https://blog.securelayer7.net/cve-2026-10520-ivanti-sentry-os-command-injection/ SecureLayer7 en 2026-09-08T14:09:45.000Z CVE-2026-10520: OS Command Injection in Ivanti Sentry MICS API Enables Pre-Auth Root Shell CVE Advisory https://securelayer7.net/lab/astro-avif-libheif-rce-heap-overflow SecureLayer7 en 2026-09-08T21:55:00.084Z Astro: Remote Code Execution via Malicious AVIF Image Optimization Security Research https://securelayer7.net/lab/cve-2026-50646-dotnet-wpf-xaml-rce-objectdataprovider SecureLayer7 en 2026-09-08T22:24:08.038Z CVE-2026-50646: .NET WPF XAML Parser Remote Code Execution CVE Advisory https://securelayer7.net/lab/cve-2026-60004-gitea-diffpatch-git-hook-rce SecureLayer7 en 2026-09-08T18:10:31.979Z CVE-2026-60004: Gitea Remote Code Execution via diffpatch Git Hook Injection CVE Advisory https://securelayer7.net/lab/cve-2026-62384-nltk-framenet-symlink-sandbox-bypass SecureLayer7 en 2026-09-08T17:10:28.916Z CVE-2026-62384: NLTK FramenetCorpusReader Symlink Sandbox Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-62815-msquic-use-after-free-path-migration-rce SecureLayer7 en 2026-09-08T20:29:11.170Z CVE-2026-62815: MsQuic (Microsoft QUIC) Use After Free Remote Code Execution CVE Advisory https://securelayer7.net/lab/cve-2026-63312-nltk-streambackedcorpusview-pathsec-bypass-file-read SecureLayer7 en 2026-09-08T15:49:36.700Z CVE-2026-63312: NLTK StreamBackedCorpusView Arbitrary File Read via pathsec.ENFORCE Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-69222-liquidjs-join-filter-memorylimit-bypass-dos SecureLayer7 en 2026-09-08T18:30:36.143Z CVE-2026-69222: LiquidJS join Filter memoryLimit Bypass (DoS) CVE Advisory https://securelayer7.net/lab/cve-2026-69522-diasymreader-native-heap-buffer-overflow-rce SecureLayer7 en 2026-09-08T22:31:06.358Z CVE-2026-69522: Microsoft.DiaSymReader.Native Heap-based Buffer Overflow RCE Security Research https://securelayer7.net/lab/cve-2026-70626-nltk-corpusreader-symlink-escape-file-read SecureLayer7 en 2026-09-08T15:29:25.193Z CVE-2026-70626: NLTK CorpusReader Symlink Escape Arbitrary File Read CVE Advisory https://securelayer7.net/lab/cve-2026-72789-siyuan-encrypted-notebook-publish-access-bypass SecureLayer7 en 2026-09-08T18:11:51.265Z CVE-2026-72789: SiYuan Encrypted Notebook Publish Access Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-73294-semaphore-git-url-argument-injection-rce SecureLayer7 en 2026-09-08T18:09:06.508Z CVE-2026-73294: Semaphore UI OS Command Injection via git_url Argument Injection CVE Advisory https://securelayer7.net/lab/cve-2026-75595-netty-sni-mtls-bypass-fragmented-clienthello SecureLayer7 en 2026-09-08T18:29:21.895Z CVE-2026-75595: Netty SslClientHelloHandler SNI mTLS Bypass via Fragmented TLS ClientHello CVE Advisory https://securelayer7.net/lab/cve-2026-75604-nextjs-windows-cache-path-traversal-rce SecureLayer7 en 2026-09-08T20:55:06.835Z CVE-2026-75604: Next.js Unauthenticated RCE via Windows Cache Path Traversal CVE Advisory https://securelayer7.net/lab/cve-2026-77037-multer-file-descriptor-leak-dos SecureLayer7 en 2026-09-08T21:42:07.940Z CVE-2026-77037: multer Denial of Service via File Descriptor Leak on Aborted Uploads CVE Advisory https://securelayer7.net/lab/cve-2026-77078-multer-rangeerror-dos-field-names SecureLayer7 en 2026-09-08T21:37:32.017Z CVE-2026-77078: multer Denial of Service via Crafted Multipart Field Names CVE Advisory https://securelayer7.net/lab/cve-2026-77634-cakephp-smtp-crlf-header-injection SecureLayer7 en 2026-09-08T22:11:23.362Z CVE-2026-77634: CakePHP SmtpTransport CRLF Header Injection CVE Advisory https://securelayer7.net/lab/cve-2026-77635-cakephp-jsonvalue-sql-injection-postgres SecureLayer7 en 2026-09-08T22:15:44.086Z CVE-2026-77635: CakePHP FunctionsBuilder::jsonValue() SQL Injection via PostgreSQL Driver CVE Advisory https://securelayer7.net/lab/cve-2026-78675-gitpython-gitmodules-include-file-disclosure SecureLayer7 en 2026-09-08T18:55:01.173Z CVE-2026-78675: GitPython Local File Content Disclosure via .gitmodules [include] Directive CVE Advisory https://securelayer7.net/lab/cve-2026-78676-gitpython-config-reserialize-rce-hookspath SecureLayer7 en 2026-09-08T18:50:50.316Z CVE-2026-78676: GitPython Multi-line Config Value RCE via Unsafe Re-serialization CVE Advisory https://securelayer7.net/lab/cve-2026-78677-gitpython-clone-separate-git-dir-path-traversal SecureLayer7 en 2026-09-08T18:49:04.255Z CVE-2026-78677: GitPython clone_from() Path Traversal via --separate-git-dir CVE Advisory https://securelayer7.net/lab/cve-2026-78681-nltk-xml-entity-expansion-dos SecureLayer7 en 2026-09-08T16:50:25.560Z CVE-2026-78681: NLTK XML Entity Expansion (Billion Laughs) DoS CVE Advisory https://securelayer7.net/lab/cve-2026-78682-nltk-pathsec-ssrf-proxy-bypass SecureLayer7 en 2026-09-08T17:05:06.858Z CVE-2026-78682: NLTK pathsec SSRF Protection Bypass via HTTP Proxy CVE Advisory https://securelayer7.net/lab/cve-2026-78683-nltk-transitionparser-pickle-rce SecureLayer7 en 2026-09-08T16:57:56.838Z CVE-2026-78683: nltk Unsafe Pickle Deserialization in TransitionParser CVE Advisory https://securelayer7.net/lab/cve-2026-79657-nltk-allowlist-pickle-rce SecureLayer7 en 2026-09-08T16:55:21.024Z CVE-2026-79657: nltk Allowlisted Pickle Loader Remote Code Execution CVE Advisory https://securelayer7.net/lab/cve-2026-79674-nltk-corpus-reader-pathsec-sandbox-bypass SecureLayer7 en 2026-09-08T17:02:31.106Z CVE-2026-79674: NLTK Corpus Reader Constructor pathsec Sandbox Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-79676-nltk-corpus-reader-symlink-bypass SecureLayer7 en 2026-09-08T17:09:11.511Z CVE-2026-79676: NLTK Corpus Readers Symlink Path Traversal (pathsec Bypass) CVE Advisory https://securelayer7.net/lab/cve-2026-80206-nltk-tgrep-redos SecureLayer7 en 2026-09-08T22:25:27.214Z CVE-2026-80206: NLTK tgrep Regular Expression Denial of Service CVE Advisory https://securelayer7.net/lab/cve-2026-81525-mongodb-php-library-namespace-injection-dot-nul SecureLayer7 en 2026-09-08T21:49:01.681Z CVE-2026-81525: mongodb/mongodb PHP Library NoSQL Namespace Injection via Dot and NUL Bytes CVE Advisory https://securelayer7.net/lab/cve-2026-82333-multer-dos-array-index-field-name SecureLayer7 en 2026-09-08T21:43:27.218Z CVE-2026-82333: multer Denial of Service via Oversized Array Index in Field Names CVE Advisory https://securelayer7.net/lab/cve-2026-83605-xmldom-setattribute-attribute-name-injection SecureLayer7 en 2026-09-08T22:17:29.569Z CVE-2026-83605: @xmldom/xmldom Attribute Name Injection via setAttribute() CVE Advisory https://securelayer7.net/lab/cve-2026-83606-xmldom-processing-instruction-redos SecureLayer7 en 2026-09-08T20:51:23.208Z CVE-2026-83606: @xmldom/xmldom Processing Instruction ReDoS CVE Advisory https://securelayer7.net/lab/cve-2026-83607-xmldom-createelement-xml-injection-xss SecureLayer7 en 2026-09-08T22:22:50.073Z CVE-2026-83607: @xmldom/xmldom Element Name Injection via createElement() CVE Advisory https://securelayer7.net/lab/cve-2026-83609-xmldom-qname-line-terminator-xml-injection SecureLayer7 en 2026-09-08T21:12:13.500Z CVE-2026-83609: @xmldom/xmldom XML Injection via Line Terminator in QName Validation CVE Advisory https://securelayer7.net/lab/cve-2026-83612-xmldom-raw-text-closing-tag-quadratic-dos SecureLayer7 en 2026-09-08T21:01:50.722Z CVE-2026-83612: @xmldom/xmldom HTML Raw-Text Closing-Tag Case Mismatch DoS CVE Advisory https://securelayer7.net/lab/cve-2026-83613-xmldom-quadratic-attribute-deduplication-dos SecureLayer7 en 2026-09-08T21:17:36.018Z CVE-2026-83613: @xmldom/xmldom Quadratic-Time Attribute Deduplication DoS CVE Advisory https://securelayer7.net/lab/cve-2026-83614-xmldom-quadratic-parsing-dos SecureLayer7 en 2026-09-08T22:09:38.064Z CVE-2026-83614: @xmldom/xmldom Quadratic-Time Parsing ReDoS (DoS) CVE Advisory https://securelayer7.net/lab/cve-2026-83615-xmldom-quadratic-memory-dos-namespace SecureLayer7 en 2026-09-08T21:25:12.905Z CVE-2026-83615: @xmldom/xmldom Quadratic Memory DoS via Namespace Nesting CVE Advisory https://securelayer7.net/lab/cve-2026-83616-xmldom-processing-instruction-target-injection SecureLayer7 en 2026-09-08T21:22:04.208Z CVE-2026-83616: @xmldom/xmldom Processing Instruction Target Injection CVE Advisory https://securelayer7.net/lab/cve-2026-83617-xmldom-requirewellformed-qname-bypass-line-terminator SecureLayer7 en 2026-09-08T21:10:03.085Z CVE-2026-83617: @xmldom/xmldom requireWellFormed QName Check Bypass via Embedded Line Terminator CVE Advisory https://securelayer7.net/lab/cve-2026-83618-xmldom-doctype-injection-multiline-bypass SecureLayer7 en 2026-09-08T21:16:17.639Z CVE-2026-83618: @xmldom/xmldom requireWellFormed DocType Injection Bypass via Embedded Line Terminator CVE Advisory https://securelayer7.net/lab/cve-2026-83619-xmldom-end-tag-whitespace-redos SecureLayer7 en 2026-09-08T21:23:58.734Z CVE-2026-83619: @xmldom/xmldom End-Tag Whitespace ReDoS CVE Advisory https://securelayer7.net/lab/cve-2026-84361-composer-perforce-rsh-command-injection SecureLayer7 en 2026-09-08T21:30:06.032Z CVE-2026-84361: Composer OS Command Injection via Malicious Perforce Source URL CVE Advisory https://securelayer7.net/lab/cve-2026-84370-svgo-removescripts-xss-namespace-bypass SecureLayer7 en 2026-09-08T22:03:26.227Z CVE-2026-84370: svgo removeScripts Plugin XSS via Namespace and Control-Character Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-84372-predis-crlf-pipeline-redis-command-injection SecureLayer7 en 2026-09-08T21:03:21.540Z CVE-2026-84372: predis/predis Redis Command Injection via CRLF Smuggling in Pipelined Commands CVE Advisory https://securelayer7.net/lab/cve-2026-84374-laravel-excel-path-traversal-file-overwrite SecureLayer7 en 2026-09-08T20:50:10.890Z CVE-2026-84374: Laravel Excel (maatwebsite/excel) Path Traversal File Overwrite CVE Advisory https://securelayer7.net/lab/cve-2026-84375-js-yaml-empty-merge-key-dos SecureLayer7 en 2026-09-08T21:51:01.720Z CVE-2026-84375: js-yaml ReDoS via Empty Merge-Key Sources CVE Advisory https://securelayer7.net/lab/cve-2026-84381-httpcore2-wss-socks5-tls-bypass SecureLayer7 en 2026-09-08T20:48:55.301Z CVE-2026-84381: httpcore2 Cleartext WebSocket Transmission via SOCKS5 Proxy CVE Advisory https://securelayer7.net/lab/cve-2026-84382-httpx2-decompression-amplification-oom SecureLayer7 en 2026-09-08T20:57:38.956Z CVE-2026-84382: httpx2 Decompression Amplification (CWE-409) CVE Advisory https://securelayer7.net/lab/cve-2026-84383-sharp-libheif-heap-buffer-overflow-avif-rce SecureLayer7 en 2026-09-08T21:31:49.199Z CVE-2026-84383: sharp Heap Buffer Overflow via Crafted AVIF/HEIC File (libheif RCE) Security Research https://securelayer7.net/lab/cve-2026-84445-grpc-go-xds-authority-header-dos SecureLayer7 en 2026-09-08T21:56:14.361Z CVE-2026-84445: gRPC-Go xDS Server Denial of Service via Missing :authority Header CVE Advisory https://securelayer7.net/lab/cve-2026-84452-winml-cli-cors-localhost-rce-trust-remote-code SecureLayer7 en 2026-09-08T21:44:51.160Z CVE-2026-84452: winml-cli CORS Wildcard Enables Localhost RCE via trust_remote_code CVE Advisory https://securelayer7.net/lab/cve-2026-85061-maplibre-gl-xss-sanitizer-bypass-namednodemap SecureLayer7 en 2026-09-08T20:56:10.577Z CVE-2026-85061: maplibre-gl XSS Sanitizer Bypass via Live NamedNodeMap Iteration CVE Advisory https://securelayer7.net/lab/nextjs-avif-image-optimization-rce-libheif-heap-overflow SecureLayer7 en 2026-09-08T22:02:08.077Z Next.js: Unauthenticated Remote Code Execution via AVIF Image Optimization (CVE-2026-84383 / libheif) Security Research https://securelayer7.net/lab/nodemailer-addressparser-quadratic-dos-address-list SecureLayer7 en 2026-09-08T21:35:12.511Z nodemailer Quadratic ReDoS in addressparser (O(n²) address-list parsing) Security Research https://securelayer7.net/lab/tiptap-core-quadratic-redos-markdown-attribute-parsing SecureLayer7 en 2026-09-08T21:52:06.344Z @tiptap/core Quadratic ReDoS in Markdown Attribute Parsing Security Research https://securelayer7.net/lab/typespec-openapi3-path-traversal-versioned-enum-output-filename SecureLayer7 en 2026-09-08T21:36:16.852Z @typespec/openapi3 Path Traversal via Versioned Enum Value in Output Filename Security Research