https://blog.securelayer7.net/ai-sandbox/ SecureLayer7 en 2026-09-03T07:35:45.000Z AI Sandbox: Security Risks, Benefits & Best Practices Security News https://securelayer7.net/lab/cve-2026-56811-phoenix-unbounded-channel-join-dos SecureLayer7 en 2026-09-03T20:50:31.125Z CVE-2026-56811: Phoenix Unbounded Channel Join DoS CVE Advisory https://securelayer7.net/lab/cve-2026-61556-liquidjs-strip-html-infinite-loop-dos SecureLayer7 en 2026-09-03T17:48:48.994Z CVE-2026-61556: LiquidJS strip_html Infinite Loop (DoS) CVE Advisory https://securelayer7.net/lab/cve-2026-62682-orval-server-url-template-literal-rce SecureLayer7 en 2026-09-03T19:09:04.581Z CVE-2026-62682: Orval Remote Code Execution via Unescaped Server URL in Template Literal CVE Advisory https://securelayer7.net/lab/cve-2026-63376-toml-node-prototype-pollution-proto-desync SecureLayer7 en 2026-09-03T21:11:04.599Z CVE-2026-63376: toml Prototype Pollution via __proto__ Key-Path Desynchronization CVE Advisory https://securelayer7.net/lab/cve-2026-67445-mailpit-smtp-command-line-memory-exhaustion SecureLayer7 en 2026-09-02T23:51:27.707Z CVE-2026-67445: Mailpit SMTP Command Parser Unbounded Memory Allocation (DoS) CVE Advisory https://securelayer7.net/lab/cve-2026-67446-mailpit-thumbnail-image-decompression-dos SecureLayer7 en 2026-09-02T23:58:06.989Z CVE-2026-67446: Mailpit Thumbnail Handler Uncontrolled Memory Allocation via Oversized Image Dimensions CVE Advisory https://securelayer7.net/lab/cve-2026-68584-siyuan-publish-password-auth-bypass-heading-dom SecureLayer7 en 2026-09-03T21:29:01.205Z CVE-2026-68584: SiYuan Publish Password Authentication Bypass via Unprotected Content Endpoints Security Research https://securelayer7.net/lab/cve-2026-68586-siyuan-getbacklinkdoc-publish-access-bypass SecureLayer7 en 2026-09-03T21:30:18.174Z CVE-2026-68586: SiYuan Missing Publish-Access Filter on Backlink Content Endpoints CVE Advisory https://securelayer7.net/lab/cve-2026-68587-siyuan-getheading-transaction-publish-disclosure SecureLayer7 en 2026-09-03T21:31:43.871Z CVE-2026-68587: SiYuan getHeading*Transaction Publish-Disabled Document Disclosure CVE Advisory https://securelayer7.net/lab/cve-2026-69086-siyuan-attributeview-avid-path-traversal SecureLayer7 en 2026-09-03T20:49:08.090Z CVE-2026-69086: SiYuan Attribute-View Path Traversal via Unvalidated avID CVE Advisory https://securelayer7.net/lab/cve-2026-71428-unstructured-ssrf-url-partition SecureLayer7 en 2026-09-03T17:09:04.126Z CVE-2026-71428: unstructured Full-Read SSRF via url= Parameter CVE Advisory https://securelayer7.net/lab/cve-2026-72793-siyuan-getconf-credential-disclosure SecureLayer7 en 2026-09-04T21:29:03.757Z CVE-2026-72793: SiYuan /api/system/getConf Credential Disclosure CVE Advisory https://securelayer7.net/lab/cve-2026-72798-siyuan-renderattributeview-publish-access-filter-bypass SecureLayer7 en 2026-09-04T21:08:54.280Z CVE-2026-72798: SiYuan renderAttributeView Publish-Access Filter Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-72801-siyuan-notebook-crypto-disclosure SecureLayer7 en 2026-09-03T23:09:03.480Z CVE-2026-72801: SiYuan Encrypted Notebook Key Material Disclosed to Anonymous Readers CVE Advisory https://securelayer7.net/lab/cve-2026-72804-siyuan-graph-password-bypass SecureLayer7 en 2026-09-03T23:10:13.237Z CVE-2026-72804: SiYuan Graph Endpoints Missing Publish-Password Check CVE Advisory https://securelayer7.net/lab/cve-2026-72810-siyuan-websocket-broadcast-publish-bypass SecureLayer7 en 2026-09-03T22:49:48.621Z CVE-2026-72810: SiYuan WebSocket Broadcast Publish-Boundary Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-72811-siyuan-backlink-sql-injection SecureLayer7 en 2026-09-03T22:51:05.245Z CVE-2026-72811: SiYuan SQL Injection via Backlink and Mention Search CVE Advisory https://securelayer7.net/lab/cve-2026-72921-seaweedfs-filer-jwt-allowed-prefixes-bypass SecureLayer7 en 2026-09-02T23:56:50.403Z CVE-2026-72921: SeaweedFS Filer JWT allowed_prefixes Authorization Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-73222-claude-code-templates-studio-rce-command-injection SecureLayer7 en 2026-09-03T20:10:23.148Z CVE-2026-73222: claude-code-templates Unauthenticated OS Command Injection (RCE) in Studio Server CVE Advisory https://securelayer7.net/lab/cve-2026-73292-semaphore-ui-csrf-password-takeover SecureLayer7 en 2026-09-03T19:30:11.523Z CVE-2026-73292: Semaphore UI CSRF Password Takeover CVE Advisory https://securelayer7.net/lab/cve-2026-73293-semaphore-ui-manager-owner-privilege-escalation-role-slug SecureLayer7 en 2026-09-03T19:29:08.482Z CVE-2026-73293: Semaphore UI Manager-to-Owner Privilege Escalation via Custom Role Slug Collision CVE Advisory https://securelayer7.net/lab/cve-2026-73841-openchoreo-cross-project-exec-wirelogs-authz-bypass SecureLayer7 en 2026-09-02T23:55:42.427Z CVE-2026-73841: OpenChoreo Cross-Project Authorization Bypass in exec and wirelogs Endpoints CVE Advisory https://securelayer7.net/lab/cve-2026-73842-openchoreo-cluster-gateway-missing-authentication-secret-disclosu SecureLayer7 en 2026-09-04T21:50:03.232Z CVE-2026-73842: OpenChoreo cluster-gateway Missing Authentication on Internal Proxy CVE Advisory https://securelayer7.net/lab/cve-2026-73843-openchoreo-cluster-gateway-unauthenticated-rce SecureLayer7 en 2026-09-02T23:50:20.186Z CVE-2026-73843: OpenChoreo cluster-gateway Unauthenticated Data-Plane RCE CVE Advisory https://securelayer7.net/lab/cve-2026-75856-codewhale-ssrf-dns-pinning-toctou SecureLayer7 en 2026-09-04T18:09:06.106Z CVE-2026-75856: CodeWhale (deepseek-tui) SSRF via DNS Pinning TOCTOU Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-75857-codewhale-exec-shell-interact-approval-bypass SecureLayer7 en 2026-09-04T18:12:15.028Z CVE-2026-75857: CodeWhale exec_shell_interact Approval Bypass Privilege Escalation CVE Advisory https://securelayer7.net/lab/cve-2026-75858-codewhale-rlm-eval-approval-bypass-rce SecureLayer7 en 2026-09-04T18:15:16.052Z CVE-2026-75858: CodeWhale rlm_eval Approval Bypass Leading to Unsandboxed RCE CVE Advisory https://securelayer7.net/lab/cve-2026-75859-codewhale-instructions-arbitrary-file-read SecureLayer7 en 2026-09-04T18:18:17.480Z CVE-2026-75859: deepseek-tui (CodeWhale) Arbitrary File Read via Project Config instructions Override CVE Advisory https://securelayer7.net/lab/cve-2026-75911-codewhale-allow-shell-project-config-code-injection SecureLayer7 en 2026-09-04T18:21:54.648Z CVE-2026-75911: deepseek-tui (CodeWhale) Project Config allow_shell Override Enables Arbitrary Shell Execution CVE Advisory https://securelayer7.net/lab/cve-2026-75913-codewhale-git-show-argument-injection-file-write SecureLayer7 en 2026-09-04T18:17:06.289Z CVE-2026-75913: CodeWhale Argument Injection in git_show Allows Arbitrary File Write CVE Advisory https://securelayer7.net/lab/cve-2026-75914-codewhale-image-analyze-symlink-path-traversal SecureLayer7 en 2026-09-04T17:49:05.446Z CVE-2026-75914: CodeWhale image_analyze Symlink Path Traversal CVE Advisory https://securelayer7.net/lab/cve-2026-75915-codewhale-js-execution-env-leak SecureLayer7 en 2026-09-04T18:10:18.377Z CVE-2026-75915: CodeWhale deepseek-tui js_execution Environment Variable Leak CVE Advisory https://securelayer7.net/lab/cve-2026-77465-toml-node-uncontrolled-recursion-dos SecureLayer7 en 2026-09-03T21:09:40.258Z CVE-2026-77465: toml Uncontrolled Recursion (DoS) CVE Advisory https://securelayer7.net/lab/cve-2026-79921-amqp091-go-frame-max-memory-exhaustion SecureLayer7 en 2026-09-03T20:30:01.194Z CVE-2026-79921: amqp091-go Broker-Controlled Memory Exhaustion via Oversized Frame CVE Advisory https://securelayer7.net/lab/cve-2026-82404-toon-format-prototype-pollution-decode SecureLayer7 en 2026-09-03T20:09:05.457Z CVE-2026-82404: @toon-format/toon Prototype Pollution via Untrusted Decode CVE Advisory https://securelayer7.net/lab/siyuan-svg-sanitizer-bypass-xss-desc-style-parser-mismatch SecureLayer7 en 2026-09-03T15:09:04.894Z SiYuan: Stored and Reflected XSS via SVG Sanitizer Bypass (HTML/XML Parser Mismatch) Security Research https://securelayer7.net/lab/typespec-spector-unauthenticated-admin-stop-dos SecureLayer7 en 2026-09-04T21:48:42.840Z @typespec/spector Unauthenticated Remote Shutdown via POST /.admin/stop Security Research