CVE

S Stefan Mitocaru · Sep 18, 2026 · 20 min

CVE-2026-74820: how an unsanitized ORDER BY clause turned ServiceNow's AI Platform into an unauthenticated database backdoor

Inside CVE-2026-74820: a CVSS 10.0 unauthenticated SQL injection in ServiceNow's AI Platform, reachable through a dynamic schema ORDER BY cl...

P Paraschivoiu Alexandru · Sep 9, 2026 · 20 min

CVE-2026-85978: how one path normalization mismatch turned Akana's admin console into unauthenticated remote code execution

Inside CVE-2026-85978: a path normalization gap between Akana Policy Manager's auth filter and its servlet dispatcher lets an unauthenticate...

S Stefan Mitocaru · Sep 1, 2026 · 19 min

CVE-2026-78174: how an unredacted session token in a diagnostic log turned a low-privileged WatchGuard Dimension admin into super admin

Inside CVE-2026-78174: WatchGuard Dimension writes Super Administrator session tokens into a diagnostic log any lower-privileged Administrat...

S Stefan Mitocaru · Aug 3, 2026 · 18 min

CVE-2026-65321: how one backslash in PyAthena's quote escaper turned parameterized DELETE queries into SQL injection

Inside CVE-2026-65321: PyAthena sent DELETE and CTAS statements through a Hive escaper that backslash-escapes quotes, but Athena and Trino i...

S Stefan Mitocaru · Jul 31, 2026 · 19 min

CVE-2026-63223: how a GIF header on a PHP file turned CodeIgniter's image upload check into remote code execution

CodeIgniter's is_image and mime_in upload rules trusted content-derived MIME type but never the client filename extension, letting a .php fi...

P Paraschivoiu Alexandru · Jul 29, 2026 · 18 min

CVE-2026-58155: how silently truncating a long header name turned Apache Traffic Server into a request-smuggling engine

Inside CVE-2026-58155: Apache Traffic Server silently truncated over-length HTTP header names instead of rejecting them, enabling header ali...

P Paraschivoiu Alexandru · Jul 20, 2026 · 21 min

CVE-2026-60137 + CVE-2026-63030: how a one-position array desync in WordPress's batch API turned a login-only SQL injection into unauthenticated RCE

Inside wp2shell (CVE-2026-60137 + CVE-2026-63030): a REST batch route desync in WordPress core unblocks an author__not_in SQL injection, cha...

P Paraschivoiu Alexandru · Jul 17, 2026 · 19 min

CVE-2026-58644: how one unsafe deserialize turns an on-prem SharePoint server into unauthenticated remote code execution

Inside CVE-2026-58644: a critical (CVSS 9.8) deserialization flaw in on-premises Microsoft SharePoint Server that hands unauthenticated atta...

S Stefan Mitocaru · Jul 10, 2026 · 22 min

IonStack (CVE-2026-10702 + CVE-2026-43499): how a JIT miscompilation and a 15-year-old kernel flaw turned one URL click into full Android 17 root

Inside IonStack: Nebula Security chains a Firefox IonMonkey type-confusion (CVE-2026-10702) with a 15-year-old Linux kernel stack-UAF (CVE-2...

S Stefan Mitocaru · Jul 8, 2026 · 22 min

CVE-2026-43499: how a 15-year-old cleanup shortcut in the Linux kernel's futex code became a one-user path to root and a container escape

Inside GhostLock (CVE-2026-43499): a 15-year-old stack use-after-free in the Linux kernel's rtmutex priority-inheritance code lets any local...

P Paraschivoiu Alexandru · Jul 2, 2026 · 18 min

CVE-2025-29927: how one internal header let attackers walk straight past Next.js middleware auth

Inside CVE-2025-29927: a forged x-middleware-subrequest header makes Next.js skip its own middleware, bypassing every authentication and aut...

S Stefan Mitocaru · Jun 15, 2026 · 16 min

CVE-2026-20253: how a localhost-only database helper turned every AWS Splunk box into a pre-auth RCE

Inside CVE-2026-20253 (CVSS 9.8): Splunk Enterprise's PostgreSQL backup sidecar trusted the network instead of the request, letting an unaut...