https://blog.securelayer7.net/remote-penetration-testing/ SecureLayer7 en 2026-09-18T13:30:44.000Z Remote Penetration Testing: Methods, Tools & Best Practices Security News https://blog.securelayer7.net/kubernetes-security-risks/ SecureLayer7 en 2026-09-17T11:14:48.000Z Top Kubernetes Security Risks: Vulnerabilities and Fixes Security News https://securelayer7.net/lab/cve-2025-61682-semantic-mediawiki-stored-xss-data-subtab SecureLayer7 en 2026-09-18T16:28:17.399Z CVE-2025-61682: Semantic MediaWiki Stored XSS via data-subtab Attribute CVE Advisory https://securelayer7.net/lab/cve-2025-66455-lmdeploy-distserve-pickle-rce-zmq SecureLayer7 en 2026-09-18T17:09:25.074Z CVE-2025-66455: lmdeploy Remote Code Execution via Pickle Deserialization in DistServe ZMQ Connector CVE Advisory https://securelayer7.net/lab/cve-2026-58197-toolhive-container-lateral-movement-host-docker-internal SecureLayer7 en 2026-09-18T17:50:50.579Z CVE-2026-58197: ToolHive Container Lateral Movement via host.docker.internal CVE Advisory https://securelayer7.net/lab/cve-2026-59163-mnemosyne-memory-jwt-signature-bypass SecureLayer7 en 2026-09-18T18:10:48.995Z CVE-2026-59163: mnemosyne-memory JWT Signature Verification Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-61672-capsule-forbidden-label-annotation-bypass SecureLayer7 en 2026-09-18T17:56:21.199Z CVE-2026-61672: Capsule Tenant Forbidden Metadata Enforcement Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-61682-kcp-front-proxy-x-remote-header-injection SecureLayer7 en 2026-09-18T17:51:45.170Z CVE-2026-61682: kcp Front-Proxy Identity Header Injection Authentication Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-61833-zot-bearer-token-delete-scope-bypass SecureLayer7 en 2026-09-18T17:55:35.369Z CVE-2026-61833: zot Bearer Token Scope Collapse Allows Unauthorized Manifest and Blob Deletion CVE Advisory https://securelayer7.net/lab/cve-2026-63126-wire-runtime-integer-overflow-protobuf-dos SecureLayer7 en 2026-09-17T15:10:46.653Z CVE-2026-63126: wire-runtime 32-bit Integer Overflow in ByteArrayProtoReader32 CVE Advisory https://securelayer7.net/lab/cve-2026-63199-perses-datasource-proxy-secret-disclosure SecureLayer7 en 2026-09-18T17:54:24.415Z CVE-2026-63199: Perses Datasource Proxy Cross-Scope Secret Disclosure CVE Advisory https://securelayer7.net/lab/cve-2026-63349-anyio-extra-groups-privilege-assignment SecureLayer7 en 2026-09-18T17:30:55.308Z CVE-2026-63349: anyio Incorrect Privilege Assignment in run_process / open_process CVE Advisory https://securelayer7.net/lab/cve-2026-63374-anyio-tls-idna-hostname-spoofing SecureLayer7 en 2026-09-18T17:31:43.574Z CVE-2026-63374: anyio TLS Certificate Spoofing via IDNA 2003 Hostname Encoding CVE Advisory https://securelayer7.net/lab/cve-2026-63445-perses-project-parameter-path-traversal SecureLayer7 en 2026-09-18T17:48:24.664Z CVE-2026-63445: Perses Filesystem Path Traversal via Unvalidated Project Parameter CVE Advisory https://securelayer7.net/lab/cve-2026-63458-perses-project-query-param-authorization-bypass SecureLayer7 en 2026-09-18T17:54:57.834Z CVE-2026-63458: Perses Project Query Parameter Authorization Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-63459-vendure-dashboard-stored-xss-innerhtml SecureLayer7 en 2026-09-17T15:48:21.698Z CVE-2026-63459: @vendure/dashboard Stored XSS via innerHTML in Admin Dashboard CVE Advisory https://securelayer7.net/lab/cve-2026-63460-vendure-redos-sqlite-regex-filter SecureLayer7 en 2026-09-17T15:30:14.618Z CVE-2026-63460: Vendure Unauthenticated ReDoS via SQLite Regex Filter CVE Advisory https://securelayer7.net/lab/cve-2026-63472-vendure-external-auth-account-takeover SecureLayer7 en 2026-09-17T15:29:41.763Z CVE-2026-63472: @vendure/core External Authentication Account Takeover CVE Advisory https://securelayer7.net/lab/cve-2026-63506-tinacms-auth-cross-tenant-authorization-bypass SecureLayer7 en 2026-09-17T15:08:51.498Z CVE-2026-63506: @tinacms/auth Cross-Tenant Authorization Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-65608-grav-flexdirectory-unsafe-reflection-rce SecureLayer7 en 2026-09-17T17:50:00.369Z CVE-2026-65608: Grav FlexDirectory Unsafe Reflection RCE CVE Advisory https://securelayer7.net/lab/cve-2026-68523-fulgur-unbounded-page-slicing-dos SecureLayer7 en 2026-09-17T19:09:14.420Z CVE-2026-68523: fulgur Unbounded Page Slicing Denial of Service CVE Advisory https://securelayer7.net/lab/cve-2026-69089-grav-cms-watermark-path-traversal-file-disclosure SecureLayer7 en 2026-09-17T17:29:53.514Z CVE-2026-69089: Grav CMS Path Traversal via ImageMedium::watermark() CVE Advisory https://securelayer7.net/lab/cve-2026-69197-umbraco-delivery-api-protected-content-disclosure-expansion SecureLayer7 en 2026-09-17T16:49:57.739Z CVE-2026-69197: Umbraco.Cms Delivery API Protected Content Disclosure via Property Expansion CVE Advisory https://securelayer7.net/lab/cve-2026-71538-cyclonedx-npm-windows-shell-injection-workspace SecureLayer7 en 2026-09-17T15:29:01.372Z CVE-2026-71538: @cyclonedx/cyclonedx-npm Windows Shell Injection via --workspace CVE Advisory https://securelayer7.net/lab/cve-2026-72695-grav-mediauploadtrait-deletefile-path-traversal SecureLayer7 en 2026-09-17T20:48:33.329Z CVE-2026-72695: Grav CMS Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion CVE Advisory https://securelayer7.net/lab/cve-2026-72819-grav-cms-rce-zip-upload-flex-objects SecureLayer7 en 2026-09-17T21:08:39.939Z CVE-2026-72819: Grav CMS Remote Code Execution via ZIP Upload CVE Advisory https://securelayer7.net/lab/cve-2026-73247-kestra-ssrf-pebble-http-function SecureLayer7 en 2026-09-17T17:49:17.358Z CVE-2026-73247: Kestra Unauthenticated SSRF via Pebble http() Function CVE Advisory https://securelayer7.net/lab/cve-2026-74907-grav-path-traversal-plugin-asset-map SecureLayer7 en 2026-09-17T21:11:29.143Z CVE-2026-74907: Grav CMS Unauthenticated Path Traversal via plugin-asset-map.php CVE Advisory https://securelayer7.net/lab/cve-2026-75513-marten-linq-dictionary-key-sql-injection SecureLayer7 en 2026-09-17T15:28:28.363Z CVE-2026-75513: Marten LINQ Provider SQL Injection via Unescaped Dictionary Key CVE Advisory https://securelayer7.net/lab/cve-2026-75516-rabbitmq-java-client-framemax-oom-dos SecureLayer7 en 2026-09-17T15:11:51.251Z CVE-2026-75516: RabbitMQ Java Client Frame-Level OOM via Math.min with Unlimited Frame Size CVE Advisory https://securelayer7.net/lab/cve-2026-75827-grav-blueprint-error-log-arbitrary-file-write SecureLayer7 en 2026-09-17T21:09:59.860Z CVE-2026-75827: Grav CMS Arbitrary File Write via Blueprint error_log Injection CVE Advisory https://securelayer7.net/lab/cve-2026-75837-grav-group-blueprint-privilege-escalation SecureLayer7 en 2026-09-17T21:09:15.697Z CVE-2026-75837: Grav Group Blueprint Missing Authorization Allows Privilege Escalation to Super-Admin CVE Advisory https://securelayer7.net/lab/cve-2026-76839-grav-twig-sandbox-offsetget-credential-leak SecureLayer7 en 2026-09-17T21:50:03.336Z CVE-2026-76839: Grav CMS Twig Sandbox Credential Leak via offsetGet() CVE Advisory https://securelayer7.net/lab/cve-2026-77301-adm-zip-memory-allocation-dos-zip-bomb SecureLayer7 en 2026-09-18T17:29:26.175Z CVE-2026-77301: adm-zip Uncontrolled Memory Allocation via Declared Uncompressed Size (DoS) CVE Advisory https://securelayer7.net/lab/cve-2026-77404-amqp091-go-tls-path-query-parameter-injection SecureLayer7 en 2026-09-17T18:10:42.256Z CVE-2026-77404: amqp091-go TLS Path Query Parameter Injection CVE Advisory https://securelayer7.net/lab/cve-2026-77405-amqp091-go-tls-minversion-downgrade SecureLayer7 en 2026-09-17T18:10:10.375Z CVE-2026-77405: amqp091-go TLS Version Downgrade via Missing MinVersion CVE Advisory https://securelayer7.net/lab/cve-2026-77406-amqp091-go-qos-signed-unsigned-overflow-dos SecureLayer7 en 2026-09-17T18:09:38.184Z CVE-2026-77406: amqp091-go Signed-to-Unsigned Integer Overflow in Qos CVE Advisory https://securelayer7.net/lab/cve-2026-77408-amqp091-go-shortstr-integer-overflow-truncation SecureLayer7 en 2026-09-17T17:50:36.641Z CVE-2026-77408: amqp091-go Silent Data Truncation via shortstr Integer Overflow CVE Advisory https://securelayer7.net/lab/cve-2026-77410-amqp091-go-oom-body-allocation SecureLayer7 en 2026-09-17T17:10:26.095Z CVE-2026-77410: amqp091-go Resource Exhaustion via Unbounded Body Buffer Allocation CVE Advisory https://securelayer7.net/lab/cve-2026-77411-amqp091-go-readlongstr-desynchronization-frame-injection SecureLayer7 en 2026-09-17T17:09:44.053Z CVE-2026-77411: amqp091-go Protocol Desynchronization via Oversized longstr CVE Advisory https://securelayer7.net/lab/cve-2026-77412-amqp091-go-negative-length-dos SecureLayer7 en 2026-09-17T17:09:06.883Z CVE-2026-77412: amqp091-go Denial of Service via Negative Byte-Array Length CVE Advisory https://securelayer7.net/lab/cve-2026-77615-opencast-paella-player-stored-xss-caption SecureLayer7 en 2026-09-18T13:48:26.638Z CVE-2026-77615: Opencast Paella Player Stored XSS via Caption Cue Text CVE Advisory https://securelayer7.net/lab/cve-2026-79752-cakephp-functionsbuilder-sql-injection SecureLayer7 en 2026-09-17T21:48:30.772Z CVE-2026-79752: CakePHP FunctionsBuilder SQL Injection CVE Advisory https://securelayer7.net/lab/cve-2026-81515-steeltoe-eureka-malformed-field-registry-dos SecureLayer7 en 2026-09-17T21:36:37.771Z CVE-2026-81515: Steeltoe.Discovery.Eureka Registry Fetch DoS via Malformed Instance Fields CVE Advisory https://securelayer7.net/lab/cve-2026-81516-steeltoe-consul-secure-metadata-dos SecureLayer7 en 2026-09-17T21:31:35.946Z CVE-2026-81516: Steeltoe.Discovery.Consul Malformed 'secure' Metadata DoS CVE Advisory https://securelayer7.net/lab/cve-2026-81875-hapi-fhir-shcparser-deflate-zip-bomb-dos SecureLayer7 en 2026-09-17T21:35:22.116Z CVE-2026-81875: HAPI FHIR SHCParser Unbounded DEFLATE Decompression DoS CVE Advisory https://securelayer7.net/lab/cve-2026-82399-coredns-doh-memory-exhaustion-dos SecureLayer7 en 2026-09-17T20:50:50.799Z CVE-2026-82399: CoreDNS Unauthenticated Memory Exhaustion via Compressed DNS Section Counts CVE Advisory https://securelayer7.net/lab/cve-2026-82410-pocketbase-worker-goroutine-unhandled-panic-dos SecureLayer7 en 2026-09-17T15:10:06.918Z CVE-2026-82410: PocketBase Unhandled Panic in Worker Goroutines CVE Advisory https://securelayer7.net/lab/cve-2026-84997-reactphp-http-chunked-decoder-infinite-loop-dos SecureLayer7 en 2026-09-17T20:49:54.398Z CVE-2026-84997: react/http ChunkedDecoder Infinite Loop DoS CVE Advisory https://securelayer7.net/lab/cve-2026-85058-moquette-broker-will-message-acl-bypass SecureLayer7 en 2026-09-18T18:10:17.854Z CVE-2026-85058: moquette-broker Will Message ACL Authorization Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-85715-exifreader-iloc-dos-memory-exhaustion SecureLayer7 en 2026-09-17T16:49:11.442Z CVE-2026-85715: exifreader iloc Box Memory Exhaustion DoS CVE Advisory https://securelayer7.net/lab/cve-2026-85721-async-http-client-decompression-bomb-dos SecureLayer7 en 2026-09-17T17:28:33.466Z CVE-2026-85721: async-http-client Decompression Bomb DoS CVE Advisory https://securelayer7.net/lab/cve-2026-85731-oras-go-symlink-chain-tar-extraction-path-traversal SecureLayer7 en 2026-09-17T17:31:39.842Z CVE-2026-85731: oras-go Symlink-Chain Path Traversal in tar Extraction CVE Advisory https://securelayer7.net/lab/cve-2026-85756-sshdotnet-scpclient-command-injection-remote-path SecureLayer7 en 2026-09-17T17:29:12.267Z CVE-2026-85756: SSH.NET ScpClient OS Command Injection via Unquoted Remote Path CVE Advisory https://securelayer7.net/lab/cve-2026-86003-coredns-update-opcode-bypass-doh-doq-grpc SecureLayer7 en 2026-09-17T20:49:20.086Z CVE-2026-86003: CoreDNS Confused Deputy via RFC 2136 UPDATE over DoH/DoQ/gRPC CVE Advisory https://securelayer7.net/lab/cve-2026-86038-libp2p-gossipsub-strictsign-rsa-author-spoof SecureLayer7 en 2026-09-17T17:48:43.130Z CVE-2026-86038: @libp2p/gossipsub StrictSign RSA Peer ID Author Spoofing CVE Advisory https://securelayer7.net/lab/cve-2026-86039-libp2p-peer-store-certified-address-poisoning SecureLayer7 en 2026-09-17T18:08:24.931Z CVE-2026-86039: @libp2p/peer-store Certified Address Poisoning via Forged PeerRecord CVE Advisory https://securelayer7.net/lab/cve-2026-86043-skipper-opa-truncated-body-chunked-bypass SecureLayer7 en 2026-09-17T17:08:29.970Z CVE-2026-86043: Skipper opaAuthorizeRequestWithBody OPA Authorization Bypass via Chunked Body CVE Advisory https://securelayer7.net/lab/cve-2026-86049-jupyter-server-referer-token-log-leak SecureLayer7 en 2026-09-17T21:37:06.808Z CVE-2026-86049: jupyter_server Token Leak via Referer Header in 500 Logs CVE Advisory https://securelayer7.net/lab/cve-2026-91127-file-viewer-doc-dom-xss-hyperlink-scheme SecureLayer7 en 2026-09-18T17:28:34.206Z CVE-2026-91127: @file-viewer/doc DOM XSS via Unsafe Hyperlink Scheme in Legacy DOC Renderer CVE Advisory https://securelayer7.net/lab/djust-mark-safe-context-key-inheritance-xss SecureLayer7 en 2026-09-17T21:35:56.390Z djust: mark_safe Context Key Inheritance XSS Security Research https://securelayer7.net/lab/djust-template-autoescape-xss-six-defects SecureLayer7 en 2026-09-17T21:30:57.758Z djust: Six Template-Layer XSS Defects via Broken Auto-Escape Security Research https://securelayer7.net/lab/lmdeploy-ssrf-urlparse-requests-parser-bypass SecureLayer7 en 2026-09-18T18:28:23.887Z LMDeploy SSRF Bypass via urlparse and requests Parser Disagreement Security Research https://securelayer7.net/lab/obot-mcp-oauth-dynamic-client-registration-token-theft-audience-confusion SecureLayer7 en 2026-09-18T18:09:09.831Z Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion Security Research https://securelayer7.net/lab/obot-remote-mcp-ssrf-internal-metadata SecureLayer7 en 2026-09-18T18:08:33.018Z Obot: Server-Side Request Forgery via Remote MCP Server URL Security Research https://securelayer7.net/lab/semantic-mediawiki-smwtask-missing-authorization-unauthenticated-admin-tasks SecureLayer7 en 2026-09-18T17:10:08.214Z Semantic MediaWiki Missing Authorization in smwtask API Module Security Research