https://blog.securelayer7.net/kubernetes-security-risks/ SecureLayer7 en 2026-09-17T11:14:48.000Z Top Kubernetes Security Risks: Vulnerabilities and Fixes Security News https://blog.securelayer7.net/cve-2026-45659-sharepoint-deserialization-rce/ SecureLayer7 en 2026-09-16T10:03:21.000Z CVE-2026-45659: SharePoint Authenticated Deserialization RCE CVE Advisory https://blog.securelayer7.net/aws-security-issues/ SecureLayer7 en 2026-09-16T06:58:48.000Z AWS Security Issues: Top Risks and How to Fix Them Security News https://securelayer7.net/lab/cve-2025-59953-lmdeploy-zmq-rpc-pickle-rce SecureLayer7 en 2026-09-16T15:50:03.338Z CVE-2025-59953: lmdeploy Remote Code Execution via Pickle Deserialization in AsyncRPCServer CVE Advisory https://securelayer7.net/lab/cve-2026-61560-mcp-gitlab-unauthenticated-file-read-pat-exfiltration SecureLayer7 en 2026-09-16T14:11:23.599Z CVE-2026-61560: @zereight/mcp-gitlab Unauthenticated Arbitrary File Read via Path Traversal CVE Advisory https://securelayer7.net/lab/cve-2026-61590-djust-observability-endpoints-missing-auth SecureLayer7 en 2026-09-16T14:10:16.163Z CVE-2026-61590: djust Unauthenticated Observability Endpoint Exposure CVE Advisory https://securelayer7.net/lab/cve-2026-61591-djust-unsigned-state-snapshot-privilege-escalation SecureLayer7 en 2026-09-16T22:10:18.550Z CVE-2026-61591: djust Unsigned State Snapshot Privilege Escalation CVE Advisory https://securelayer7.net/lab/cve-2026-61592-djust-sse-session-hijack-client-controlled-session-id SecureLayer7 en 2026-09-16T22:11:22.786Z CVE-2026-61592: djust SSE Session Hijack via Client-Controlled session_id CVE Advisory https://securelayer7.net/lab/cve-2026-61593-djust-sse-csrf-origin-bypass SecureLayer7 en 2026-09-16T15:49:02.340Z CVE-2026-61593: djust Cross-Site Request Forgery via Server-Sent Events Transport CVE Advisory https://securelayer7.net/lab/cve-2026-61595-djust-websocket-sse-tenant-isolation-fail-open SecureLayer7 en 2026-09-16T15:51:18.196Z CVE-2026-61595: djust Multi-Tenant Isolation Fails Open on WebSocket/SSE Path CVE Advisory https://securelayer7.net/lab/cve-2026-63126-wire-runtime-integer-overflow-protobuf-dos SecureLayer7 en 2026-09-17T15:10:46.653Z CVE-2026-63126: wire-runtime 32-bit Integer Overflow in ByteArrayProtoReader32 CVE Advisory https://securelayer7.net/lab/cve-2026-63127-rmcp-oauth-resource-metadata-spoofing SecureLayer7 en 2026-09-16T22:31:25.440Z CVE-2026-63127: rmcp OAuth Protected Resource Metadata Spoofing CVE Advisory https://securelayer7.net/lab/cve-2026-63128-rmcp-streamable-http-session-leak-dos SecureLayer7 en 2026-09-16T22:30:18.351Z CVE-2026-63128: rmcp Streamable HTTP Unauthenticated Session-Table Memory Leak CVE Advisory https://securelayer7.net/lab/cve-2026-63459-vendure-dashboard-stored-xss-innerhtml SecureLayer7 en 2026-09-17T15:48:21.698Z CVE-2026-63459: @vendure/dashboard Stored XSS via innerHTML in Admin Dashboard CVE Advisory https://securelayer7.net/lab/cve-2026-63460-vendure-redos-sqlite-regex-filter SecureLayer7 en 2026-09-17T15:30:14.618Z CVE-2026-63460: Vendure Unauthenticated ReDoS via SQLite Regex Filter CVE Advisory https://securelayer7.net/lab/cve-2026-63472-vendure-external-auth-account-takeover SecureLayer7 en 2026-09-17T15:29:41.763Z CVE-2026-63472: @vendure/core External Authentication Account Takeover CVE Advisory https://securelayer7.net/lab/cve-2026-63506-tinacms-auth-cross-tenant-authorization-bypass SecureLayer7 en 2026-09-17T15:08:51.498Z CVE-2026-63506: @tinacms/auth Cross-Tenant Authorization Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-63671-nuxtjs-mdc-xlink-href-iframe-xss SecureLayer7 en 2026-09-16T22:29:05.865Z CVE-2026-63671: @nuxtjs/mdc SVG xlink:href and iframe data:text/html XSS CVE Advisory https://securelayer7.net/lab/cve-2026-65608-grav-flexdirectory-unsafe-reflection-rce SecureLayer7 en 2026-09-17T17:50:00.369Z CVE-2026-65608: Grav FlexDirectory Unsafe Reflection RCE CVE Advisory https://securelayer7.net/lab/cve-2026-68523-fulgur-unbounded-page-slicing-dos SecureLayer7 en 2026-09-17T19:09:14.420Z CVE-2026-68523: fulgur Unbounded Page Slicing Denial of Service CVE Advisory https://securelayer7.net/lab/cve-2026-68904-node-opcua-transport-tcp-socket-leak-fin-wait-2 SecureLayer7 en 2026-09-16T16:29:14.726Z CVE-2026-68904: node-opcua-transport TCP Socket Leak via Keepalive Reconnection Loop CVE Advisory https://securelayer7.net/lab/cve-2026-69089-grav-cms-watermark-path-traversal-file-disclosure SecureLayer7 en 2026-09-17T17:29:53.514Z CVE-2026-69089: Grav CMS Path Traversal via ImageMedium::watermark() CVE Advisory https://securelayer7.net/lab/cve-2026-69197-umbraco-delivery-api-protected-content-disclosure-expansion SecureLayer7 en 2026-09-17T16:49:57.739Z CVE-2026-69197: Umbraco.Cms Delivery API Protected Content Disclosure via Property Expansion CVE Advisory https://securelayer7.net/lab/cve-2026-71538-cyclonedx-npm-windows-shell-injection-workspace SecureLayer7 en 2026-09-17T15:29:01.372Z CVE-2026-71538: @cyclonedx/cyclonedx-npm Windows Shell Injection via --workspace CVE Advisory https://securelayer7.net/lab/cve-2026-72695-grav-mediauploadtrait-deletefile-path-traversal SecureLayer7 en 2026-09-17T20:48:33.329Z CVE-2026-72695: Grav CMS Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion CVE Advisory https://securelayer7.net/lab/cve-2026-72819-grav-cms-rce-zip-upload-flex-objects SecureLayer7 en 2026-09-17T21:08:39.939Z CVE-2026-72819: Grav CMS Remote Code Execution via ZIP Upload CVE Advisory https://securelayer7.net/lab/cve-2026-73247-kestra-ssrf-pebble-http-function SecureLayer7 en 2026-09-17T17:49:17.358Z CVE-2026-73247: Kestra Unauthenticated SSRF via Pebble http() Function CVE Advisory https://securelayer7.net/lab/cve-2026-74907-grav-path-traversal-plugin-asset-map SecureLayer7 en 2026-09-17T21:11:29.143Z CVE-2026-74907: Grav CMS Unauthenticated Path Traversal via plugin-asset-map.php CVE Advisory https://securelayer7.net/lab/cve-2026-75513-marten-linq-dictionary-key-sql-injection SecureLayer7 en 2026-09-17T15:28:28.363Z CVE-2026-75513: Marten LINQ Provider SQL Injection via Unescaped Dictionary Key CVE Advisory https://securelayer7.net/lab/cve-2026-75516-rabbitmq-java-client-framemax-oom-dos SecureLayer7 en 2026-09-17T15:11:51.251Z CVE-2026-75516: RabbitMQ Java Client Frame-Level OOM via Math.min with Unlimited Frame Size CVE Advisory https://securelayer7.net/lab/cve-2026-75827-grav-blueprint-error-log-arbitrary-file-write SecureLayer7 en 2026-09-17T21:09:59.860Z CVE-2026-75827: Grav CMS Arbitrary File Write via Blueprint error_log Injection CVE Advisory https://securelayer7.net/lab/cve-2026-75837-grav-group-blueprint-privilege-escalation SecureLayer7 en 2026-09-17T21:09:15.697Z CVE-2026-75837: Grav Group Blueprint Missing Authorization Allows Privilege Escalation to Super-Admin CVE Advisory https://securelayer7.net/lab/cve-2026-77404-amqp091-go-tls-path-query-parameter-injection SecureLayer7 en 2026-09-17T18:10:42.256Z CVE-2026-77404: amqp091-go TLS Path Query Parameter Injection CVE Advisory https://securelayer7.net/lab/cve-2026-77405-amqp091-go-tls-minversion-downgrade SecureLayer7 en 2026-09-17T18:10:10.375Z CVE-2026-77405: amqp091-go TLS Version Downgrade via Missing MinVersion CVE Advisory https://securelayer7.net/lab/cve-2026-77406-amqp091-go-qos-signed-unsigned-overflow-dos SecureLayer7 en 2026-09-17T18:09:38.184Z CVE-2026-77406: amqp091-go Signed-to-Unsigned Integer Overflow in Qos CVE Advisory https://securelayer7.net/lab/cve-2026-77408-amqp091-go-shortstr-integer-overflow-truncation SecureLayer7 en 2026-09-17T17:50:36.641Z CVE-2026-77408: amqp091-go Silent Data Truncation via shortstr Integer Overflow CVE Advisory https://securelayer7.net/lab/cve-2026-77410-amqp091-go-oom-body-allocation SecureLayer7 en 2026-09-17T17:10:26.095Z CVE-2026-77410: amqp091-go Resource Exhaustion via Unbounded Body Buffer Allocation CVE Advisory https://securelayer7.net/lab/cve-2026-77411-amqp091-go-readlongstr-desynchronization-frame-injection SecureLayer7 en 2026-09-17T17:09:44.053Z CVE-2026-77411: amqp091-go Protocol Desynchronization via Oversized longstr CVE Advisory https://securelayer7.net/lab/cve-2026-77412-amqp091-go-negative-length-dos SecureLayer7 en 2026-09-17T17:09:06.883Z CVE-2026-77412: amqp091-go Denial of Service via Negative Byte-Array Length CVE Advisory https://securelayer7.net/lab/cve-2026-81515-steeltoe-eureka-malformed-field-registry-dos SecureLayer7 en 2026-09-17T21:36:37.771Z CVE-2026-81515: Steeltoe.Discovery.Eureka Registry Fetch DoS via Malformed Instance Fields CVE Advisory https://securelayer7.net/lab/cve-2026-81516-steeltoe-consul-secure-metadata-dos SecureLayer7 en 2026-09-17T21:31:35.946Z CVE-2026-81516: Steeltoe.Discovery.Consul Malformed 'secure' Metadata DoS CVE Advisory https://securelayer7.net/lab/cve-2026-81875-hapi-fhir-shcparser-deflate-zip-bomb-dos SecureLayer7 en 2026-09-17T21:35:22.116Z CVE-2026-81875: HAPI FHIR SHCParser Unbounded DEFLATE Decompression DoS CVE Advisory https://securelayer7.net/lab/cve-2026-82399-coredns-doh-memory-exhaustion-dos SecureLayer7 en 2026-09-17T20:50:50.799Z CVE-2026-82399: CoreDNS Unauthenticated Memory Exhaustion via Compressed DNS Section Counts CVE Advisory https://securelayer7.net/lab/cve-2026-82410-pocketbase-worker-goroutine-unhandled-panic-dos SecureLayer7 en 2026-09-17T15:10:06.918Z CVE-2026-82410: PocketBase Unhandled Panic in Worker Goroutines CVE Advisory https://securelayer7.net/lab/cve-2026-84997-reactphp-http-chunked-decoder-infinite-loop-dos SecureLayer7 en 2026-09-17T20:49:54.398Z CVE-2026-84997: react/http ChunkedDecoder Infinite Loop DoS CVE Advisory https://securelayer7.net/lab/cve-2026-85715-exifreader-iloc-dos-memory-exhaustion SecureLayer7 en 2026-09-17T16:49:11.442Z CVE-2026-85715: exifreader iloc Box Memory Exhaustion DoS CVE Advisory https://securelayer7.net/lab/cve-2026-85721-async-http-client-decompression-bomb-dos SecureLayer7 en 2026-09-17T17:28:33.466Z CVE-2026-85721: async-http-client Decompression Bomb DoS CVE Advisory https://securelayer7.net/lab/cve-2026-85731-oras-go-symlink-chain-tar-extraction-path-traversal SecureLayer7 en 2026-09-17T17:31:39.842Z CVE-2026-85731: oras-go Symlink-Chain Path Traversal in tar Extraction CVE Advisory https://securelayer7.net/lab/cve-2026-85756-sshdotnet-scpclient-command-injection-remote-path SecureLayer7 en 2026-09-17T17:29:12.267Z CVE-2026-85756: SSH.NET ScpClient OS Command Injection via Unquoted Remote Path CVE Advisory https://securelayer7.net/lab/cve-2026-86003-coredns-update-opcode-bypass-doh-doq-grpc SecureLayer7 en 2026-09-17T20:49:20.086Z CVE-2026-86003: CoreDNS Confused Deputy via RFC 2136 UPDATE over DoH/DoQ/gRPC CVE Advisory https://securelayer7.net/lab/cve-2026-86038-libp2p-gossipsub-strictsign-rsa-author-spoof SecureLayer7 en 2026-09-17T17:48:43.130Z CVE-2026-86038: @libp2p/gossipsub StrictSign RSA Peer ID Author Spoofing CVE Advisory https://securelayer7.net/lab/cve-2026-86039-libp2p-peer-store-certified-address-poisoning SecureLayer7 en 2026-09-17T18:08:24.931Z CVE-2026-86039: @libp2p/peer-store Certified Address Poisoning via Forged PeerRecord CVE Advisory https://securelayer7.net/lab/cve-2026-86043-skipper-opa-truncated-body-chunked-bypass SecureLayer7 en 2026-09-17T17:08:29.970Z CVE-2026-86043: Skipper opaAuthorizeRequestWithBody OPA Authorization Bypass via Chunked Body CVE Advisory https://securelayer7.net/lab/cve-2026-86049-jupyter-server-referer-token-log-leak SecureLayer7 en 2026-09-17T21:37:06.808Z CVE-2026-86049: jupyter_server Token Leak via Referer Header in 500 Logs CVE Advisory https://securelayer7.net/lab/djust-mark-safe-context-key-inheritance-xss SecureLayer7 en 2026-09-17T21:35:56.390Z djust: mark_safe Context Key Inheritance XSS Security Research https://securelayer7.net/lab/djust-template-autoescape-xss-six-defects SecureLayer7 en 2026-09-17T21:30:57.758Z djust: Six Template-Layer XSS Defects via Broken Auto-Escape Security Research