https://blog.securelayer7.net/cve-2026-8037-progress-loadmaster-rce/ SecureLayer7 en 2026-07-16T13:04:09.000Z CVE-2026-8037: Progress Kemp LoadMaster – Pre-Auth Root RCE CVE Advisory https://blog.securelayer7.net/vulnerability-management-lifecycle/ SecureLayer7 en 2026-07-16T10:23:06.000Z The Vulnerability Management Lifecycle: A Complete Guide Security News https://securelayer7.net/lab/arcadedb-cross-database-idor-timeseries-batch-prometheus-grafana SecureLayer7 en 2026-07-16T20:28:12.749Z ArcadeDB: Cross-Database IDOR on Time-Series, Batch, Prometheus, and Grafana Endpoints Security Research https://securelayer7.net/lab/arcadedb-javascript-trigger-rce-os-command-injection SecureLayer7 en 2026-07-16T20:29:30.905Z ArcadeDB: JavaScript Trigger OS Command Injection (RCE) Security Research https://securelayer7.net/lab/cve-2026-47142-mantisbt-history-order-sql-injection SecureLayer7 en 2026-07-15T16:48:51.316Z CVE-2026-47142: MantisBT SQL Injection via history_order Configuration Value CVE Advisory https://securelayer7.net/lab/cve-2026-47156-mantisbt-soap-api-auth-bypass-privilege-escalation SecureLayer7 en 2026-07-15T16:48:12.932Z CVE-2026-47156: MantisBT SOAP API Authentication Bypass with Privilege Escalation CVE Advisory https://securelayer7.net/lab/cve-2026-49273-mantisbt-eval-class-hoisting-rce SecureLayer7 en 2026-07-15T17:08:05.982Z CVE-2026-49273: MantisBT Remote Code Execution via eval() Class Hoisting in adm_config_set.php CVE Advisory https://securelayer7.net/lab/cve-2026-50271-ddtrace-w3c-baggage-dos SecureLayer7 en 2026-07-15T23:10:04.734Z CVE-2026-50271: ddtrace Uncontrolled Resource Consumption via W3C Baggage Header Parsing CVE Advisory https://securelayer7.net/lab/cve-2026-50272-dd-trace-baggage-extraction-dos SecureLayer7 en 2026-07-15T23:09:25.379Z CVE-2026-50272: dd-trace Unbounded W3C Baggage Extraction DoS CVE Advisory https://securelayer7.net/lab/cve-2026-50273-datadog-trace-dotnet-baggage-extraction-dos SecureLayer7 en 2026-07-15T23:08:43.574Z CVE-2026-50273: Datadog.Trace Unbounded W3C Baggage Extraction DoS CVE Advisory https://securelayer7.net/lab/cve-2026-50274-dd-trace-go-baggage-extraction-dos SecureLayer7 en 2026-07-15T23:08:04.815Z CVE-2026-50274: dd-trace-go Unbounded W3C Baggage Header Parsing DoS CVE Advisory https://securelayer7.net/lab/cve-2026-50276-dd-trace-rb-baggage-header-dos SecureLayer7 en 2026-07-15T23:30:06.379Z CVE-2026-50276: datadog (dd-trace-rb) W3C Baggage Header Denial of Service CVE Advisory https://securelayer7.net/lab/cve-2026-50285-pomerium-hpke-zstd-decompression-bomb-dos SecureLayer7 en 2026-07-15T23:29:19.793Z CVE-2026-50285: Pomerium Pre-Auth Denial of Service via HPKE Decompression Bomb CVE Advisory https://securelayer7.net/lab/cve-2026-52847-mantisbt-reflected-xss-admin-install SecureLayer7 en 2026-07-15T18:28:06.689Z CVE-2026-52847: MantisBT Reflected XSS in admin/install.php CVE Advisory https://securelayer7.net/lab/cve-2026-52869-mcp-python-sdk-session-authorization-bypass SecureLayer7 en 2026-07-16T20:09:21.547Z CVE-2026-52869: mcp (Python SDK) Session Authorization Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-52870-mcp-python-sdk-tasks-missing-authorization SecureLayer7 en 2026-07-16T20:09:50.208Z CVE-2026-52870: mcp (Python SDK) Missing Authorization on Experimental Task Handlers CVE Advisory https://securelayer7.net/lab/cve-2026-52881-mantisbt-install-php-reflected-xss SecureLayer7 en 2026-07-15T18:48:09.618Z CVE-2026-52881: MantisBT Reflected XSS in admin/install.php CVE Advisory https://securelayer7.net/lab/cve-2026-53714-envoy-gateway-xds-auth-bypass-gateway-namespace-mode SecureLayer7 en 2026-07-16T19:48:47.033Z CVE-2026-53714: Envoy Gateway xDS Authentication Bypass in GatewayNamespaceMode CVE Advisory https://securelayer7.net/lab/cve-2026-54077-arcadedb-import-database-ssrf-file-read SecureLayer7 en 2026-07-16T20:08:04.452Z CVE-2026-54077: ArcadeDB IMPORT DATABASE SSRF and Local File Read CVE Advisory https://securelayer7.net/lab/cve-2026-54447-garminconnect-world-readable-oauth-token SecureLayer7 en 2026-07-15T17:49:06.754Z CVE-2026-54447: garminconnect World-Readable OAuth Token File CVE Advisory https://securelayer7.net/lab/cve-2026-54449-langbot-mcp-stdio-command-injection-rce SecureLayer7 en 2026-07-15T17:48:37.038Z CVE-2026-54449: LangBot Authenticated RCE via MCP STDIO Command Injection CVE Advisory https://securelayer7.net/lab/cve-2026-54451-elixir-protobuf-unbounded-recursion-dos SecureLayer7 en 2026-07-15T17:48:00.893Z CVE-2026-54451: elixir-protobuf Unbounded Recursion DoS CVE Advisory https://securelayer7.net/lab/cve-2026-54457-tensorzero-gateway-file-read-ssrf SecureLayer7 en 2026-07-15T22:07:58.354Z CVE-2026-54457: TensorZero Gateway Arbitrary File Read and SSRF CVE Advisory https://securelayer7.net/lab/cve-2026-54466-websocket-driver-hixie-draft-length-header-corruption SecureLayer7 en 2026-07-15T22:28:15.142Z CVE-2026-54466: websocket-driver Hixie Draft Length Header Integer Corruption CVE Advisory https://securelayer7.net/lab/cve-2026-54493-koel-ssrf-subsonic-internet-radio SecureLayer7 en 2026-07-15T17:28:08.165Z CVE-2026-54493: Koel Authenticated Full-Read SSRF via Subsonic Radio Endpoints CVE Advisory https://securelayer7.net/lab/cve-2026-54498-view-component-around-render-xss SecureLayer7 en 2026-07-15T23:31:27.005Z CVE-2026-54498: view_component around_render HTML-Safety Bypass XSS CVE Advisory https://securelayer7.net/lab/cve-2026-54504-mcp-documentation-server-unauth-network-api-exposure SecureLayer7 en 2026-07-15T23:27:59.856Z CVE-2026-54504: @andrea9293/mcp-documentation-server Unauthenticated Network API Exposure CVE Advisory https://securelayer7.net/lab/cve-2026-55578-pheditor-terminal-command-injection-rce SecureLayer7 en 2026-07-16T20:48:02.656Z CVE-2026-55578: Pheditor OS Command Injection via Incomplete Terminal Blocklist CVE Advisory https://securelayer7.net/lab/cve-2026-55579-pheditor-hardcoded-default-password-rce SecureLayer7 en 2026-07-16T20:31:23.295Z CVE-2026-55579: Pheditor Hardcoded Default Password Enables Unauthenticated RCE CVE Advisory https://securelayer7.net/lab/cve-2026-59950-mcp-websocket-missing-origin-validation SecureLayer7 en 2026-07-16T20:30:06.334Z CVE-2026-59950: mcp WebSocket Transport Missing Origin Validation CVE Advisory https://securelayer7.net/lab/cve-2026-62944-mantisbt-stored-xss-attachment-filename-html-export SecureLayer7 en 2026-07-15T19:08:01.589Z CVE-2026-62944: MantisBT Stored XSS via Attachment Filename in HTML Export CVE Advisory https://securelayer7.net/lab/obsidian-local-rest-api-path-traversal-percent-encoded-slash-vault SecureLayer7 en 2026-07-15T22:08:32.348Z obsidian-local-rest-api: Authenticated Path Traversal via Percent-Encoded Slash in /vault/{path} Security Research