https://blog.securelayer7.net/external-attack-surface-management-easm/ SecureLayer7 en 2026-07-07T12:08:47.000Z External Attack Surface Management (EASM): A Practical Guide Security News https://blog.securelayer7.net/prompt-injection-attacks/ SecureLayer7 en 2026-07-07T08:26:03.000Z Prompt Injection Attacks: Risks, Examples & Prevention Security News https://securelayer7.net/lab/better-auth-scim-provider-account-takeover-missing-owner-binding SecureLayer7 en 2026-07-07T21:07:58.122Z @better-auth/scim: SCIM Provider Account Takeover via Missing Owner Binding Security Research https://securelayer7.net/lab/better-auth-stored-xss-javascript-redirect-uri-oidc-provider SecureLayer7 en 2026-07-07T21:28:53.367Z better-auth Stored XSS via javascript: redirect_uri in oidc-provider and mcp Plugins Security Research https://securelayer7.net/lab/cve-2026-27823-egroupware-smallpart-rce-auth-bypass-path-traversal SecureLayer7 en 2026-07-07T13:09:48.723Z CVE-2026-27823: EGroupware SmallPART Remote Code Execution via Auth Bypass and Path Traversal CVE Advisory https://securelayer7.net/lab/cve-2026-33655-new-api-ssrf-hostname-bypass SecureLayer7 en 2026-07-07T13:09:06.627Z CVE-2026-33655: new-api SSRF Protection Bypass via Unresolved Hostname CVE Advisory https://securelayer7.net/lab/cve-2026-34151-xwiki-skin-path-traversal-jetty12 SecureLayer7 en 2026-07-07T13:08:35.174Z CVE-2026-34151: XWiki Platform Old Core Path Traversal via /skin/ Endpoint on Jetty 12 CVE Advisory https://securelayer7.net/lab/cve-2026-40187-egroupware-etemplate-eval-rce SecureLayer7 en 2026-07-07T13:07:57.344Z CVE-2026-40187: EGroupware Authenticated RCE via eTemplate eval Injection CVE Advisory https://securelayer7.net/lab/cve-2026-49464-nl-portal-taak-idor-submittaakv2 SecureLayer7 en 2026-07-08T21:28:40.118Z CVE-2026-49464: NL Portal Taak IDOR Allows Takeover of Any User's Open Task CVE Advisory https://securelayer7.net/lab/cve-2026-49471-serena-agent-unauthenticated-dashboard-dns-rebinding-rce SecureLayer7 en 2026-07-08T21:28:07.593Z CVE-2026-49471: serena-agent Unauthenticated Flask Dashboard Enables DNS Rebinding to RCE CVE Advisory https://securelayer7.net/lab/cve-2026-49825-lxml-html-clean-xlink-href-xss SecureLayer7 en 2026-07-08T20:48:00.787Z CVE-2026-49825: lxml_html_clean javascript: XSS via xlink:href CVE Advisory https://securelayer7.net/lab/cve-2026-49832-dspace-velocity-template-injection-rce-ldn SecureLayer7 en 2026-07-08T20:28:41.209Z CVE-2026-49832: DSpace Remote Code Execution via Velocity Template Injection in LDN CVE Advisory https://securelayer7.net/lab/cve-2026-50197-skipper-opa-body-bypass-chunked-encoding SecureLayer7 en 2026-07-08T20:29:50.643Z CVE-2026-50197: Skipper opaAuthorizeRequestWithBody OPA Policy Bypass via Chunked Encoding CVE Advisory https://securelayer7.net/lab/cve-2026-52831-nuclio-cron-trigger-command-injection-rce SecureLayer7 en 2026-07-08T20:29:21.288Z CVE-2026-52831: Nuclio Cron Trigger OS Command Injection (Persistent RCE) CVE Advisory https://securelayer7.net/lab/cve-2026-53513-better-auth-sso-ssrf-oidc-endpoints SecureLayer7 en 2026-07-07T21:09:12.087Z CVE-2026-53513: @better-auth/sso SSRF via Unvalidated OIDC Endpoints CVE Advisory https://securelayer7.net/lab/cve-2026-53514-better-auth-organization-invitation-takeover-unverified-email SecureLayer7 en 2026-07-07T21:30:00.879Z CVE-2026-53514: better-auth Organization Invitation Takeover via Unverified Email Pre-Registration CVE Advisory https://securelayer7.net/lab/cve-2026-53516-better-auth-oauth-auto-link-account-takeover SecureLayer7 en 2026-07-07T21:29:27.273Z CVE-2026-53516: better-auth OAuth Auto-Link Account Takeover via Unverified Email CVE Advisory https://securelayer7.net/lab/cve-2026-53517-better-auth-oauth-provider-refresh-token-race-condition SecureLayer7 en 2026-07-07T21:09:50.634Z CVE-2026-53517: @better-auth/oauth-provider Refresh Token Family Fork via Race Condition CVE Advisory https://securelayer7.net/lab/cve-2026-53518-better-auth-oauth-provider-authorization-code-race-condition SecureLayer7 en 2026-07-07T21:08:35.275Z CVE-2026-53518: @better-auth/oauth-provider Authorization Code Race Condition Allows Duplicate Token Issuance CVE Advisory https://securelayer7.net/lab/cve-2026-53530-ratex-parser-verb-utf8-panic-dos SecureLayer7 en 2026-07-07T23:49:14.771Z CVE-2026-53530: ratex-parser Process Abort via UTF-8 Multibyte Delimiter in \verb CVE Advisory https://securelayer7.net/lab/cve-2026-53552-goploy-cross-namespace-idor-rce-project-id SecureLayer7 en 2026-07-07T23:48:43.254Z CVE-2026-53552: Goploy Cross-Namespace IDOR and RCE via Body-Controlled Project ID CVE Advisory https://securelayer7.net/lab/cve-2026-53553-goploy-path-traversal-file-read SecureLayer7 en 2026-07-07T23:47:58.046Z CVE-2026-53553: Goploy Arbitrary File Read via Path Traversal in /deploy/fileDiff CVE Advisory https://securelayer7.net/lab/cve-2026-53649-joro-unauthenticated-cross-origin-plugin-upload-rce SecureLayer7 en 2026-07-08T20:28:04.075Z CVE-2026-53649: Joro Unauthenticated Cross-Origin Plugin Upload RCE CVE Advisory