https://blog.securelayer7.net/application-penetration-testing/ SecureLayer7 en 2026-07-14T11:22:39.000Z Application Penetration Testing: Complete Guide Security News https://blog.securelayer7.net/continuous-threat-exposure-management-ctem/ SecureLayer7 en 2026-07-14T06:37:53.000Z Continuous Threat Exposure Management (CTEM) Explained Security News https://securelayer7.net/lab/cve-2026-44300-opencost-unauthenticated-servicekey-file-write SecureLayer7 en 2026-07-14T17:30:03.933Z CVE-2026-44300: OpenCost Unauthenticated GCP Service Key Overwrite CVE Advisory https://securelayer7.net/lab/cve-2026-44891-netty-stomp-unbounded-headers-dos SecureLayer7 en 2026-07-14T20:29:15.948Z CVE-2026-44891: netty-codec-stomp Unbounded Header Count DoS CVE Advisory https://securelayer7.net/lab/cve-2026-45262-facturascripts-api-sqli-parenthesis-bypass SecureLayer7 en 2026-07-14T17:29:30.374Z CVE-2026-45262: FacturaScripts REST API SQL Injection via Parenthesis Bypass in Where::sqlColumn CVE Advisory https://securelayer7.net/lab/cve-2026-45263-facturascripts-csv-formula-injection-csvexport SecureLayer7 en 2026-07-14T17:28:05.717Z CVE-2026-45263: FacturaScripts CSV Formula Injection in CSVExport CVE Advisory https://securelayer7.net/lab/cve-2026-45693-facturascripts-path-traversal-myfiles-private SecureLayer7 en 2026-07-14T17:28:42.592Z CVE-2026-45693: FacturaScripts Unauthenticated Path Traversal in Static File Controllers CVE Advisory https://securelayer7.net/lab/cve-2026-47142-mantisbt-history-order-sql-injection SecureLayer7 en 2026-07-15T16:48:51.316Z CVE-2026-47142: MantisBT SQL Injection via history_order Configuration Value CVE Advisory https://securelayer7.net/lab/cve-2026-47156-mantisbt-soap-api-auth-bypass-privilege-escalation SecureLayer7 en 2026-07-15T16:48:12.932Z CVE-2026-47156: MantisBT SOAP API Authentication Bypass with Privilege Escalation CVE Advisory https://securelayer7.net/lab/cve-2026-47677-facturascripts-2fa-bypass-account-takeover SecureLayer7 en 2026-07-13T23:48:40.218Z CVE-2026-47677: FacturaScripts 2FA Endpoint Authentication Bypass and Account Takeover CVE Advisory https://securelayer7.net/lab/cve-2026-49273-mantisbt-eval-class-hoisting-rce SecureLayer7 en 2026-07-15T17:08:05.982Z CVE-2026-49273: MantisBT Remote Code Execution via eval() Class Hoisting in adm_config_set.php CVE Advisory https://securelayer7.net/lab/cve-2026-50006-anyquery-attach-database-arbitrary-file-write-rce SecureLayer7 en 2026-07-14T18:48:08.425Z CVE-2026-50006: Anyquery Arbitrary File Write via Unrestricted ATTACH DATABASE in Server Mode CVE Advisory https://securelayer7.net/lab/cve-2026-50013-hoverfly-diff-mode-concurrent-map-race-condition-dos SecureLayer7 en 2026-07-14T18:08:04.382Z CVE-2026-50013: Hoverfly Concurrent Map Write DoS in Diff Mode CVE Advisory https://securelayer7.net/lab/cve-2026-50125-mkp-pod-log-memory-exhaustion SecureLayer7 en 2026-07-14T18:28:41.500Z CVE-2026-50125: MKP Unbounded Pod Log Read Memory Exhaustion CVE Advisory https://securelayer7.net/lab/cve-2026-50131-fedify-ssrf-ipv4-bypass-special-use-ranges SecureLayer7 en 2026-07-14T18:28:11.172Z CVE-2026-50131: @fedify/fedify SSRF Mitigation Bypass via Incomplete IPv4 Validation CVE Advisory https://securelayer7.net/lab/cve-2026-50158-yutu-mcp-caption-download-arbitrary-file-write SecureLayer7 en 2026-07-14T19:48:43.824Z CVE-2026-50158: yutu Arbitrary File Write via MCP caption-download CVE Advisory https://securelayer7.net/lab/cve-2026-50271-ddtrace-w3c-baggage-dos SecureLayer7 en 2026-07-15T23:10:04.734Z CVE-2026-50271: ddtrace Uncontrolled Resource Consumption via W3C Baggage Header Parsing CVE Advisory https://securelayer7.net/lab/cve-2026-50272-dd-trace-baggage-extraction-dos SecureLayer7 en 2026-07-15T23:09:25.379Z CVE-2026-50272: dd-trace Unbounded W3C Baggage Extraction DoS CVE Advisory https://securelayer7.net/lab/cve-2026-50273-datadog-trace-dotnet-baggage-extraction-dos SecureLayer7 en 2026-07-15T23:08:43.574Z CVE-2026-50273: Datadog.Trace Unbounded W3C Baggage Extraction DoS CVE Advisory https://securelayer7.net/lab/cve-2026-50274-dd-trace-go-baggage-extraction-dos SecureLayer7 en 2026-07-15T23:08:04.815Z CVE-2026-50274: dd-trace-go Unbounded W3C Baggage Header Parsing DoS CVE Advisory https://securelayer7.net/lab/cve-2026-50276-dd-trace-rb-baggage-header-dos SecureLayer7 en 2026-07-15T23:30:06.379Z CVE-2026-50276: datadog (dd-trace-rb) W3C Baggage Header Denial of Service CVE Advisory https://securelayer7.net/lab/cve-2026-50285-pomerium-hpke-zstd-decompression-bomb-dos SecureLayer7 en 2026-07-15T23:29:19.793Z CVE-2026-50285: Pomerium Pre-Auth Denial of Service via HPKE Decompression Bomb CVE Advisory https://securelayer7.net/lab/cve-2026-52824-kimai-docker-default-app-secret-cookie-forgery SecureLayer7 en 2026-07-14T00:28:04.225Z CVE-2026-52824: Kimai Docker Default APP_SECRET Enables Cookie Forgery and Account Takeover CVE Advisory https://securelayer7.net/lab/cve-2026-52827-kimai-2fa-totp-bypass-session-cookie SecureLayer7 en 2026-07-14T00:48:03.845Z CVE-2026-52827: Kimai 2FA TOTP Bypass via Pre-Verification Session Cookie CVE Advisory https://securelayer7.net/lab/cve-2026-52847-mantisbt-reflected-xss-admin-install SecureLayer7 en 2026-07-15T18:28:06.689Z CVE-2026-52847: MantisBT Reflected XSS in admin/install.php CVE Advisory https://securelayer7.net/lab/cve-2026-52881-mantisbt-install-php-reflected-xss SecureLayer7 en 2026-07-15T18:48:09.618Z CVE-2026-52881: MantisBT Reflected XSS in admin/install.php CVE Advisory https://securelayer7.net/lab/cve-2026-54087-easyadmin-stored-xss-filefield-imagefield-upload SecureLayer7 en 2026-07-14T20:29:56.881Z CVE-2026-54087: EasyAdmin Bundle Stored XSS via FileField and ImageField Upload CVE Advisory https://securelayer7.net/lab/cve-2026-54446-netlicensing-mcp-missing-auth-http-mode SecureLayer7 en 2026-07-14T21:08:34.920Z CVE-2026-54446: netlicensing-mcp Unauthenticated API Key Exposure in HTTP Mode CVE Advisory https://securelayer7.net/lab/cve-2026-54447-garminconnect-world-readable-oauth-token SecureLayer7 en 2026-07-15T17:49:06.754Z CVE-2026-54447: garminconnect World-Readable OAuth Token File CVE Advisory https://securelayer7.net/lab/cve-2026-54448-trivy-helm-tar-bomb-oom SecureLayer7 en 2026-07-14T20:10:40.486Z CVE-2026-54448: Trivy Helm Chart Tar Bomb OOM via Unbounded io.ReadAll CVE Advisory https://securelayer7.net/lab/cve-2026-54449-langbot-mcp-stdio-command-injection-rce SecureLayer7 en 2026-07-15T17:48:37.038Z CVE-2026-54449: LangBot Authenticated RCE via MCP STDIO Command Injection CVE Advisory https://securelayer7.net/lab/cve-2026-54451-elixir-protobuf-unbounded-recursion-dos SecureLayer7 en 2026-07-15T17:48:00.893Z CVE-2026-54451: elixir-protobuf Unbounded Recursion DoS CVE Advisory https://securelayer7.net/lab/cve-2026-54457-tensorzero-gateway-file-read-ssrf SecureLayer7 en 2026-07-15T22:07:58.354Z CVE-2026-54457: TensorZero Gateway Arbitrary File Read and SSRF CVE Advisory https://securelayer7.net/lab/cve-2026-54466-websocket-driver-hixie-draft-length-header-corruption SecureLayer7 en 2026-07-15T22:28:15.142Z CVE-2026-54466: websocket-driver Hixie Draft Length Header Integer Corruption CVE Advisory https://securelayer7.net/lab/cve-2026-54493-koel-ssrf-subsonic-internet-radio SecureLayer7 en 2026-07-15T17:28:08.165Z CVE-2026-54493: Koel Authenticated Full-Read SSRF via Subsonic Radio Endpoints CVE Advisory https://securelayer7.net/lab/cve-2026-54498-view-component-around-render-xss SecureLayer7 en 2026-07-15T23:31:27.005Z CVE-2026-54498: view_component around_render HTML-Safety Bypass XSS CVE Advisory https://securelayer7.net/lab/cve-2026-54504-mcp-documentation-server-unauth-network-api-exposure SecureLayer7 en 2026-07-15T23:27:59.856Z CVE-2026-54504: @andrea9293/mcp-documentation-server Unauthenticated Network API Exposure CVE Advisory https://securelayer7.net/lab/cve-2026-54628-anyquery-ssrf-sqlite-virtual-table-server-mode SecureLayer7 en 2026-07-14T20:08:44.113Z CVE-2026-54628: Anyquery SSRF via Unrestricted SQLite Virtual Table Modules in Server Mode CVE Advisory https://securelayer7.net/lab/cve-2026-54629-anyquery-local-file-read-csv-reader-server-mode SecureLayer7 en 2026-07-14T20:27:59.291Z CVE-2026-54629: Anyquery Local File Read via Unrestricted SQLite Virtual Table Modules CVE Advisory https://securelayer7.net/lab/cve-2026-61549-woodpecker-ci-kubernetes-serviceaccountname-privilege-escalation SecureLayer7 en 2026-07-14T20:48:05.230Z CVE-2026-61549: Woodpecker CI Kubernetes Backend Privilege Escalation via serviceAccountName CVE Advisory https://securelayer7.net/lab/cve-2026-61699-nebula-mesh-blocklist-never-enforced SecureLayer7 en 2026-07-14T20:49:16.605Z CVE-2026-61699: nebula-mesh Certificate Blocklist Never Enforced on Mesh Peers CVE Advisory https://securelayer7.net/lab/cve-2026-62944-mantisbt-stored-xss-attachment-filename-html-export SecureLayer7 en 2026-07-15T19:08:01.589Z CVE-2026-62944: MantisBT Stored XSS via Attachment Filename in HTML Export CVE Advisory https://securelayer7.net/lab/ech0-accept-language-underscore-bypass-dos-amplification SecureLayer7 en 2026-07-14T20:09:19.681Z Ech0: Accept-Language `_` Separator Bypass Causes ~70x CPU Amplification DoS Security Research https://securelayer7.net/lab/facturascripts-uploadedfile-path-traversal-rce SecureLayer7 en 2026-07-14T21:07:59.830Z FacturaScripts Path Traversal to Remote Code Execution via UploadedFile::move() Security Research https://securelayer7.net/lab/json-repair-circular-ref-infinite-loop-dos SecureLayer7 en 2026-07-13T23:47:53.793Z json-repair Circular JSON Schema $ref Infinite Loop DoS Security Research https://securelayer7.net/lab/nebula-mesh-allow-private-ssrf-missing-authorization SecureLayer7 en 2026-07-14T20:48:38.759Z nebula-mesh: Non-Admin SSRF via Unguarded allow_private Webhook Flag Security Research https://securelayer7.net/lab/obsidian-local-rest-api-path-traversal-percent-encoded-slash-vault SecureLayer7 en 2026-07-15T22:08:32.348Z obsidian-local-rest-api: Authenticated Path Traversal via Percent-Encoded Slash in /vault/{path} Security Research https://securelayer7.net/lab/tidgi-desktop-rce-tiddlywiki-startup-module-import SecureLayer7 en 2026-07-14T20:09:55.785Z TidGi Desktop Remote Code Execution via Malicious TiddlyWiki Repository Import Security Research https://securelayer7.net/lab/tsdproxy-x-forwarded-for-ip-spoofing-injection SecureLayer7 en 2026-07-14T19:48:03.192Z TsDProxy X-Forwarded-For Header Injection Allows IP Spoofing Security Research