https://blog.securelayer7.net/black-hat-usa-2026-parties-events-guide/ SecureLayer7 en 2026-07-20T18:33:09.000Z Black Hat USA 2026 Parties & Events: The Complete Guide (with DEF CON 34) Security News https://securelayer7.net/lab/axios-prototype-pollution-proxy-hijack-interceptor-config SecureLayer7 en 2026-07-20T22:50:27.496Z axios Node HTTP Adapter Prototype Pollution Proxy Hijack via Interceptor Config Cloning Security Research https://securelayer7.net/lab/cve-2025-67725-tornado-httpheaders-quadratic-dos-repeated-headers SecureLayer7 en 2026-07-20T19:08:39.101Z CVE-2025-67725: Tornado HTTPHeaders Quadratic DoS via Repeated Header Coalescing CVE Advisory https://securelayer7.net/lab/cve-2025-67726-tornado-multipart-parseparam-quadratic-dos SecureLayer7 en 2026-07-20T19:08:00.383Z CVE-2025-67726: Tornado Quadratic DoS via Crafted Multipart Parameters CVE Advisory https://securelayer7.net/lab/cve-2026-13311-shell-quote-quadratic-dos-parse SecureLayer7 en 2026-07-20T22:10:33.827Z CVE-2026-13311: shell-quote Quadratic Complexity DoS in parse() CVE Advisory https://securelayer7.net/lab/cve-2026-13676-fast-uri-idn-host-confusion SecureLayer7 en 2026-07-21T19:09:32.394Z CVE-2026-13676: fast-uri IDN Host Confusion via Failed Canonicalization CVE Advisory https://securelayer7.net/lab/cve-2026-13760-aws-cdk-lib-nodejs-function-docker-command-injection SecureLayer7 en 2026-07-21T19:08:51.119Z CVE-2026-13760: aws-cdk-lib OS Command Injection via nodeModules Version Strings in Docker Bundling CVE Advisory https://securelayer7.net/lab/cve-2026-20779-gitea-totp-replay-toctou-basic-auth SecureLayer7 en 2026-07-21T22:29:38.732Z CVE-2026-20779: Gitea TOTP Passcode Capture-Replay via Basic-Auth and TOCTOU Race CVE Advisory https://securelayer7.net/lab/cve-2026-20896-gitea-docker-reverse-proxy-auth-bypass SecureLayer7 en 2026-07-21T21:10:42.189Z CVE-2026-20896: Gitea Docker Image Authentication Bypass via Spoofed X-WEBAUTH-USER Header CVE Advisory https://securelayer7.net/lab/cve-2026-24451-gitea-fork-sync-private-repo-disclosure SecureLayer7 en 2026-07-21T21:49:18.756Z CVE-2026-24451: Gitea Fork Sync Information Disclosure via merge-upstream CVE Advisory https://securelayer7.net/lab/cve-2026-27775-gitea-pre-receive-cached-branch-permission-bypass SecureLayer7 en 2026-07-21T21:48:41.961Z CVE-2026-27775: Gitea Pre-Receive Hook Authorization Bypass via Cached Branch Permission CVE Advisory https://securelayer7.net/lab/cve-2026-47300-aspnetcore-negotiate-ldap-role-elevation-of-privilege SecureLayer7 en 2026-07-21T16:29:27.094Z CVE-2026-47300: Microsoft.AspNetCore.Authentication.Negotiate Elevation of Privilege via LDAP Role Retrieval CVE Advisory https://securelayer7.net/lab/cve-2026-47302-encryptedxml-nested-dos SecureLayer7 en 2026-07-20T22:49:13.083Z CVE-2026-47302: System.Security.Cryptography.Xml EncryptedXml Denial of Service CVE Advisory https://securelayer7.net/lab/cve-2026-47303-aspnetcore-negotiate-ldap-injection-privilege-escalation SecureLayer7 en 2026-07-21T16:30:07.072Z CVE-2026-47303: Microsoft.AspNetCore.Authentication.Negotiate LDAP Injection Elevation of Privilege CVE Advisory https://securelayer7.net/lab/cve-2026-50524-dotnet-tls-handshake-dos SecureLayer7 en 2026-07-20T23:10:52.413Z CVE-2026-50524: .NET TLS Handshake Denial of Service CVE Advisory https://securelayer7.net/lab/cve-2026-50525-dotnet-encryptedxml-cipherreference-dos SecureLayer7 en 2026-07-20T23:09:01.007Z CVE-2026-50525: System.Security.Cryptography.Xml EncryptedXml Denial of Service CVE Advisory https://securelayer7.net/lab/cve-2026-50526-dotnet-build-containers-symlink-container-tampering SecureLayer7 en 2026-07-21T16:28:49.178Z CVE-2026-50526: Microsoft.NET.Build.Containers Symlink Following Allows Container Image Tampering CVE Advisory https://securelayer7.net/lab/cve-2026-50527-encryptedxml-cipherreference-stack-overflow-dos SecureLayer7 en 2026-07-21T16:08:10.076Z CVE-2026-50527: System.Security.Cryptography.Xml EncryptedXml Stack Overflow DoS CVE Advisory https://securelayer7.net/lab/cve-2026-50528-dotnet-sslstream-tls-authorization-bypass SecureLayer7 en 2026-07-20T23:09:29.070Z CVE-2026-50528: .NET SslStream TLS Authorization Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-50648-encryptedxml-nested-dos-resource-exhaustion SecureLayer7 en 2026-07-20T23:10:15.322Z CVE-2026-50648: System.Security.Cryptography.Xml EncryptedXml Denial of Service CVE Advisory https://securelayer7.net/lab/cve-2026-50650-wpf-xaml-code-injection-elevation-of-privilege SecureLayer7 en 2026-07-21T16:08:57.985Z CVE-2026-50650: WPF XAML Code Injection Elevation of Privilege CVE Advisory https://securelayer7.net/lab/cve-2026-53515-better-auth-sso-bola-register-provider SecureLayer7 en 2026-07-20T21:08:02.302Z CVE-2026-53515: @better-auth/sso Broken Object-Level Authorization on SSO Provider Registration CVE Advisory https://securelayer7.net/lab/cve-2026-54058-pillow-mcidas-oob-read-mmap-stride SecureLayer7 en 2026-07-20T23:48:47.857Z CVE-2026-54058: Pillow Out-of-Bounds Read via Undersized McIdas AREA Row Stride CVE Advisory https://securelayer7.net/lab/cve-2026-54059-pillow-pcffontfile-decompression-bomb-bypass SecureLayer7 en 2026-07-20T22:51:15.511Z CVE-2026-54059: Pillow PcfFontFile Decompression Bomb Protection Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-54060-pillow-fontfile-compile-decompression-bomb-bypass SecureLayer7 en 2026-07-20T22:30:37.778Z CVE-2026-54060: Pillow FontFile.compile() Decompression Bomb Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-54291-pgjdbc-scram-channel-binding-downgrade SecureLayer7 en 2026-07-21T18:08:08.045Z CVE-2026-54291: PostgreSQL JDBC Driver Silent SCRAM Channel-Binding Downgrade CVE Advisory https://securelayer7.net/lab/cve-2026-54481-gitea-internal-api-insecureskipverify-mitm SecureLayer7 en 2026-07-21T20:48:12.789Z CVE-2026-54481: Gitea Internal API Client Skips TLS Verification CVE Advisory https://securelayer7.net/lab/cve-2026-54560-cloudreve-oauth-scope-bypass SecureLayer7 en 2026-07-20T21:29:48.976Z CVE-2026-54560: Cloudreve OAuth Access Token Scope Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-55379-pillow-bdffontfile-decompression-bomb-bypass SecureLayer7 en 2026-07-20T22:29:50.106Z CVE-2026-55379: Pillow BdfFontFile Decompression Bomb Protection Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-55380-pillow-gdimagefile-decompression-bomb-dos SecureLayer7 en 2026-07-20T21:51:06.544Z CVE-2026-55380: Pillow GdImageFile Decompression Bomb (DoS) CVE Advisory https://securelayer7.net/lab/cve-2026-55514-vllm-mrope-prompt-embeds-dos SecureLayer7 en 2026-07-20T19:28:51.145Z CVE-2026-55514: vLLM Denial of Service via Prompt Embeds on M-RoPE Models CVE Advisory https://securelayer7.net/lab/cve-2026-55667-filebrowser-scopedfs-removeall-symlink-deletion SecureLayer7 en 2026-07-20T21:29:15.182Z CVE-2026-55667: File Browser Out-of-Scope File Deletion via Symlink-Following RemoveAll CVE Advisory https://securelayer7.net/lab/cve-2026-55987-gitea-oauth2-deactivated-account-reactivation-bypass SecureLayer7 en 2026-07-21T21:08:41.760Z CVE-2026-55987: Gitea OAuth2 Sign-In Reactivates Admin-Deactivated Accounts CVE Advisory https://securelayer7.net/lab/cve-2026-56170-aspnetcore-signalr-stateful-reconnect-dos SecureLayer7 en 2026-07-21T16:28:07.274Z CVE-2026-56170: ASP.NET Core SignalR Stateful Reconnect Denial of Service CVE Advisory https://securelayer7.net/lab/cve-2026-56654-gitea-access-token-scope-escalation SecureLayer7 en 2026-07-21T20:28:13.940Z CVE-2026-56654: Gitea Privilege Escalation via Access Token Scope Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-56750-gitea-remember-me-token-session-not-invalidated SecureLayer7 en 2026-07-21T20:29:45.704Z CVE-2026-56750: Gitea Remember-Me Token Theft Leaves Attacker Session Alive CVE Advisory https://securelayer7.net/lab/cve-2026-56755-gitea-debian-registry-dos-decompression-bomb SecureLayer7 en 2026-07-21T20:29:02.143Z CVE-2026-56755: Gitea Debian Package Registry Denial of Service via Decompression Bomb and O(N^2) String Concatenation CVE Advisory https://securelayer7.net/lab/cve-2026-57108-dotnet-runtime-x509-nameinfo-dos SecureLayer7 en 2026-07-20T22:49:48.269Z CVE-2026-57108: .NET Runtime X.509 Certificate Parsing Denial of Service CVE Advisory https://securelayer7.net/lab/cve-2026-57894-gitea-migration-ssrf-git-redirect SecureLayer7 en 2026-07-21T19:28:13.710Z CVE-2026-57894: Gitea Repository Migration SSRF via Git HTTP Redirect CVE Advisory https://securelayer7.net/lab/cve-2026-58314-gitea-ssrf-cgnat-openid SecureLayer7 en 2026-07-21T21:28:16.410Z CVE-2026-58314: Gitea SSRF via Incomplete IP Classifier and Unguarded OpenID Discovery CVE Advisory https://securelayer7.net/lab/cve-2026-58419-gitea-notification-api-private-metadata-leak SecureLayer7 en 2026-07-21T22:30:51.691Z CVE-2026-58419: Gitea Notification API Private Issue Metadata Leak After Access Revocation CVE Advisory https://securelayer7.net/lab/cve-2026-58421-gitea-codeowners-redos-regexp2-timeout SecureLayer7 en 2026-07-21T21:09:19.373Z CVE-2026-58421: Gitea CODEOWNERS ReDoS via Unbounded regexp2 Match CVE Advisory https://securelayer7.net/lab/cve-2026-58422-gitea-oauth2-callback-disabled-account-reactivation SecureLayer7 en 2026-07-21T22:30:15.821Z CVE-2026-58422: Gitea OAuth2 Callback Improper Access Control Silently Re-enables Disabled Accounts CVE Advisory https://securelayer7.net/lab/cve-2026-58423-gitea-lfs-ssh-subverb-auth-bypass SecureLayer7 en 2026-07-21T20:51:15.817Z CVE-2026-58423: Gitea LFS SSH Sub-Verb Authentication Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-58424-gitea-actions-fork-pr-approval-bypass SecureLayer7 en 2026-07-21T20:50:36.511Z CVE-2026-58424: Gitea Actions Fork PR Approval Gate Permanent Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-58426-gitea-actions-artifacts-v4-hmac-boundary-collision SecureLayer7 en 2026-07-21T20:49:57.167Z CVE-2026-58426: Gitea Actions Artifacts V4 HMAC Signature Ambiguity CVE Advisory https://securelayer7.net/lab/cve-2026-58436-gitea-accept-language-redos-underscore-bypass SecureLayer7 en 2026-07-21T21:29:04.083Z CVE-2026-58436: Gitea Locale Middleware ReDoS via Accept-Language Underscore Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-58437-gitea-repo-visibility-push-options SecureLayer7 en 2026-07-21T21:08:02.044Z CVE-2026-58437: Gitea Repository Visibility Manipulation via Git Push Options CVE Advisory https://securelayer7.net/lab/cve-2026-58439-gitea-branch-protection-bypass-pr-retarget-stale-approval SecureLayer7 en 2026-07-21T20:30:25.760Z CVE-2026-58439: Gitea Branch Protection Bypass via PR Retargeting CVE Advisory https://securelayer7.net/lab/cve-2026-59197-pillow-rankfilter-integer-overflow-heap-oob-write SecureLayer7 en 2026-07-20T23:48:06.904Z CVE-2026-59197: Pillow Heap Out-of-Bounds Write via Integer Overflow in RankFilter CVE Advisory https://securelayer7.net/lab/cve-2026-59199-pillow-heap-oob-write-paste-crop-integer-overflow SecureLayer7 en 2026-07-20T23:30:15.960Z CVE-2026-59199: Pillow Heap Out-of-Bounds Write via Signed Coordinate Overflow CVE Advisory https://securelayer7.net/lab/cve-2026-59200-pillow-pdfparser-decompression-bomb-dos SecureLayer7 en 2026-07-20T23:29:31.412Z CVE-2026-59200: Pillow PdfParser Decompression Bomb DoS CVE Advisory https://securelayer7.net/lab/cve-2026-59204-pillow-jpeg2000-tiled-decode-memory-exhaustion SecureLayer7 en 2026-07-20T23:28:47.936Z CVE-2026-59204: Pillow JPEG2000 Tiled Decode Memory Exhaustion CVE Advisory https://securelayer7.net/lab/cve-2026-59205-pillow-imagecms-heap-oob-write-mode-mismatch SecureLayer7 en 2026-07-20T23:28:09.955Z CVE-2026-59205: Pillow Controlled Heap Out-of-Bounds Write in ImageCmsTransform.apply() CVE Advisory https://securelayer7.net/lab/cve-2026-59725-engine-io-polling-connection-exhaustion-dos SecureLayer7 en 2026-07-20T22:09:58.620Z CVE-2026-59725: engine.io Polling Transport Connection Exhaustion (DoS) CVE Advisory https://securelayer7.net/lab/cve-2026-59731-astro-middleware-authorization-bypass-decode-iteration SecureLayer7 en 2026-07-20T22:08:00.647Z CVE-2026-59731: Astro Middleware Authorization Bypass via URL Decode Iteration Limit CVE Advisory https://securelayer7.net/lab/cve-2026-59869-js-yaml-merge-key-quadratic-dos SecureLayer7 en 2026-07-20T21:28:34.464Z CVE-2026-59869: js-yaml Merge-Key Chain Quadratic CPU DoS CVE Advisory https://securelayer7.net/lab/cve-2026-59874-node-tar-infinite-loop-negative-entry-size SecureLayer7 en 2026-07-20T22:09:17.085Z CVE-2026-59874: node-tar Infinite Loop via Negative Base-256 Entry Size CVE Advisory https://securelayer7.net/lab/cve-2026-59879-immutable-js-list-integer-overflow-dos SecureLayer7 en 2026-07-21T18:48:15.021Z CVE-2026-59879: Immutable.js List 32-bit Trie Overflow leading to Denial of Service CVE Advisory https://securelayer7.net/lab/cve-2026-59880-immutable-js-hash-collision-dos SecureLayer7 en 2026-07-21T19:10:14.149Z CVE-2026-59880: immutable Hash-Collision Algorithmic Complexity DoS CVE Advisory https://securelayer7.net/lab/cve-2026-59884-pyasn1-ber-long-form-tag-dos SecureLayer7 en 2026-07-21T19:30:36.685Z CVE-2026-59884: pyasn1 BER Decoder Denial of Service via Unbounded Long-Form Tag IDs CVE Advisory https://securelayer7.net/lab/cve-2026-59885-pyasn1-oid-quadratic-complexity-dos SecureLayer7 en 2026-07-21T19:29:53.692Z CVE-2026-59885: pyasn1 Quadratic Complexity OID Decoding Denial of Service CVE Advisory https://securelayer7.net/lab/cve-2026-59886-pyasn1-real-float-dos SecureLayer7 en 2026-07-21T19:28:55.818Z CVE-2026-59886: pyasn1 Uncontrolled Resource Consumption in Real Float Conversion CVE Advisory https://securelayer7.net/lab/cve-2026-59892-opentelemetry-propagator-jaeger-dos-malformed-header SecureLayer7 en 2026-07-21T19:51:33.782Z CVE-2026-59892: @opentelemetry/propagator-jaeger Denial of Service via Malformed Header CVE Advisory https://securelayer7.net/lab/cve-2026-59922-mistune-quadratic-dos-formatting-plugins SecureLayer7 en 2026-07-20T21:49:33.963Z CVE-2026-59922: mistune Quadratic Parsing DoS in Formatting Plugins CVE Advisory https://securelayer7.net/lab/cve-2026-59928-mistune-quadratic-reflink-dos SecureLayer7 en 2026-07-20T21:28:01.632Z CVE-2026-59928: mistune Quadratic-Time ReDoS via Reference-Link Definitions CVE Advisory https://securelayer7.net/lab/cve-2026-61666-websocket-driver-ruby-host-header-dos SecureLayer7 en 2026-07-21T18:48:50.000Z CVE-2026-61666: websocket-driver Denial of Service via Malformed Host Header CVE Advisory https://securelayer7.net/lab/cve-2026-61736-lightrag-cors-wildcard-credentials SecureLayer7 en 2026-07-20T21:48:51.361Z CVE-2026-61736: lightrag-hku CORS Wildcard + Credentials Any-Origin Takeover CVE Advisory https://securelayer7.net/lab/cve-2026-61740-lightrag-hardcoded-jwt-secret-auth-bypass SecureLayer7 en 2026-07-20T21:48:13.747Z CVE-2026-61740: LightRAG Authentication Bypass via Hardcoded JWT Secret and Guest Token Short-Circuit CVE Advisory https://securelayer7.net/lab/cve-2026-61835-directus-ssrf-0000-bypass-file-import SecureLayer7 en 2026-07-20T22:29:17.137Z CVE-2026-61835: Directus SSRF Protection Bypass via 0.0.0.0 in File Import CVE Advisory https://securelayer7.net/lab/cve-2026-62685-filebrowser-username-normalization-home-directory-collision SecureLayer7 en 2026-07-20T22:28:04.043Z CVE-2026-62685: File Browser Username Normalization Home Directory Collision CVE Advisory https://securelayer7.net/lab/fast-xml-parser-multiple-doctype-entity-expansion-limit-bypass SecureLayer7 en 2026-07-21T22:08:12.158Z fast-xml-parser: Repeated DOCTYPE Declarations Reset Entity Expansion Limits Security Research https://securelayer7.net/lab/gitpython-3150-clone-joined-short-option-upload-pack-bypass SecureLayer7 en 2026-07-21T19:48:46.435Z GitPython unsafe clone option gate bypass via joined short options Security Research https://securelayer7.net/lab/gitpython-clone-from-env-var-exfiltration-expandvars SecureLayer7 en 2026-07-21T22:08:47.049Z GitPython: Environment-Variable Exfiltration via Repo.clone_from() URL Security Research https://securelayer7.net/lab/gitpython-command-injection-archive-ls-remote-iter-commits SecureLayer7 en 2026-07-21T21:30:42.335Z GitPython Command Injection and Arbitrary File Overwrite via Unguarded Git Options Security Research https://securelayer7.net/lab/gitpython-command-injection-upload-pack-prefix-abbreviation-bypass SecureLayer7 en 2026-07-21T19:48:06.178Z GitPython: OS Command Injection via git long-option prefix abbreviation bypass Security Research https://securelayer7.net/lab/grpc-go-xds-rbac-auth-bypass-rapid-reset-dos-not-rule-panic SecureLayer7 en 2026-07-21T22:09:51.465Z gRPC-Go: xDS RBAC Authorization Bypass, HTTP/2 Rapid Reset DoS, and NOT-Rule Panic Security Research https://securelayer7.net/lab/jackson-core-async-parser-maxnumberlength-bypass-chunked-digits SecureLayer7 en 2026-07-21T22:10:38.998Z jackson-core Async Parser maxNumberLength Bypass via Chunked Digit Accumulation (Incomplete Fix) Security Research https://securelayer7.net/lab/sharp-libvips-gif-tiff-vips-loader-vulnerabilities-cve-2026-33327 SecureLayer7 en 2026-07-21T22:28:43.732Z sharp: Inherited libvips Vulnerabilities in GIF, TIFF, and VIPS Loaders (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591) Security Research https://securelayer7.net/lab/svgo-removescripts-xss-bypass-namespace-prefix SecureLayer7 en 2026-07-21T19:49:20.577Z svgo removeScripts Plugin XSS Bypass via Namespace Prefix and Case-Insensitive URI Security Research