CVE

P Paraschivoiu Alexandru · Jun 8, 2026 · 16 min

CVE-2026-20245: how a tenant-list CSV upload turned Cisco SD-WAN Manager into a root shell

Inside CVE-2026-20245: an unvalidated file-path argument to a privileged tenant-list upload script lets a netadmin execute commands as root...

P Paraschivoiu Alexandru · Jun 3, 2026 · 18 min

CVE-2026-45659: how an ordinary site member turns on-prem SharePoint into a remote code execution box

Inside CVE-2026-45659: an insecure-deserialization (CWE-502) flaw lets any authenticated SharePoint Server Site Member run code on-prem (CVS...

P Paraschivoiu Alexandru · Jun 2, 2026 · 17 min

CVE-2026-48095: how a 1-byte heap buffer turned 7-Zip's NTFS parser into an extension-agnostic code execution primitive

Inside CVE-2026-48095: an undefined-behavior shift in 7-Zip's NTFS handler allocates a 1-byte buffer, then writes 256 MB into it, corrupting...

S Stefan Mitocaru · May 22, 2026 · 19 min

CVE-2026-43640: how one `&&` short-circuit turned a stolen Bitwarden session into a persistent SCIM key

Inside CVE-2026-43640: the C# short-circuit boolean that lets any authenticated Bitwarden admin with a stolen session pull or rotate the org...

S Stefan Mitocaru · May 20, 2026 · 16 min

CVE-2026-6973: Ivanti EPMM RCE Actively Exploited in the Wild and Already in CISA KEV

Ivanti Ivanti Endpoint Manager Mobile (versions up to 12.8.0.0) contains an improper input validation vulnerability that allows remote code...

P Paraschivoiu Alexandru · May 18, 2026 · 22 min

CVE-2026-42945: how an 18-year-old flaw in NGINX's rewrite module turned the world's most popular web server into a one-shot RCE target

Inside CVE-2026-42945 (NGINX Rift): the 18-year-old heap buffer overflow in NGINX's ngx_http_rewrite_module that enables unauthenticated RCE...

S Stefan Mitocaru · May 15, 2026 · 23 min

CVE-2026-45321: how attackers hijacked a trusted GitHub Actions publisher to weaponize the npm supply chain

Breakdown of CVE-2026-45321, the TanStack supply chain compromise. An attacker chained a pull_request_target misconfiguration, GitHub Action...

P Paraschivoiu Alexandru · May 13, 2026 · 15 min

CVE-2026-23918: Apache HTTP/2 Double-Free Flaw That Can Bring Down Your Server (and Worse)

A critical double-free bug in Apache HTTP Server 2.4.66 lets unauthenticated attackers crash worker processes with two HTTP/2 frames, and es...

S Stefan Mitocaru · May 11, 2026 · 23 min

Dirty Frag (CVE-2026-43284, CVE-2026-43500): how the same page-cache write class that powered Copy Fail came back in IPSec and rxrpc, and leaked before the patch was ready

Dirty Frag chains two Linux kernel LPE vulnerabilities (CVE-2026-43284 in IPSec ESP, CVE-2026-43500 in RxRPC) to achieve instant root on vir...

P Paraschivoiu Alexandru · May 8, 2026 · 17 min

CVE-2026-40372: how a broken HMAC check in ASP.NET Core Data Protection let attackers forge authentication cookies

A regression in ASP.NET Core Data Protection broke HMAC validation, exposing apps to forged authentication cookies and padding oracle attack...

S Stefan Mitocaru · May 6, 2026 · 12 min

CVE-2026-41940: How Three Small Mistakes in cPanel Handed Attackers the Keys to 1.5 Million Servers

CVE-2026-41940 is a critical (CVSS 9.8) authentication bypass in cPanel and WHM that lets unauthenticated attackers gain root-level server a...

P Paraschivoiu Alexandru · May 4, 2026 · 15 min

CVE-2026-31431: how a nine-year-old kernel optimization turned every Linux system into a privilege escalation target

A logic flaw in the Linux kernel's crypto subsystem, dormant since 2017, now lets any unprivileged local user write into the page cache of f...