https://blog.securelayer7.net/life-at-securelayer7-pranav-khune/ SecureLayer7 en 2026-07-24T20:08:26.000Z Life at SecureLayer7: Notes From the 2026 Employee of the Year Security News https://blog.securelayer7.net/januscape-linux-kvm-vulnerability/ SecureLayer7 en 2026-07-24T07:42:24.000Z Januscape: A 16-Year-Old Field-Comparison Bug in the Linux KVM Shadow MMU CVE Advisory https://securelayer7.net/lab/anephenix-hub-websocket-rpc-resource-exhaustion SecureLayer7 en 2026-07-24T22:09:42.905Z @anephenix/hub WebSocket RPC Waiter Resource Exhaustion Security Research https://securelayer7.net/lab/authjs-email-homoglyph-unicode-at-bypass-account-takeover SecureLayer7 en 2026-07-23T14:48:57.279Z Auth.js (@auth/core): Email Magic-Link Homoglyph Bypass Leading to Account Takeover Security Research https://securelayer7.net/lab/better-auth-pre-account-hijacking-magic-link-email-otp SecureLayer7 en 2026-07-24T15:51:27.065Z better-auth Pre-Account Hijacking via Magic-Link and Email-OTP Sign-In Security Research https://securelayer7.net/lab/better-auth-stripe-cross-org-billing-authorization-bypass SecureLayer7 en 2026-07-24T16:09:36.519Z @better-auth/stripe: Cross-Organization Billing Authorization Bypass Security Research https://securelayer7.net/lab/blaze-server-chunked-trailer-header-injection SecureLayer7 en 2026-07-24T22:28:38.450Z blaze-server HTTP/1.1 Chunked Trailer Header Injection Security Research https://securelayer7.net/lab/budibase-app-scoped-builder-privilege-escalation-roles-assign SecureLayer7 en 2026-07-24T22:30:45.779Z Budibase: App-Scoped Builder Privilege Escalation via Public Role Assignment API Security Research https://securelayer7.net/lab/budibase-dns-rebinding-ssrf-openapi-rest-query SecureLayer7 en 2026-07-24T22:18:05.055Z Budibase: DNS Rebinding SSRF Bypass in OpenAPI Import and REST Query Execution Security Research https://securelayer7.net/lab/budibase-email-change-idor-account-takeover-accountid-not-validated SecureLayer7 en 2026-07-24T22:24:03.637Z Budibase Email Change IDOR Allows Full Account Takeover via POST /api/v2/email Security Research https://securelayer7.net/lab/budibase-mongodb-nosql-operator-injection-filter-bypass SecureLayer7 en 2026-07-24T22:23:01.235Z Budibase MongoDB Integration NoSQL Operator Injection Security Research https://securelayer7.net/lab/budibase-mongodb-tls-path-filesystem-read-oracle SecureLayer7 en 2026-07-24T21:43:55.695Z Budibase MongoDB Datasource Filesystem Read Oracle via Unvalidated TLS Certificate Paths Security Research https://securelayer7.net/lab/budibase-mysql-describe-backtick-sql-injection-multiplestatements SecureLayer7 en 2026-07-24T21:28:39.821Z Budibase MySQL DESCRIBE Backtick Injection via multipleStatements Security Research https://securelayer7.net/lab/budibase-mysql-multiplestatements-sql-injection SecureLayer7 en 2026-07-24T21:44:56.632Z Budibase MySQL Integration SQL Injection via multipleStatements Security Research https://securelayer7.net/lab/budibase-oidc-sso-account-takeover-email-verified-bypass SecureLayer7 en 2026-07-24T21:36:07.547Z Budibase OIDC SSO Account Takeover via Unverified Email Claim Security Research https://securelayer7.net/lab/budibase-rest-datasource-ssrf-dns-rebinding-undici-dispatcher SecureLayer7 en 2026-07-24T22:21:52.854Z Budibase REST Datasource SSRF via DNS Rebinding (undici dispatcher bypasses IP pin) Security Research https://securelayer7.net/lab/budibase-rest-datasource-unauthenticated-credential-theft-cross-origin-query-pat SecureLayer7 en 2026-07-24T21:34:53.181Z Budibase REST Datasource Unauthenticated Credential Theft via Cross-Origin Query Path Security Research https://securelayer7.net/lab/budibase-s3-presigned-url-authorization-regression-basic-user-escalation SecureLayer7 en 2026-07-24T21:42:38.984Z Budibase S3 Presigned URL Authorization Regression (BASIC User Escalation) Security Research https://securelayer7.net/lab/budibase-server-nosql-injection-mongodb-query-parameter-interpolation SecureLayer7 en 2026-07-24T21:29:51.404Z @budibase/server NoSQL Injection via MongoDB Query Parameter Interpolation Security Research https://securelayer7.net/lab/budibase-unauthenticated-tenant-user-info-disclosure SecureLayer7 en 2026-07-24T21:30:56.964Z Budibase Unauthenticated Tenant User Information Disclosure Security Research https://securelayer7.net/lab/cve-2026-14257-brace-expansion-unbounded-expansion-oom-dos SecureLayer7 en 2026-07-24T21:54:46.720Z CVE-2026-14257: brace-expansion Unbounded Expansion Length DoS (OOM Crash) CVE Advisory https://securelayer7.net/lab/cve-2026-15074-fastify-static-route-guard-bypass-dot-dot-path-traversal SecureLayer7 en 2026-07-24T16:49:43.911Z CVE-2026-15074: @fastify/static Route Guard Bypass via Dot-Dot Path Traversal CVE Advisory https://securelayer7.net/lab/cve-2026-16584-aws-api-mcp-server-policy-bypass-init-failure SecureLayer7 en 2026-07-24T23:12:09.454Z CVE-2026-16584: AWS API MCP Server Security Policy Bypass via Startup Initialization Failure CVE Advisory https://securelayer7.net/lab/cve-2026-16756-aws-smithy-http-server-slowloris-dos SecureLayer7 en 2026-07-24T22:52:16.432Z CVE-2026-16756: aws-smithy-http-server Slowloris Denial of Service CVE Advisory https://securelayer7.net/lab/cve-2026-16796-bedrock-agentcore-install-packages-argument-injection SecureLayer7 en 2026-07-24T22:50:03.750Z CVE-2026-16796: bedrock-agentcore Argument Injection in install_packages() CVE Advisory https://securelayer7.net/lab/cve-2026-25800-quinn-proto-assembler-memory-exhaustion SecureLayer7 en 2026-07-24T14:15:06.684Z CVE-2026-25800: quinn-proto Unbounded Stream Reassembly Memory Exhaustion Security Research https://securelayer7.net/lab/cve-2026-33413-etcd-watch-withfromkey-rbac-bypass SecureLayer7 en 2026-07-24T23:21:57.727Z CVE-2026-33413: etcd Watch API RBAC Authorization Bypass via Open-Ended Range Security Research https://securelayer7.net/lab/cve-2026-44907-react-server-dom-webpack-dos-server-functions SecureLayer7 en 2026-07-24T22:31:55.794Z CVE-2026-44907: react-server-dom-webpack Denial of Service in Server Functions CVE Advisory https://securelayer7.net/lab/cve-2026-45623-postcss-sourcemappingurl-arbitrary-file-read SecureLayer7 en 2026-07-23T15:08:12.038Z CVE-2026-45623: PostCSS Arbitrary File Read via sourceMappingURL Path Traversal CVE Advisory https://securelayer7.net/lab/cve-2026-47219-find-my-way-http2-prototype-dos SecureLayer7 en 2026-07-23T19:48:58.909Z CVE-2026-47219: find-my-way Prototype Property Lookup DoS via HTTP/2 Method CVE Advisory https://securelayer7.net/lab/cve-2026-50132-budibase-chat-link-handoff-csrf-identity-confusion SecureLayer7 en 2026-07-24T22:16:44.402Z CVE-2026-50132: Budibase Chat-Link Handoff Identity Confusion CSRF Security Research https://securelayer7.net/lab/cve-2026-54673-builder-util-runtime-redirect-credential-leak SecureLayer7 en 2026-07-24T14:11:32.726Z CVE-2026-54673: builder-util-runtime Cross-Origin Redirect Credential Leak CVE Advisory https://securelayer7.net/lab/cve-2026-55404-yt-dlp-write-link-shortcut-injection-rce SecureLayer7 en 2026-07-24T20:48:51.059Z CVE-2026-55404: yt-dlp Shortcut File Injection Leading to Remote Code Execution CVE Advisory https://securelayer7.net/lab/cve-2026-55502-cloudreve-onedrive-oauth-scope-bypass SecureLayer7 en 2026-07-24T21:10:55.211Z CVE-2026-55502: Cloudreve Admin.Read OAuth Token Can Overwrite OneDrive Storage Policy Credentials CVE Advisory https://securelayer7.net/lab/cve-2026-55575-liquidjs-pop-filter-memorylimit-bypass SecureLayer7 en 2026-07-24T14:10:07.235Z CVE-2026-55575: LiquidJS pop Filter memoryLimit Accounting Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-55607-claude-code-git-worktree-sandbox-escape SecureLayer7 en 2026-07-24T17:05:05.510Z CVE-2026-55607: @anthropic-ai/claude-code Sandbox Escape via Git Worktree Path Confusion CVE Advisory https://securelayer7.net/lab/cve-2026-55685-react-router-manifest-dos-route-matching SecureLayer7 en 2026-07-24T14:09:01.865Z CVE-2026-55685: react-router Unauthenticated DoS via Inefficient Route Matching on Manifest Endpoint CVE Advisory https://securelayer7.net/lab/cve-2026-57516-ray-read-webdataset-pickle-rce SecureLayer7 en 2026-07-24T15:54:59.540Z CVE-2026-57516: Ray read_webdataset Arbitrary Code Execution via Default Pickle Decoder CVE Advisory https://securelayer7.net/lab/cve-2026-59214-open-webui-pyodide-same-origin-xss-rce SecureLayer7 en 2026-07-24T17:03:31.287Z CVE-2026-59214: Open WebUI Stored Web-Worker XSS via Pyodide Same-Origin Code Execution CVE Advisory https://securelayer7.net/lab/cve-2026-59216-open-webui-cross-user-socketio-session-hijack-rce SecureLayer7 en 2026-07-24T17:14:48.818Z CVE-2026-59216: Open WebUI Cross-User Code Execution via Unvalidated Socket.IO session_id CVE Advisory https://securelayer7.net/lab/cve-2026-59219-open-webui-jwt-revocation-bypass-socketio-websocket SecureLayer7 en 2026-07-24T17:02:15.874Z CVE-2026-59219: Open WebUI Insufficient Session Expiration on Realtime Endpoints CVE Advisory https://securelayer7.net/lab/cve-2026-59224-open-webui-terminal-proxy-user-id-spoofing SecureLayer7 en 2026-07-24T21:09:51.372Z CVE-2026-59224: open-webui Terminal Proxy Authentication Bypass via session_id Query Injection CVE Advisory https://securelayer7.net/lab/cve-2026-59714-open-webui-cross-channel-message-overwrite SecureLayer7 en 2026-07-24T17:09:57.767Z CVE-2026-59714: open-webui Cross-Channel Message Overwrite via Chat Completion API CVE Advisory https://securelayer7.net/lab/cve-2026-59859-kiota-php-code-injection-dollar-interpolation SecureLayer7 en 2026-07-24T16:03:16.945Z CVE-2026-59859: Microsoft.OpenApi.Kiota PHP Code Generation Literal Injection CVE Advisory https://securelayer7.net/lab/cve-2026-59860-kiota-xml-doccomment-newline-code-injection SecureLayer7 en 2026-07-24T16:11:48.872Z CVE-2026-59860: Microsoft.OpenApi.Kiota XML Doc-Comment Newline Breakout Code Injection CVE Advisory https://securelayer7.net/lab/cve-2026-59862-kiota-python-generator-enum-description-code-injection SecureLayer7 en 2026-07-24T16:04:35.490Z CVE-2026-59862: Microsoft Kiota Python Generator Code Injection via Enum Description CVE Advisory https://securelayer7.net/lab/cve-2026-59863-kiota-workspace-outputpath-path-traversal SecureLayer7 en 2026-07-24T16:44:17.915Z CVE-2026-59863: Microsoft Kiota workspace.json Path Traversal to Arbitrary File Write CVE Advisory https://securelayer7.net/lab/cve-2026-59864-kiota-plugin-static-template-path-traversal SecureLayer7 en 2026-07-24T16:01:49.195Z CVE-2026-59864: Microsoft.OpenApi.Kiota Path Traversal via x-ai-* OpenAPI Extensions CVE Advisory https://securelayer7.net/lab/cve-2026-59865-kiota-command-injection-dependency-install-command SecureLayer7 en 2026-07-24T16:38:12.237Z CVE-2026-59865: Microsoft Kiota Command Injection via x-ms-kiota-info dependencyInstallCommand CVE Advisory https://securelayer7.net/lab/cve-2026-59866-kiota-x-ms-kiota-info-path-traversal-code-injection SecureLayer7 en 2026-07-24T16:43:02.764Z CVE-2026-59866: Microsoft Kiota Arbitrary File Write and Code Injection via x-ms-kiota-info CVE Advisory https://securelayer7.net/lab/cve-2026-59867-kiota-openapi-ref-ssrf-lfi-rfi SecureLayer7 en 2026-07-24T17:24:09.750Z CVE-2026-59867: Microsoft Kiota SSRF and Local File Inclusion via Unrestricted OpenAPI $ref Resolution CVE Advisory https://securelayer7.net/lab/cve-2026-59931-phpspreadsheet-webservice-ssrf-redirect-bypass SecureLayer7 en 2026-07-23T15:10:14.158Z CVE-2026-59931: PHPSpreadsheet SSRF Whitelist Bypass via HTTP Redirect in WEBSERVICE() CVE Advisory https://securelayer7.net/lab/cve-2026-59932-phpspreadsheet-gnumeric-gzip-bomb-dos SecureLayer7 en 2026-07-23T15:09:39.960Z CVE-2026-59932: PHPSpreadsheet Gnumeric Reader Gzip Bomb (DoS) CVE Advisory https://securelayer7.net/lab/cve-2026-59933-phpspreadsheet-ole-sector-chain-infinite-loop-dos SecureLayer7 en 2026-07-23T15:08:55.657Z CVE-2026-59933: PHPSpreadsheet OLE Sector-Chain Infinite Loop (DoS) CVE Advisory https://securelayer7.net/lab/cve-2026-59935-pypdf-infinite-loop-ascii85-asciihex-inline-image SecureLayer7 en 2026-07-23T16:48:07.924Z CVE-2026-59935: pypdf Infinite Loop via Unterminated ASCII85/ASCIIHex Inline Image CVE Advisory https://securelayer7.net/lab/cve-2026-59936-pypdf-infinite-loop-inline-image SecureLayer7 en 2026-07-23T16:48:46.288Z CVE-2026-59936: pypdf Infinite Loop via Unterminated Inline Image CVE Advisory https://securelayer7.net/lab/cve-2026-59939-httplib2-decompression-bomb-dos SecureLayer7 en 2026-07-24T15:29:12.786Z CVE-2026-59939: httplib2 Decompression Bomb Denial of Service CVE Advisory https://securelayer7.net/lab/cve-2026-59940-seroval-fromjson-promise-resolver-type-confusion SecureLayer7 en 2026-07-24T17:22:54.461Z CVE-2026-59940: seroval fromJSON() Promise Resolver Type Confusion CVE Advisory https://securelayer7.net/lab/cve-2026-62263-openam-webauthn-objectinputfilter-depth-bypass-rce SecureLayer7 en 2026-07-24T23:24:32.600Z CVE-2026-62263: OpenAM WebAuthn ObjectInputFilter depth>1 Deserialization RCE CVE Advisory https://securelayer7.net/lab/cve-2026-62379-openam-authxmlutils-unsafe-reflection-rce SecureLayer7 en 2026-07-24T23:17:52.339Z CVE-2026-62379: OpenAM Unauthenticated Remote Code Execution via Unsafe Reflection in AuthXMLUtils CVE Advisory https://securelayer7.net/lab/etcd-tls-listener-unbounded-handshake-goroutine-dos SecureLayer7 en 2026-07-24T22:48:52.955Z etcd tlsListener Unbounded TLS Handshake Goroutine DoS Security Research https://securelayer7.net/lab/frp-ssh-tunnel-gateway-integer-overflow-dos SecureLayer7 en 2026-07-24T21:57:43.444Z frp SSH Tunnel Gateway Unauthenticated Remote Denial of Service via Integer Overflow Security Research https://securelayer7.net/lab/gitpython-clone-template-hook-rce SecureLayer7 en 2026-07-24T17:16:00.550Z GitPython: OS Command Injection via --template in clone_from Security Research https://securelayer7.net/lab/gitpython-config-section-name-injection-sshcommand-rce SecureLayer7 en 2026-07-24T16:31:08.721Z GitPython: git-config section-name injection leads to core.sshCommand RCE Security Research https://securelayer7.net/lab/gitpython-create-remote-env-var-exfiltration-incomplete-fix SecureLayer7 en 2026-07-24T22:10:51.082Z GitPython Environment-Variable Exfiltration via Repo.create_remote() URL Security Research https://securelayer7.net/lab/gitpython-diffable-diff-argument-injection-file-overwrite SecureLayer7 en 2026-07-24T17:21:33.200Z GitPython Argument Injection via Diffable.diff Enables Arbitrary File Overwrite Security Research https://securelayer7.net/lab/gitpython-kwarg-value-token-smuggling-os-command-injection SecureLayer7 en 2026-07-24T16:50:55.764Z GitPython: OS Command Injection via Single-Character Kwarg Value Token Smuggling Security Research https://securelayer7.net/lab/http4s-blaze-server-http1-request-smuggling-parser-laxities SecureLayer7 en 2026-07-24T22:29:28.398Z http4s-blaze-server HTTP/1.1 Request Smuggling (Multiple Parser Laxities) Security Research https://securelayer7.net/lab/http4s-blaze-server-websocket-unbounded-aggregation-dos SecureLayer7 en 2026-07-24T23:16:36.022Z http4s-blaze-server Unbounded WebSocket Message Aggregation DoS Security Research https://securelayer7.net/lab/js-yaml-exponential-dos-nested-flow-collections SecureLayer7 en 2026-07-24T16:57:18.901Z js-yaml: Exponential Parsing DoS via Nested Flow Collections Security Research https://securelayer7.net/lab/kin-openapi-validation-handler-fail-open-auth-bypass SecureLayer7 en 2026-07-24T16:56:14.289Z kin-openapi: ValidationHandler Fail-Open Authentication Bypass Security Research https://securelayer7.net/lab/netty-codec-xml-xmlframedecoder-cpu-exhaustion-dos SecureLayer7 en 2026-07-24T16:55:04.264Z netty-codec-xml XmlFrameDecoder Denial of Service via CPU Exhaustion Security Research https://securelayer7.net/lab/oh-my-posh-template-injection-path-rce SecureLayer7 en 2026-07-24T23:09:34.401Z Oh My Posh: Arbitrary Command Execution via Template Injection in Path Segment Security Research https://securelayer7.net/lab/omnifaces-forged-resource-id-xss-push-replay SecureLayer7 en 2026-07-24T23:10:54.777Z OmniFaces: Forged Resource IDs, XSS via o:hashParam, and Push-Channel Replay Security Research https://securelayer7.net/lab/opendj-dsml-anyuri-ssrf-file-read-dos SecureLayer7 en 2026-07-24T21:50:38.708Z OpenDJ DSMLv2 Gateway Unauthenticated SSRF and Local File Read Security Research https://securelayer7.net/lab/opendj-sasl-plain-authzid-proxy-aci-bypass SecureLayer7 en 2026-07-24T21:49:15.065Z OpenDJ SASL PLAIN authzid Proxy ACI Authorization Bypass Security Research https://securelayer7.net/lab/openlist-batch-rename-src-name-path-traversal SecureLayer7 en 2026-07-24T23:23:02.663Z OpenList Authenticated Path Traversal in Batch Rename src_name Security Research https://securelayer7.net/lab/pheditor-authentication-bypass-forced-password-change SecureLayer7 en 2026-07-24T22:05:05.570Z Pheditor: Authentication Bypass in Forced Password-Change Flow Security Research https://securelayer7.net/lab/pheditor-terminal-allowlist-bypass-argument-injection-rce SecureLayer7 en 2026-07-24T21:51:46.049Z Pheditor Terminal Command-Allowlist Bypass via Argument Injection (RCE) Security Research https://securelayer7.net/lab/postcss-sourcemappingurl-path-traversal-map-file-disclosure SecureLayer7 en 2026-07-24T16:28:37.488Z PostCSS Path Traversal via sourceMappingURL Leads to Arbitrary .map File Disclosure Security Research https://securelayer7.net/lab/poweradmin-api-broken-access-control-password-reset-privilege-escalation SecureLayer7 en 2026-07-24T22:04:02.811Z Poweradmin: API Broken Access Control Allows Non-Admin to Reset Any User's Password Security Research https://securelayer7.net/lab/poweradmin-idor-broken-access-control-dns-record-edit SecureLayer7 en 2026-07-24T22:02:53.716Z Poweradmin: IDOR Broken Access Control in DNS Record Edit Security Research https://securelayer7.net/lab/poweradmin-oidc-sub-collation-bypass-account-takeover SecureLayer7 en 2026-07-24T22:01:47.188Z Poweradmin OIDC sub Collation Bypass Account Takeover Security Research https://securelayer7.net/lab/prompty-core-nunjucks-ssti-rce-constructor-prototype SecureLayer7 en 2026-07-24T16:29:50.037Z @prompty/core Server-Side Template Injection to Remote Code Execution Security Research https://securelayer7.net/lab/py-libp2p-yamux-oversized-data-frame-dos SecureLayer7 en 2026-07-24T22:55:23.169Z py-libp2p yamux connection DoS via oversized DATA frame Security Research https://securelayer7.net/lab/react-router-rsc-csrf-bypass-action-execution SecureLayer7 en 2026-07-24T17:11:17.727Z react-router RSC Mode CSRF Bypass () Security Research https://securelayer7.net/lab/shescape-quadratic-dos-flag-protection-redos SecureLayer7 en 2026-07-24T22:58:13.970Z Shescape: Quadratic-Time Denial of Service in Flag Protection Security Research https://securelayer7.net/lab/shescape-shell-injection-windows-cmd-parentheses SecureLayer7 en 2026-07-24T23:04:38.011Z shescape: Shell Injection via Unescaped Parentheses on Windows CMD Security Research https://securelayer7.net/lab/sm-crypto-predictable-sm2-key-generation-weak-prng-nodejs SecureLayer7 en 2026-07-24T21:55:56.303Z sm-crypto: Predictable SM2 Key Generation via Weak PRNG in Node.js Security Research https://securelayer7.net/lab/vantage6-algorithm-store-incorrect-authorization-edit-endpoint SecureLayer7 en 2026-07-24T22:08:35.239Z vantage6 Algorithm Store: Incorrect Authorization on Algorithm Edit Endpoint Security Research https://securelayer7.net/lab/velocityjs-rce-property-read-function-constructor-bypass SecureLayer7 en 2026-07-24T16:35:04.341Z Velocityjs Remote Code Execution via Property-Read to Function Constructor Security Research