https://blog.securelayer7.net/exploit-validated-pentesting/ SecureLayer7 en 2026-08-18T19:24:52.000Z Exploit-Validated Pentesting: Stop Paying for CVE Lists Security News https://blog.securelayer7.net/ai-agent-red-teaming-obfuscated-prompt-injection/ SecureLayer7 en 2026-08-17T19:15:05.000Z We Red-Teamed an AI Agent: 54% of Prompt-Injection Probes Got Past Its Defenses Security News https://securelayer7.net/lab/atomic-agents-stack-http-mcp-catalog-mitm-rce-cleartext-command-injection SecureLayer7 en 2026-08-17T22:18:00.239Z atomic-agents-stack: HTTP MCP Catalog MITM to RCE via Cleartext Command Injection Security Research https://securelayer7.net/lab/cve-2026-17106-moby-go-archive-symlink-tar-path-traversal SecureLayer7 en 2026-08-18T21:22:07.463Z CVE-2026-17106: moby/go-archive Symlink-Following Path Traversal in Tar Extraction CVE Advisory https://securelayer7.net/lab/cve-2026-47683-vm2-buffer-concat-alloclimit-bypass-dos SecureLayer7 en 2026-08-17T18:08:54.360Z CVE-2026-47683: vm2 bufferAllocLimit DoS Bypass via Buffer.concat and Buffer.from CVE Advisory https://securelayer7.net/lab/cve-2026-47686-vm2-error-cause-sandbox-escape-rce SecureLayer7 en 2026-08-17T18:04:34.818Z CVE-2026-47686: vm2 Missing Error.cause Sanitization Sandbox Escape to RCE CVE Advisory https://securelayer7.net/lab/cve-2026-47698-vm2-sandbox-breakout-indirect-call-proto-mutation SecureLayer7 en 2026-08-17T17:52:05.204Z CVE-2026-47698: vm2 Sandbox Breakout via Indirect Call Proto Mutation CVE Advisory https://securelayer7.net/lab/cve-2026-53659-http4k-gzip-decompression-bomb-dos SecureLayer7 en 2026-08-17T22:16:20.536Z CVE-2026-53659: http4k-core Unbounded Gzip Decompression DoS CVE Advisory https://securelayer7.net/lab/cve-2026-54133-jmespath-php-compiler-runtime-code-injection SecureLayer7 en 2026-08-18T20:36:17.844Z CVE-2026-54133: jmespath.php CompilerRuntime Code Injection via Unescaped Function Names CVE Advisory https://securelayer7.net/lab/cve-2026-54284-sqlparse-tokenlist-quadratic-cpu-dos SecureLayer7 en 2026-08-17T18:01:39.597Z CVE-2026-54284: sqlparse TokenList O(n*depth) CPU Denial of Service CVE Advisory https://securelayer7.net/lab/cve-2026-54347-froxlor-stored-xss-dns-txt-admin-takeover SecureLayer7 en 2026-08-18T21:30:08.023Z CVE-2026-54347: Froxlor Stored XSS in DNS TXT Record Leads to Admin Account Takeover CVE Advisory https://securelayer7.net/lab/cve-2026-54348-froxlor-second-order-sql-injection-admins-ipaddress SecureLayer7 en 2026-08-18T21:28:49.148Z CVE-2026-54348: Froxlor Second-Order SQL Injection via Admins.add ipaddress Parameter CVE Advisory https://securelayer7.net/lab/cve-2026-55090-etherpad-stored-xss-html-export-attribute-pool SecureLayer7 en 2026-08-17T18:03:06.805Z CVE-2026-55090: Etherpad Stored XSS via Unescaped HTML Export Attribute Values CVE Advisory https://securelayer7.net/lab/cve-2026-55107-kobako-sandbox-escape-public-send-rce SecureLayer7 en 2026-08-18T20:42:46.316Z CVE-2026-55107: kobako Sandbox Escape via Unguarded public_send Dispatcher CVE Advisory https://securelayer7.net/lab/cve-2026-55178-geolens-cross-dataset-authorization-bypass SecureLayer7 en 2026-08-18T18:09:16.825Z CVE-2026-55178: GeoLens Cross-Dataset Authorization Bypass CVE Advisory https://securelayer7.net/lab/cve-2026-55211-surfio-irap-out-of-bounds-read SecureLayer7 en 2026-08-18T20:37:43.246Z CVE-2026-55211: surfio Out-of-Bounds Read in IRAP Binary Parser CVE Advisory https://securelayer7.net/lab/cve-2026-55224-mineadmin-plugin-path-traversal SecureLayer7 en 2026-08-18T20:48:48.168Z CVE-2026-55224: MineAdmin Path Traversal in Plugin Install/Uninstall CVE Advisory https://securelayer7.net/lab/cve-2026-55839-kestra-stored-xss-markdown-link-attribute-injection SecureLayer7 en 2026-08-18T16:56:32.599Z CVE-2026-55839: Kestra Stored XSS via Custom Markdown [[link]] Attribute Injection CVE Advisory https://securelayer7.net/lab/cve-2026-56677-9router-unauthenticated-ssrf-oidc-issuerurl SecureLayer7 en 2026-08-17T22:11:28.723Z CVE-2026-56677: 9router Unauthenticated SSRF via OIDC Test Endpoint CVE Advisory https://securelayer7.net/lab/cve-2026-59893-sqlparse-redos-dollar-quote-multiline-comment SecureLayer7 en 2026-08-17T17:57:53.140Z CVE-2026-59893: sqlparse ReDoS via Dollar-Quoted and Multiline-Comment Regexes CVE Advisory https://securelayer7.net/lab/cve-2026-59902-netty-sctp-memory-exhaustion-oom SecureLayer7 en 2026-08-17T17:55:09.824Z CVE-2026-59902: netty-transport-sctp SctpMessageCompletionHandler Memory Exhaustion CVE Advisory https://securelayer7.net/lab/cve-2026-62988-froxlor-api-credential-2fa-disclosure SecureLayer7 en 2026-08-18T21:24:36.348Z CVE-2026-62988: Froxlor API Credential and 2FA Secret Disclosure CVE Advisory https://securelayer7.net/lab/cve-2026-63337-rabbitmq-amqp-client-unsafe-reflection-jsonrpc SecureLayer7 en 2026-08-18T16:49:07.442Z CVE-2026-63337: RabbitMQ amqp-client Unsafe Reflection via JSON-RPC javaReturnType CVE Advisory https://securelayer7.net/lab/cve-2026-64849-mlflow-webhook-ssrf-redirect-bypass SecureLayer7 en 2026-08-17T22:10:15.142Z CVE-2026-64849: MLflow Unauthenticated Full-Read SSRF via Webhook HTTP Redirect CVE Advisory https://securelayer7.net/lab/cve-2026-64859-new-api-user-list-access-token-disclosure SecureLayer7 en 2026-08-17T16:55:04.359Z CVE-2026-64859: new-api User List API Leaks Root Access Token CVE Advisory https://securelayer7.net/lab/cve-2026-64868-new-api-webhook-dos-unbounded-body SecureLayer7 en 2026-08-17T16:52:06.431Z CVE-2026-64868: new-api Unauthenticated Webhook DoS via Unbounded Body Read CVE Advisory https://securelayer7.net/lab/cve-2026-68518-glances-action-template-sanitizer-bypass-cross-field-command-inje SecureLayer7 en 2026-08-17T16:49:22.549Z CVE-2026-68518: glances Action-Template Sanitizer Bypass via Cross-Field Shell-Operator Reconstruction CVE Advisory https://securelayer7.net/lab/cve-2026-68519-glances-disable-config-exec-bypass-alert-action-command-injection SecureLayer7 en 2026-08-17T17:30:37.651Z CVE-2026-68519: Glances --disable-config-exec Bypass via On-Alert Action OS Command Injection CVE Advisory https://securelayer7.net/lab/cve-2026-69148-mlflow-create-model-version-missing-authorization SecureLayer7 en 2026-08-17T22:08:47.988Z CVE-2026-69148: MLflow Missing Authorization on CreateModelVersion run_id CVE Advisory https://securelayer7.net/lab/cve-2026-69219-rabbitmq-java-client-longstring-oom-dos SecureLayer7 en 2026-08-18T16:50:29.820Z CVE-2026-69219: RabbitMQ Java Client Unchecked LongString Allocation DoS CVE Advisory https://securelayer7.net/lab/cve-2026-69220-rabbitmq-java-client-valuereader-uncontrolled-recursion-dos SecureLayer7 en 2026-08-18T16:55:23.024Z CVE-2026-69220: RabbitMQ Java Client Uncontrolled Recursion DoS via Nested AMQP Tables CVE Advisory https://securelayer7.net/lab/cve-2026-70666-lemur-acme-ssrf-server-controlled-urls SecureLayer7 en 2026-08-18T21:16:21.692Z CVE-2026-70666: Lemur ACME Client Server-Side Request Forgery via Server-Controlled URLs CVE Advisory https://securelayer7.net/lab/cve-2026-71303-lemur-acme-authority-update-ssrf SecureLayer7 en 2026-08-18T21:14:51.232Z CVE-2026-71303: Lemur ACME Authority Update SSRF (Incomplete Fix) CVE Advisory https://securelayer7.net/lab/cve-2026-71307-lemur-destination-credentials-missing-authorization SecureLayer7 en 2026-08-18T21:11:40.379Z CVE-2026-71307: Lemur Authenticated Plaintext Destination Credential Exposure CVE Advisory https://securelayer7.net/lab/cve-2026-71308-lemur-replaces-authorization-bypass-certificate-hijack SecureLayer7 en 2026-08-18T21:10:22.677Z CVE-2026-71308: Lemur Unauthorized Certificate Hijack via Unchecked replaces Field CVE Advisory https://securelayer7.net/lab/cve-2026-71417-lemur-authorization-bypass-arbitrary-certificate-revocation SecureLayer7 en 2026-08-18T21:08:53.742Z CVE-2026-71417: Lemur Authorization Bypass via Duplicate Certificate Upload Enables Arbitrary CA Revocation CVE Advisory https://securelayer7.net/lab/cve-2026-71479-new-api-integer-overflow-quota-billing-self-credit SecureLayer7 en 2026-08-17T16:50:43.760Z CVE-2026-71479: new-api Integer Overflow in Quota Billing Yields Negative Charges CVE Advisory https://securelayer7.net/lab/cve-2026-71491-sqlparse-quadratic-dos-group-comments SecureLayer7 en 2026-08-17T17:29:06.190Z CVE-2026-71491: sqlparse Quadratic DoS in group_comments CVE Advisory https://securelayer7.net/lab/librenms-oxidized-ssrf-stored-xss-showconfig SecureLayer7 en 2026-08-18T21:23:21.211Z LibreNMS SSRF-Driven Stored XSS via Oxidized API Response Fields Security Research https://securelayer7.net/lab/meshcentral-stored-xss-agent-osdesc-injection SecureLayer7 en 2026-08-18T20:43:58.849Z MeshCentral Stored XSS via Unsanitized Agent Fields Security Research https://securelayer7.net/lab/monai-algo-from-pickle-pickle-deserialization-rce-incomplete-fix SecureLayer7 en 2026-08-18T20:31:08.298Z MONAI algo_from_pickle() Unsafe Pickle Deserialization RCE (Incomplete Fix) Security Research https://securelayer7.net/lab/monai-nnunetv2runner-os-command-injection-dataset-name SecureLayer7 en 2026-08-18T20:34:51.710Z MONAI nnUNetV2Runner OS Command Injection via dataset_name_or_id Security Research https://securelayer7.net/lab/monai-numpyreader-unsafe-deserialization-allow-pickle-rce SecureLayer7 en 2026-08-18T20:28:55.373Z MONAI NumpyReader Unsafe Deserialization via allow_pickle=True Security Research https://securelayer7.net/lab/uniget-cli-inverted-signature-guard-metadata-rce SecureLayer7 en 2026-08-17T17:56:25.494Z uniget CLI: Inverted Signature-Guard Condition Allows Unsigned Metadata RCE Security Research https://securelayer7.net/lab/vm2-arraybuffer-bufferalloclimit-bypass-dos SecureLayer7 en 2026-08-17T17:49:12.890Z vm2 Memory Exhaustion DoS via ArrayBuffer bufferAllocLimit Bypass Security Research https://securelayer7.net/lab/vm2-nodejs-sandbox-os-dns-host-process-escape SecureLayer7 en 2026-08-17T17:50:39.644Z vm2: NodeVM builtin wildcard exposes os and dns host-process read/write primitives Security Research