartext Transmission of AWS Credentials CVE Advisory https://securelayer7.net/lab/siyuan-svg-sanitizer-bypass-xss-desc-style-parser-mismatch SecureLayer7 en 2026-09-03T15:09:04.894Z SiYuan: Stored and Reflected XSS via SVG Sanitizer Bypass (HTML/XML Parser Mismatch) Security Research