Alerts¶

High-signal incident notes, malware waves, CVE writeups, and active defensive references.

How to use alerts¶

• Start with the newest entries when you need current context.
• Use alerts to capture threat details that should remain linkable after the initial advisory window.
• Fold recurring lessons into Skills, Playbooks, or Best Practices when they become reusable guidance.

Recent highlights¶

• [Oct 14 03:3xZ wave — 1 new page + 2 folds: Document-server RCE wave = new page Collabora/ONLYOFFICE wave — Collabora Built-in CODE Server <26.4.303 proxy.php pre-auth OS command injection, exploited-in-the-wild Sept–Oct 2026 per the GHSA, NOT yet in KEV (catalog 2026.10.13) = ITW-before-KEV head-start window; only the richdocumentscode built-in deployment shape is affected (standalone Collabora unaffected — deployment-shape fingerprinting is the recon question on any Nextcloud target), and the exploit window is when the CODE server isn't running (post-restart) = component-lifecycle gates are transient states attackers poll for and can cause. ONLYOFFICE Document Server <10.0.0 Document Builder RCE: valid Inbox JWT → converter XML third arg of builder.SaveFile() → duplicate m_sFileTo element overrides the output path → overwrite runtime.json → next Builder job executes attacker-changed binary path as ds; config-file-rewrite = deferred-execution implant surviving upgrades; JWT_SECRET is the whole auth story. Unreal Engine ≤5.8.0 LaunchURL empty-scheme-filter (empty FURLRequestFilter = allow-all; file:/// → ShellExecuteW; UGC Blueprints + WebDAV remote delivery) = fail-closed-vs-fail-open empty-container probe battery. Folds: Abandoned Cart Pro ≤10.8.0 MAC-free AES-CTR cart tokens with attacker-selected key (user_email param) + nonce-inside-blob + HMAC-gate-skipped-by-omission = keystream recovery → forge any victim's cart ID → wp_set_auth_cookie() any-user ATO incl admin, auto-login defaults ON/force-on-upgrade (9.8) + second-order SQLi from checkout fields through stored cart meta into unparameterized UPDATE wp_usermeta → capabilities-row admin write, on the Sept 19 shortcode page — CTR-keystream-recovery hunt + conditional-integrity-by-omission + prepared-statement sibling parity axes; Click to Chat ≤4.44 sanitize-before-substitute ordering (wp_kses on template pre-{url} fill = URL bytes reach do_shortcode() unfiltered) third mechanism on same page; Snazzy Social Media Feed ≤2.5 standalone save-to-cache.php never loads WP → anonymous PHP upload with FILTER_SANITIZE_URL-only + Printcart ≤2.9.1 Google-Drive-branch filename allowlist divergence + nonce minted to anonymous callers by sibling endpoint + Bit integrations ≤2.10.6 log-re-execution replays anonymous payload in the admin's session → admin password write + Automatic Role Changer add-only foreign-role cache resurrects revoked Administrator, on the Sept 19 alternate-surface page. Tracked no-publish: TeamPlus Messenger JS-inject→code-exec pair, Kasa local-protocol unauth mgmt, Hyland %PROGRAMDATA% LPE, Hitachi disk-driver trio, Samsung QA-Board detail-free cmdi, Directorist/Booking Package public-nonce class, BP Profile Search referer-gate LFI, CFDB7 substring-key unlink. KEV unchanged (catalog 2026.10.13, 1741, sha 136904f1; CVE-2026-110447 KEV-watch); ToB 25d2bbee; PortSwigger 59b1ab6e; PD head-processed; Brutecat f099b20d; disclosed DEAD (rjewel stub)

• [Oct 13 19:1xZ wave — 1 new page + 3 folds: Docker Hub GhostPat (CVE-2026-105445 critical, fixed 2026-09-30, GHSA published 10-13) = new page GhostPat page — account→org conversion with victim username as receiver silently carries the attacker's PAT onto the victim's identity: no notification, no consent, token authenticates as the victim inheriting org memberships (private-repo pull, namespace push, bearer exchange; attacker-chosen token name defeats name-based review; exposure window since 2024-08-26; official-images root-of-trust leg flagged-unconfirmed). Rules: identity-transition flows (convert/merge/link/transfer) are credential-carrying state machines — consent-of-receiver + rotation-of-carried-credentials are the two audit questions; token-user foreign-key rewrite without rotation = grep-able twin in self-hosted registries; two-owned-accounts probe before ever touching a live target. Folds: OpenStack Keystone delegated tokens (EC2/app-cred/OAuth1/trust) reach /v3/credentials create/modify/delete, EC2 tokens READ credential blobs = TOTP MFA-seed cloning, PATCH moves credentials to unauthorized projects (qfjc/90460 fixed 29.0.3) on the Sept 16 IdP page — delegated-token population × admin-adjacent API sweep, seed-read = MFA-integrity class; MongoDB five-leg aggregation wave on the Sept 18 query-grammar page — user-named internal aggregation stages lack their own authz → forced-on-router mongos aborts ×2 (ppm2/56w2), UAF with batchSize:0 returns server-heap residue (8hjj/96297 = read-priv → cross-client memory disclosure), query-rewriter returns fields the query never asked for (8w3x/103965 = planner-costume filter bypass), stored-crash validator detonates on later inserts (v57p/104004); internal-name allowlists are conventions not ACLs (FalkorDB --bolt recall), optimizer is below your masks; Grafana provisioning/data-source legs on the Sept 18 Grafana page — read-only principal writes Git Sync connection config via status subresource (pm7c/15577 verb×subresource matrix), Azure Monitor resource proxy spends the server's ARM identity beyond Grafana's needs (5wf9/93294 confused-deputy role-bound check), conversion-endpoint unbounded-body + hostile-configured-Git-upstream DoS pair (5mj5/w2wx). Tracked no-publish: Fortinet wave (FortiAnalyzer/FortiManager SQLi trio low-priv→cmdi FG-IR-26-178, FortiSIEM traversal 5cx2 critical + missing-authz, FortiSandbox hardcoded key, FortiOS newcli double-free — vendor boilerplate no route detail), Ivanti Xtraction five-leg (2j2w critical app-request redirect steals EPMM connector creds, vj5v unauth trusted-site create, template-export traversal — thin single sentences, watch vendor bulletin), Portal for ArcGIS trio (69m7 unauth /portaladmin/local under specific conditions, vq46 signup-bypass, LDAPi — ESRI bulletin detail thin), Docker-adjacent Submariner spoke-cluster route hijack 37mq/66785 (watch: cluster-join = traffic-interception class), DeepSeek V4 sparse gist GHSA, OT/OCS/BusyBox/Xen/Kingsoft vuldb packs, wolfSSH/OpENer/Brocade re-listings already processed. KEV unchanged (catalog 2026.10.13, 1740; sha re-download bf25dac3 same content); ToB 9498f6e8 head SequenceHash; PortSwigger head Oct-6; PD head Aug-16; Brutecat f099b20d; disclosed DEAD (rjewel stub)

• Oct 13 18:1xZ wave — 1 new page: Ivanti Connect Secure exploited chain (CVE-2026-104935, KEV added 2026-10-13 due 10-16) = new page ICS chain — Volexity's full zero-day chain on a fully patched 22.8R2.4 appliance: URL-vs-header dispatch split auth bypass (public welcome.cgi URL passes the auth gate, X-DSCGI-PATH header selects the protected CGI that actually executes — 2023-46805 lineage), write-then-validate execution race (wu.cgi writes the upload to /home/runtime/tmp/<MD5(client-supplied filename)> before ZIP validation and the attacker re-enters that path through the same header router, winning the execute-before-delete window; hash-derived destination path from attacker input = predictable + addressable write primitive), root via dsinvoked broker trusting DSCache task table after one in-memory instruction byte patched in libdsplibs.so via /proc/self/mem, then DSCache + patch + logs restored → Integrity Checker blind; in-band request/response C2, per-command re-exploitation, no web shell; privesc leg still unpatched. Hunt rules: dispatch-header differential battery on front/back-end appliance splits, upload-handler destination-path hash grep, privileged-broker task-table trust audit. Post-exploitation checklist from the published activity: appliance LDAP service account → LAPS + BitLocker recovery keys + userPassword attributes, renamed tcpdump on plaintext-port BPF filters writing rotating hidden-dir pcaps, custom Kerberoast tooling, on-appliance password spraying, selective log-window excision. Boundary: production probes = public-path header differentials only; race and protected-CGI proofs in the lab

• [Oct 13 15:3xZ wave — 1 new page + 4 folds: NVIDIA AIStore coordinated wave (PSAT-2026-5889, 7 GHSAs, CVSS 10.0 + 9.1 critical) = new page AIStore wave — a clustered AI object store published its own unauthenticated control-plane inventory: legacy ETL Kubernetes PodSpec initialization API accepts caller-supplied host-namespace and container-security settings (pod-spec injection through the proxy-as-deputy → code exec, privesc, node escape, 10.0), token-revocation endpoint missing authentication (unauthenticated crafted revocation lists = tamper/DoS against the cluster's own token state, 9.1), Promote API crafted absolute source path = unauthenticated read of any file the storage process can reach (verb-shaped traversal: a storage-move verb whose path hits host disk), ETL management API missing authorization (read every ETL job definition = topology recon + start/stop any job), dSort archive-member-name traversal (arbitrary file create/overwrite), and two SSRF legs on job parameters (dSort external key-map URL, experimental HT backend original-URL — job-config URL fields sit outside user-facing URL validators). Durable rule: legacy / experimental / job-internal route families do not inherit the JWT/RBAC gate — enumerate API families from the CLI command tree or router registration and probe each family's least-loved sibling unauthenticated before crediting the auth story; AIS JWT/OIDC is opt-in, several advisories say "unauthenticated remote attacker" outright. Folds: Wazuh reserved-user guard inside a falsy truthiness check (fv2h/CVE-2026-74035: empty password skips guard+policy together → overwrite the wazuh superuser, authenticate with empty creds; detection-plane takeover class; update-handler empty/omitted/null/type-confusion battery) on the Sept 21 auth-precedence page; Hono serveStatic double path decoding bypasses prefix auth middleware (3g9q/CVE-2026-109955: middleware matches the raw path, handler serves the re-decoded one — %25xx decode-generation drift battery against static gates on any middleware-chain framework) on the July 30 URL-policy page; NLTK WekaClassifier unvalidated model path reaches the WEKA JVM -d/-l flags past pathsec (9fgx/CVE-2026-109956, fifth distinct pathsec bypass channel = subprocess/native-launcher leg; no fixed band, the guard is a claim not a control) on the July 31 library page; H3C HDM firmware signature trust anchor is /conf/public.pem, writable via the Redfish UpdateService.UploadSignKey action that stores any .pem-named body verbatim, Family-A has no PFR (3886/CVE-2026-65197 — verifier-key-location audit + Redfish key-upload action recon) and Huawei openUBMC shipped SNMPv3 USM auth+privacy keys as open-source-build constants + SNMP callers minted full-privilege pseudo-identities (5754/65198 + 246r/65199 — pre-engagement upstream-repo grep for shipped keys) on the Sept 16 update-key page; AIStore dSort tar-slip noted on the May 6 extraction page. Tracked no-publish: Commvault 8-leg coordinated pack incl 77099 critical CVFS cmdi (vendor boilerplate, zero detail — watch for writeups; backup infra = credential-cache class), NVIDIA Megatron-LM x2 + DALI x2 + Warp checkpoint-parser memory-safety pack (class covered May 6), FreeRDP ~20-leg client-side pack (wg33 credential exposure + c6qf NLA-downgrade pair worth a lab rerun), Parse Server cross-client transactional batch rollback jq9m/109954, Zoom Phone buffer overflow + cert-validation pair + Android URL-scheme authz, InstallShield priv-esc, AMI Aptio pack, Froxlor five-leg, EspoCRM trio, NETGEAR RAX auth bypass + session randomness, girishsaraf SQLi trio, yt-dlp-web-ui arg injection, Apache Fesod SSRF-guard gap. KEV unchanged (catalog 2026.10.13, 1740, sha 37dd07db — the 10-13 ICS CVE-2026-104935 spoofing KEV remains zero-detail, tracked-not-promoted); ToB 9498f6e8 head SequenceHash; PortSwigger 59b1ab6e head Oct-6; PD head Aug-16; Brutecat f099b20d; disclosed DEAD (rjewel stub)]
• [Oct 13 13:1xZ wave — 1 new page + 4 folds: Siemens OT patch-day wave (12:32Z coordinated batch) = new page Siemens OT wave — the imported trace file is the weapon: SIMATIC S7-1500 web-server Trace page renders comment fields, visual marker data, signal names (menus AND error messages), calculated-signal data and visual properties from imported CSVs with no escaping — 8 legs, 3 critical — JS runs in the importing engineer's browser and performs PLC operations through the web server within that user's scope, needing only social-engineering a "Read diagnostics" holder into loading a plausible capture file (one sink × eight ingress fields = the vendor's own missed-render inventory; error-message rendering is an XSS sink with its own grammar); RUGGEDCOM CROSSBOW <V6.0 ten-leg cluster: SQLi through plain metadata — facility names in Bulk Import/Export, firmware-upload filenames, notification-condition values, custom file labels — plus internal DB queries disclosing administrative credentials for other internal systems (management platform = credential cache) + missing per-action server-side authorization checks (minimal-privilege user disconnects admin sessions, schedules special operations, retry/stop/delete scheduled tasks) + un-scoped queries dump all devices/substations/users; APOGEE/TALON building controllers: unauthenticated web-service input-length leg reads device memory + upload/multipart/FTP pre-auth DoS legs, MBC/MEC PPC "All versions" = nothing to patch to — building automation = forgotten reachable management infrastructure; Industrial Edge App Publisher backend data rendered unsanitized into a Node.js-integrated front end → vendor-stated RCE (xm4r) + no-server-cert-validation MITM twin (rc9q); Edge-device internal APIs reachable behind ordinary user auth (gxc6/9xh9); WinCC over-permissioned database role → arbitrary commands on the WinCC host (q747); BIOS vendor test key shipped inside the UEFI Secure Boot db on SIMATIC IPCs (f9v9) = Secure Boot reports enabled, boots anything signed with the test key. Folds: Payload CMS fourth-wave in/not_in SQLi (57gg/CVE-2026-63316, fixed 3.90.0/canary.34 — validation coverage is per query operator; per-operator grammar battery) on the Oct 6 Payload page; Conductor MCP mcpServer + API-tool specUrl + MeterSphere Swagger3 swaggerUrl config-URL SSRF trio (two public exploits) — workflow platforms are SSRF farms by design, the question is bound not reach + sibling URL-ingress parity (36mx/q2hq/hhch) on the Aug 6 agent page; Seldon MLServer _extract_env + MosaicML Composer checkpoint extractall + DeepPavlov model-download untar path traversals — in AI platforms the archive boundary moved to the model/checkpoint/env artifact channel, the registry is the upload form (46h3/9h32/c364) on the May 6 extraction page; scp.py ≤0.16.1 _recv_file/_recv_pushd server-filename traversal (3f22, patch public) = the asyncssh twin, class now grep-able across every Python SCP client (3f22) on the Aug 27 page. Tracked no-publish: TRENDnet TEW-432BRP EOL stack overflow (6vrm, legacy single-endpoint class), js-beautify mem-alloc (jgqr), certvalidator path-builder DoS (cf2m), gnome-remote-desktop VNC TLS busy-loop (426g), m17n-lib ISO-2022 uninit read (2f3f), PublicCMS returnUrl open redirect (8c56), Authtake CSRF (54qm), role-list disclosure (8w49). KEV unchanged (catalog 2026.10.08, 1739, sha fb1621be); ToB head SequenceHash processed; PortSwigger head Oct-6 processed; PD head Aug-16; Brutecat f099b20d; disclosed DEAD (rjewel stub)]
• Oct 13 07:1xZ wave — 3 folds, no new page: Perforce Helix Authentication Service critical chain (8m68/CVE-2026-109758: install-template default SCIM bearer token copied verbatim into live config by the installer → SCIM API = user/group ops on the SSO directory gate; chains with scim-patch CVE-2026-61834 second-generation prototype pollution — the fix blocked __proto__/constructor/prototype names but traversal still follows inherited keys, so path: "toString.x" mutates shared built-in method objects process-wide, confirmed to RCE on Node 24/Express via child_process/EJS/Pug/Passport gadgets; inherited-method-name PATCH battery + install-template credential grep on the June 22 control-plane page); D-Link DCS-930L emergency HTTP recovery server mpfd_decode signature-verification bypass (5vhf/CVE-2026-108971, public exploit) folded on the Sept 16 update-key page — the bootloader/recovery listener is a separate firmware pipeline with its own, weaker verifier; recovery-artifact split + dual-path mis-signed differential workflow; GitLab syntax-highlighted-render stored XSS via crafted repository (ggg2/CVE-2026-92883) on the July 29 inventory — highlighter attribute passthrough. Tracked no-publish: WP vuldb XSS/upload singles (Weaver Xtreme/FV Simpler/IDX Broker/WP Testimonials sanitizer-reversal/WP-BusinessDirectory unauth arbitrary-location upload), SourceCodester PIMS five-leg + HRMS session-role + Online-Exam cookie-comparison SQLi/auth singles, PaddleX NormalizeImage.scale + comfyui_segment_anything SLConfig _file2dict code-injection (model-config eval class), simple-git 858h timestamp sync. KEV unchanged (catalog 2026.10.08, 1739, sha fb1621be); ToB head SequenceHash processed; PortSwigger churn 59b1ab6e head Oct-6 processed; PD churn d978faaa head Aug-16; Brutecat f099b20d; disclosed DEAD (rjewel stub)
• Oct 13 03:3xZ wave — 1 new page + 2 folds: Metasploit msf-ws per-handler auth omission + GitLab regex-validator RCE + fail2ban log-format ban-confusion = new page msf-ws/regex/log page — msf-ws credential store unauthenticated PUT/DELETE on default 0.0.0.0:8080 (4r4h/CVE-2026-87689 critical, fixed 6.5.5: every route in CredentialServlet calls warden.authenticate! except two; whole engagement credential vault — passwords, hashes, keys — writable/deletable with zero auth; operator-tooling infra is a recon target in its own right + 401-from-middleware vs 403-from-logic anonymous route-table sweep = the missing-handler-auth oracle); fail2ban sshd filter on <ip> suffix = unauthenticated attacker picks which IP gets banned (xw36/CVE-2026-109786: OpenSSH logs usernames verbatim, log consumers are enforcement decision-makers whose input grammar is attack surface — verbatim-logged field + downstream parser suffix-token battery, lockout-class = lab proof only); GitLab 19.2.8/19.3.5/19.4.2 batch: unauth RCE via crafted regex in CI/CD config (9hj5/CVE-2026-97229 critical — the regex validator is parser attack surface, Spring4Shell/Symfony/JFrog lineage; regex-evaluation-at-the-gate sweep), Duo agent instruction-context injection executes attributed to other users (5vgp/CVE-2026-96893 — attribution confusion as distinct impact class), raw-file cache poisoning → pipelines execute crafted content + protected env exposure (49cv), import URL TOCTOU SSRF (mv9g — validator and fetcher resolve different answers); SAP Oct Patch Day: MII admin provisions elevated account on underlying Java EE = app-admin→platform-admin break-out (v27c/CVE-2026-89108), Cloud SDK tenant_subdomain OAuth2 SSRF leaks client credentials (m3j7 — tenant slug picks the credential destination), S/4 rule DSL → executable ABAP (mw39), ABAP session-manager regression reintroduces a fixed authz weakness (hxp9 — patched ≠ re-tested, re-run old probes post-upgrade), HybridTokenAuthenticator ambient IAS/XSUAA issuer acceptance (2v6r). Folds: 20-leg GitLab scope-drift/GraphQL inventory on the July 29 GitLab page; MII elevation + tenant-slug SSRF + DSL-parity + ambient-issuer legs on the Aug 11 SAP page. Tracked no-publish: AI model-loading eval/deser singles (TinyLLaVA/LightX2V/yolov13/RAE/torchdistill — July 16 + Sept 11 classes), vuldb SQLi/XSS singles, SAP boilerplate XSS/info-leak pack. KEV unchanged (catalog 2026.10.08, 1739); ToB head SequenceHash processed; PortSwigger head Oct-6 processed; PD head Aug-16; Brutecat f099b20d; disclosed DEAD (rjewel stub)
• Oct 13 00:3xZ wave — 1 new page + 1 fold: Frappe/ERPNext coordinated wave (~70 GHSAs, fix bands 15.98–15.121.3 / 16.6–16.35.0 — the advisory set is a per-patch history map) = new page Frappe wave — @frappe.whitelist() auto-exposes every decorated method as /api/method/* RPC and authorization is per-method opt-in: ~30 same-sentence "endpoints fail to enforce authorization" advisories = the vendor's own ungated-method inventory, audit kit = enumerate whitelist decorators + lowest-token sweep + verb-parity (create/read/update/delete/submit/cancel/amend separately gated is this product's native failure mode); record-creation endpoint takes the record TYPE from the request and inserts with permission checks disabled → zero-role user creates privileged accounts, full site takeover (f3v4/109667 8.8); unrestricted (non-sandboxed) Jinja SSTI via user-controlled message fields → read/write arbitrary DB data, delete documents, server outbound requests, send site mail — one expression, four impact classes (cw68/109652 8.8); endpoint honours caller-supplied flag disabling its own permission enforcement (g24j/109621 — ignore_permissions-style parameter fuzz battery); outgoing email HTML attribute referencing a local file path = arbitrary file read with the mail pipeline as readback channel (3cf9/109601); JMAP get_mailboxes/get_quota accept another user's account ID — mailbox names, counts, automation rules with sender addresses (8q8g/109675 — principal-as-parameter class); unauth public booking-page stored XSS → privileged-session ATO (rcfr/109633 8.1); config-field SSRF writable by common ops roles (r69h/109651); pdfkit dependency SSRF/LFI readable through generated PDFs (8q9q/109603); SQLi by no-role users (59gg/109608 8.8); fix-band spread = per-host open-leg fingerprint (version-diff before choosing test cases, Brocade/ClearPass pattern). Third independent Frappe mail-boundary break in five months (May 6 signup-OTP leg) same-product re-sweep validated. Fold: **IBM DataStage Cloud Pak for Data — forged TLS cert MITM captures the session-adapter-auto-attached IAM bearefull platform-scope tenant API access** 28j/CVE-2026-84418) on the Oct 2 cert page — auto-attaching request adapters are token-leak amplifiers, grep the client-construction site not the app config, CP4D-wide sweep pattern. Tracked no-publish: IBM i authenticated pack + TRIRIGA pair + DataStage authenticated path-traversal/disclosure/DoS singles + Aspera local singles (IBM boilerplate class), Mistral.rs/CityGaussian sparse singles, Frappe dashboard-filter jQuery XSS h2g2 (known rich-text-render class). KEV unchanged (catalog 2026.10.08, 1739); ToB head SequenceHash processed; PortSwigger head Oct-6 processed; PD head Aug-16; Brutecat f099b20d; disclosed DEAD (rjewel stub)
• Oct 12 18:3xZ wave — 1 new page + 6 folds: Grav coordinated wave (~13 GHSAs, core 2.0.22–2.1.6 + plugin ecosystem) = new page Grav wave — Login OAuth provisions real password-backed accounts from public identifiers: username <provider>.<id>, password = unsalted MD5 of the provider identifier, password login left enabled → anyone who learns a provider ID logs in as that user incl. admins (9qx4/109321 critical; audit every SSO provisioning flow for password-hash creation + provider-ID-derived preimages); 2FA gates the door not the house — remember-me cookie obtained after the password step restores a fully-authorized post-2FA session (mp6q/109313) and a PENDING-2FA session reaches update_user from any published page form to clear twofa_enabled pre-factor (m37v/109312) → pre-factor capability sweep belongs in every MFA test matrix; publisher-authored page shadowing the reset route harvests username + bearer reset token from render scope (7cwq/109314 — auth-family route namespaces shared with user-authored content); Clockwork profiler trusts loopback REMOTE_ADDR (any same-host proxy reads config/secrets, pm6p/109325) + redaction list omits system.debugger.token so a Twig-capable editor renders the profiler's own auth key (r6g3/109315); bundled web-server configs deny .git at document root only → /user/.git/config serves nested-repo config/refs/objects (7mh9/109326 — nested-git probe step for any flat-file host); Git Sync --author string = editor-controlled shell substitution → web-user RCE (cp28/109318); disabled accounts keep API access on existing sessions (wcc2/109320 — revocation × transport battery); scalar admin/api parent grants satisfy requireSuper (7ghm/109317). Folds: SurrealDB THIRD wave 10 legs on the June 19 page — USE statement + Surreal-NS/Surreal-DB headers switch tenants with no level check (j6qq/jhvg), ON DELETE CASCADE runs with permission checks disabled (776g — parent-verb authorization implicitly authorizes ACL-denied child verbs), JSON Patch copy/move resolve against the unreduced record (xwrw), LIVE SELECT projections + WHERE predicates = two new hidden-field oracles (578j/7c4p) — field-ACL testing is an oracle-inventory exercise; ZITADEL four-leg on the Sept 16 IdP page — SAML callback verifies signature against URL-named provider but resolves user from the intent without matching the two = org-admin registers own-key IdP → ATO any user any org (65fv/109372 critical), unsigned/empty-token session cookies + time-ordered session ids = unauthenticated ATO incl MFA-complete admins (ff7c/109373 critical), pre-factor username mutation lockout (2464/109371), END_USER_IMPERSONATOR roles satisfy admin.impersonation (7j9c/109374); LibreNMS pair on the Sept 7 page — HTTP Basic PHP_AUTH_USER: * LDAP filter injection, existence-only auth → wildcard match = admin (rx4g/109357 critical; filter metachars in identity fields), array-typed notification_id[] SQLi with persisted-UI-readback channel (g9jw/109353); Adminer BOM-prefix ATTACH/VACUUM INTO bypass → table-named-as-PHP RCE (q48c/109347) on the Aug 25 page — statement blocklists have invisible-character shadow grammars; better-auth device approval renders NO client_id/scope = consent-phish vector (v9c8/109346) on the June 4 page; Open WebUI 0.11.4 wave on the May 16 page — terminal WS checks access on first message only (deactivated users keep executing, wqjg), disabled backend index reachable via explicit index param with keys attached (32hx), /tools/export leaks read-only tool source incl. embedded keys (7rgv); Network-AI deny-hook matches only the FIRST present candidate field (benign file_path + malicious content = web-shell writes, 8x93) + loopback dashboard CSWSH (q84g) on the June 19 page; SiYuan plugin ResponseFile.Path → gin Context.File absolute read (API token/conf.json, g3cr) + unrestricted Sprig map one-request OOM (q79h) on the July 10 page. Tracked no-publish: MarkLogic ~16-leg detail-free dump (XXE-by-default + SAML-parser XXE, revisit on bulletin detail), MONAI plaintext-HTTP pickle pair (AI supply-chain class, KEV-watch), ExLlamaV3 OOB kernel-index dispatch (crash-only, June 30 lineage), OpenShift Helm SSRF + Quarkus Panache sort (classes covered), DOMPurify 3.4.16 pair, vLLM PyAV fallback, Edimax quartet, Zebra pack, WP singles. KEV unchanged (catalog 2026.10.08, 1739, sha fb1621be); ToB 9498f6e8; PortSwigger 07adb06c; PD head Aug-16; Brutecat f099b20d; disclosed DEAD (rjewel stub)
• Oct 12 17:1xZ wave — 4 folds, no new page: AnyDesk Linux "AnyPwn" pre-approval root RCE (CVE-2026-109390 / GHSA-p2jv-fpmf-jqjw, critical, fixed 8.0.3, public PoC with working exploit) folded on the Sept 23 desktop-surface page — mode-5 stream handler uint32(declared_len+0x10) wrap for declared 0xfffffff0..0xffffffff = tiny allocation + huge logical length; consent prompt sits BEHIND the parser; TCP/7070 + relay paths; near-2^32 varint fuzz battery + consent-UI-is-not-the-boundary rule. ShareFile Storage Zones Controller ≤5.12.6 three-leg chain (CVE-2026-93693/-93694/-93695) folded on the July 30 URL-policy page — vendor-described unauthenticated chain to local-handler SSRF via unsafe JSONP + queue validation gaps, ack-callback-URL race steering copy-worker metadata, remote file ID spliced into local temp path without containment → write anywhere the service account can (IIS-served dir RCE). **JAXB relied solely on FEATURE_SECURE_PROCESSING for XXEefense (CVE-2026-92877 / GHSj929-4rw7-84fh, fix PR jaxb-ri#2013) folded on the May 4 Quarkus/RESTEasy XXE lineage — FSP is per-JAXP-provider limiting not blocking; runtime factory-class check + four explicit features are the fix shape; library-constructed parser inventory is separate from app-constructed. DJI DUML over BLE pair (CVE-2026-77812 critical passive PSK/SSID/UUID cleartext sniff + CVE-2026-78306 unauthenticated BLE command interface rewriting PSK/country-code) folded on the Oct 1 wireless-management-plane page — BLE-as-credential-delivery-into-Wi-Fi class, passive-first range-bound validation only on own aircraft. Tracked no-publish: SGLang 15:32Z multimodal-budget legs (2mhj/h3xf/4fxq/6h2g/fqvf — client-controllable fps/max_frames over GLM-V limits + decompression-amp DoS pack, sibling of July 30 page's multimodal section, DoS-class), Thelia 2.6.0/2.6.1 ten-leg CMS wave (Smarty template RCE/upload/XSS known classes), jshERP/MoguBlog/TDuck/yshop-crm/lamp-cloud vuldb missing-authz waves, Linksys E1700/Netis router singles, ManageIQ YamlLoadAliases deser rwm4 (known unsafe-YAML class), mac-shell-mcp cmdi ffv7 (MCP shell-wrapper canonical), hexpm hex_core cert-validation fail-open 5rf8 (tracked: warn-then-send-without-ssl shape), mutter/janus/tftp-hpa/Zen Cart/AnyDesk-adjacent lows, Vikunja m687 CORS already on Oct 9 page. KEV unchanged (catalog 2026.10.08, 1739, sha fb1621be; RouterOS 84411 + 103903 + AnyDesk 109390 all still not KEV'd — watch AnyDesk, public PoC + no KEV = head-start window). ToB 9498f6e8 head SequenceHash processed; PortSwigger churn 8ae57e41 feed reorder, nothing newer than processed Oct-6 head (07adb06c); PD 7c040f86 head Aug-16; Brutecat f099b20d; disclosed DEAD (rjewel stub). Baseline 9e67849 -> this commit
• Oct 12 09:3xZ wave — 1 new page + 2 folds: OTRS coordinated wave (9 GHSAs, fixed 2026.7.X, CE 6.x + derivatives very likely affected) = new page OTRS wave — Remote-User: header = unauthenticated Generic Interface login (prj2/93582 9.4: CE ≤6 HTTP Basic modules accept REMOTE_USER/HTTP_REMOTE_USER as the already-authenticated username, CGI/mod_perl maps ANY client header into HTTP_* env, no password step; OTRS 7+ Mojolicious not affected — third Remote-User-family sighting after the July 24 Caddy underscore-alias leg, now highest severity: send identity headers with no creds on UI AND every API/interface path, grep HTTP_REMOTE_USER reads); JWT survives deactivation/password change ~16h (f6jh/78357 9.1: kill-then-replay battery (a) deactivate→replay (b) password-change→replay (c) demote→refresh (d) revoke→sweep every delivery path — TTL is the attacker window, weekly pattern with SmarterMail/Vikunja/Strapi); unauth Agent Frontend config endpoint = pre-login authorization map (8jjm/78356: routes + authorization groups + enabled features + integrations before any creds); SendSupportBundle traversal deletes files as app user (mjfj/78355 8.7, support bundles = standing targets); per-backend email-uniqueness drift (49rp/78359: DB+LDAP, uniqueness checked only in selected backend → ticket mail misroutes to attacker-planted record); inbound-email→CSV export formula injection, no attacker account (r7mj/93581); GET-mutable tokenless admin CSRF incl. config deploy/sync verbs (hq7p/78358) + TemplateDelete CSRF (f36p/48211) + admin-authored Custom Page stored JS (x238/48212). Folds: Kong Gateway hybrid-mode clustering-RPC SQLi (gjvg/1907 high: mTLS peer channel trust ≠ input validation — post-cert RPC grammar is the attack surface, fingerprint feature-named cluster ports) on the Sept 21 management-plane page; Keycloak CIBA public-client flow ungating (68jh/109082: no per-client flow authorization → any public client pushes a genuine-IdP approval prompt = phishing-grade ATO w/o secret; feature-enabled ≠ client×flow-gated battery) on the Sept 16 IdP page. Tracked no-publish: Kong-adjacent vuldb CMS singles (idcCMS/SEMCMS/WMCMS), agno-agi trio sparse lows, WP plugin sparse singles (Restricted Users/WP Desk/WP User Manager/event-post/VideoWhisper = Sept 19 WP page classes), OTRS CSV/CSRF legs folded on page, Emacs TRAMP + OpenSSH double-free + ansible.posix re-listings. KEV unchanged (catalog 2026.10.08, 1739, sha fb1621be); ToB fea2d7b6 churn (feed redirect stub) head SequenceHash processed; PortSwigger 07adb06c head Oct-6 processed; PD 7c040f86 head Aug-16; Brutecat f099b20d; disclosed DEAD (rjewel stub)
• Oct 12 06:3xZ wave — 1 fold, no new page: Metasploit Framework ios_image_gather loot-path traversal → operator workstation RCE (GHSA-663p-9fgr-v7m7 / CVE-2026-87690, high 8.8, fixed 6.5.5) folded on the Sept 23 desktop-surface page — gather module interpolates target-controlled Meterpreter directory-listing names into the local download_file() destination, so ../../msfconsole.rc escapes the random loot dir and overwrites the rc file every msfconsole launch auto-executes; rc can load a second traversally-written Ruby plugin → persistent code exec as the operator on the pentest workstation. Rules: the loot directory is a trust boundary — sweep every operator-side path built from remote listing/metadata for separator scrubbing per call site (the recursive sibling already had the scrub, the gather module didn't); enumerate auto-exec surfaces in the operator home before scoring any tool-side traversal; vulnerable call signature greppable across forks in seconds. Tracked no-publish: Foreman search-limit-not-applied pair (4fvc/j63r, delegated-scope class covered Sept 18), Samsung SMR Oct-2026 ~25-pack (local memory-safety/component-export class), TRENDnet EOL pigwidgeon.cgi cmdi (EOL-only, known class), Flock Night Shift bulk-license-plate SQLi cross-org read (remediated thin single), RuoYi/ZKTeco BioTime/Cicadas-class vuldb sparse singles. KEV unchanged (catalog 2026.10.08, 1739, sha fb1621be); ToB 9498f6e8; PortSwigger 07adb06c; PD e2a1b747 churn head Aug-16; Brutecat f099b20d; disclosed DEAD (rjewel stub)
• Oct 10 18:31Z wave — 1 new page, no folds: HaiND MCP coordinated wave (5 GHSAs, all with pinned-source VulnCheck writeups = fix diffs as attack maps) = new page MCP coordinated wave — 1MCP Agent tag-scope bypass (w2j7/108586): scope check validates leaf tags MENTIONED in advanced boolean tag-filter, never what the expression SELECTS — tag:internal-only token sends not internal → authorized → selects every NON-internal backend, listed AND invocable (invocation guard reuses poisoned visibility set); argocd-mcp route smuggling (f7cg/108585): delete_application splices applicationName unencoded into /api/v1/applications/${name}, new URL collapses dot-segments → ../repositories/<enc> = DELETE /api/v1/repositories/<repo> with server bearer token, default-on unless MCP_READ_ONLY; Octop provider-key oracle (c344/108581): GET /api/providers gated by JWT-only current_user while admin twin has require_permission("providers"), shared serializer emits raw api_key — any authenticated non-admin reads all admin LLM provider keys; GenOffice tokenless filesystem (29j6/108582): HTTP MCP uploads world-readable /tmp store, modeless mkdir/writeStream → 0755/0644, second UID cats other clients' docs, bearer token never runs for local open(); zotero-mcp guard-asymmetry SSRF (rc65/108583): generic webpage branch plain requests.get follows redirects while project's own _url_resolves_to_public_host+per-hop guard wired into PDF siblings only, blind citation-field readback channel. Rules: on any filter DSL over authorization labels send the complement probe (not <granted>); grep template-literal URL construction in every MCP/API wrapper, smuggle with a local recording sink; diff /api/X vs /api/admin/X bodies with the lowest-tier token; mode-inheritance audit on shared-tmp services; grep guard-helper call sites vs raw-fetch call sites for ungoverned siblings. Tracked no-publish: WP wave (Tickera SQLi wpf6, WooCommerce privilege-assign m8vc, AFFI/Super Video Player PHP object injection pair, VillaTheme content-injection pair, Bayarcash BAC, Labtechco XSS — patchstack sparse singles, classes covered Sept 19 WP page), AniWorld login brute-force, OpenPanel cohort CSV formula injection (known CSV-injection class). KEV unchanged (catalog 2026.10.08, 1739, sha fb1621be); ToB feed empty this run; PortSwigger head Oct-6 processed; PD head Aug-16; Brutecat f099b20d; disclosed DEAD (rjewel stub)
• Oct 9 21:1xZ wave — 2 new pages + 3 folds: Vikunja coordinated wave (~25 GHSAs, third Vikunja wave in ten weeks) = new page Vikunja wave — scoped token with only oauth.authorize mints unscoped JWT+refresh via authorize→token exchange (v3p6/57458); principal-type confusion second wave at three sinks the first fix never touched — self-removal fast path u.ID==GetID() runs BEFORE the only link-share rejection (32r8/76216); single-read vs list gate drift: read-only member gets the link-share hash (the bearer credential) and mints admin-level tokens (qfwc/91985); DELETE authorizes on a caller-constructed zero-value object — deleting an admin-tier share needs only Write (fmmf); MAX-over-subtree inheritance silently ignores explicit down-restriction (pjr3); expand= query param embeds comment/reaction/time-entry data with scopes never consulted — route+method-only scope matching (9rg3/91983); v2 pre-auth endpoints unthrottled while v1 twins 429 (6rvj/91972, verified PoC); v2 user-search accepts link-share tokens v1 rejects (vfxw); REST-vs-CalDAV parity: relation create ungated over CalDAV, learned UIDs survive revocation (g38j); revocation cleanup row-set omits webhooks+link_shares — removed collaborator keeps a live push feed, routine wired to 1 of 4 paths (hjx8); WS auth never resolves the sid claim — deleted sessions keep connecting (4hv6); ship-default CORS localhost:* + AllowCredentials, publicurl appends not replaces (m687); TOTP secret readable post-enrollment while disable needs the password (88f6); throwaway-project team-attach → instance-wide roster oracle (39p5); one-sided FK surviving in the sibling of a fixed endpoint (w39f); zero-accessible-projects fail-open returns every task in the instance (fprf); plaintext reset tokens while CalDAV tokens are bcrypt'd (r6w9). Rules: minting-flow scope-ladder probe; sibling-surface parity matrix FIRST on this product class; permission gates on stored state not caller-shaped objects; revocation = artifact×path battery; read-vs-step-up asymmetry on secrets. TinaCMS four-leg cluster = new page TinaCMS cluster — hash-router splat picks both the admin preview iframe src AND the postMessage expectedOrigin trust anchor: #/~//attacker/ = one click = arbitrary GraphQL read/write as the signed-in editor (x34j/108261 critical); git branch name interpolated raw into generated client.ts string literal = build-time RCE from a branch name (pwhx/108259); tina-markdown el.href = node.url with no scheme check while DOMPurify covers only html nodes and returns before the anchor branch (c42q/108260); Shiny _state_id_ bookmark-restore traversal firing even with bookmarking disabled (47c3). Folds: Nginx UI wave continues (same CVE band, second batch): restore as normal user overwrites app.ini incl. settings-API-denied fields → TestConfigCmd → root RCE (p393/107806 9.8); shipped bundled-proxy topology never sets trusted proxies → loopback exception defeats IP allowlists + shared-ban lockout (9h23/107804); body fsync'd BEFORE signature validation (j3hg/107805) on the Oct 9 Nginx UI page; Contao 7-GHSA core wave: DI config registers a voter class that doesn't exist on disk → silently absent access control, boots clean, any module user lists all preview links (q6wp/107850); voter caches per-user not per-(user,table) (5974/107851); join-without-isBasePath unauth traversal+oracle+debug path disclosure (mrvp/107844); comments-queue stored XSS: moderation guarantees exposure, no backend CSP (628f/107845 critical); index_protected toggle leaves stale protected rows in search index (x2rp/107842) on the Aug 6 CMS page; Vikunja OIDC emailfallback email-only linking, email_verified absent from the claims parser entirely (xv7q/62367) on the Sept 16 IdP page. Tracked no-publish: Vikunja DoS quintet 91968-91979 + duplicate markers, yopass unbounded Prometheus labels, pacioli consent-marker, ageLANServer AoE3 JSON-array, Contao activation-mail resync + generic CSRF, OpENer re-listing. KEV unchanged (catalog 2026.10.08, 1739, sha fb1621be); ToB fea2d7b6 churn head SequenceHash; PortSwigger 2ac9b515 fetch churn, head unchanged; PD 7c040f86; Brutecat f099b20d; disclosed DEAD (connection refused)
• Oct 9 19:1xZ wave — 1 new page + 3 folds: SmarterMail build-9777 wave (3 GHSAs) = new page SmarterMail wave — refresh-token redeems stale role claims: JWT access+refresh embed role at issuance, /api/v1/auth/refresh-token never revalidates against current role → demoted admin refreshes back into DomainAdmin/SysAdmin until TTL (3wv9/104084; role-snapshot-vs-binding lifecycle probe: issue-high-demote-refresh-only); SysAdmin-token → SYSTEM RCE via containment-by-second-endpoint (4rp5/104082): domain-put accepts arbitrary FileStore root INSIDE trusted Scripts dir, chain = AddOrUpdateMount discloses Scripts path + global-mail clears upload extension blacklist + mail upload lands script + CommandMount save triggers RunScript BEFORE validation; iCal-delivered MathML mXSS (vvh8/104083): <math><mtext><mglyph><style> treated as inert CDATA by custom sanitizer, browser foreign-content reparse → live <img onerror> in webmail message iframe, permissive CSP. Rules: a role claim is a snapshot not a binding — test demotion-then-refresh on every RT-bearing product; containment controls gating a destination lose to any other endpoint that lets you NAME the destination; custom sanitizers never modeled MathML/SVG foreign content — run the mXSS battery through whatever content-type the product ingests (iCal!). Folds: Pingvin Share X critical OAuth auto-link ATO (7p7c/108157, auto-links by email, email_verified never checked, attacker-registered victim email on attacker OIDC provider = login as victim incl admins, TOTP bypassed) on Sept 16 IdP page — federated login matrix must record whether local MFA is enforced on the linked path; busybox tar deferred-hardlink escape (v87q/108119, symlink target exactly .. + deferred hardlink created without re-resolving destination; two-invocation archive reuse = stage-A/stage-B across runs) on July 28 extraction page — validate-at-enqueue ≠ validate-at-execute; Camel Karavan pair fixed 4.22.1 (5c9w/103413 any-role user's kubernetes.yaml applied with the tool's cluster SA, hostNetwork/hostPID/hostPath/privileged pods unblocked + namespace unpinned; 8cgr/103412 project filename verbatim path segment at Git commit-write → classpath write → RCE in container) on June 22 control-plane page — low-code/IDE layer = confused deputy with cluster credentials. Tracked no-publish: Go stdlib CONNECT 2xx-continue + CONNECT-body pooling legs (already promoted Oct 9 00:3xZ on June 11 Undertow page — re-listing), Go Windows junction mkdir c3q7 (already folded July 28 page Oct 9 00:3xZ — re-sync), multipart <400B limit bypass 874m + ECH multi-reference hq7w + Range CPU loop f4xw (DoS class), OpENer EtherNet/IP 5-leg memory-safety pack (OT parser class, thin GHSAs, watch for KEV), ILIAS QTI upload, ruoyi-ai workflow IDOR pair, MOVO chat-api path fetch, plugNmeet whiteboard traversal, SmarterMail tracked-in-page, AstronRPA XSS+unsigned-update pair, LobsterAI path control, Apache Camel Karavan tracked above, busybox tracked above, Hayat Hospital client-side-auth single, GIMP XCF metadata. KEV unchanged (catalog 2026.10.08, 1739, sha fb1621be); ToB feed fetch empty this run (head SequenceHash unchanged); PortSwigger 07adb06c head Oct-6 processed; PD churn head Aug-16 processed; Brutecat f099b20d; disclosed DEAD (rjewel stub)
• Oct 9 17:1xZ wave — 1 new page + 3 folds: Nginx UI coordinated wave (7 GHSAs, CVE-2026-107807–107813) = new page Nginx UI wave — /api/nodes returns the node token unredacted to any authenticated user and that token IS the X-Node-Secret that middleware upgrades to initUser = low-priv → cross-node admin ladder (32gc/107811); same secret accepted via ?node_secret= query fallback in HTTP+WS middleware = permanent log/proxy/Referer/config leak → persistent unauth admin (pvgv/107807); passkey-only accounts login on password alone — UI enabled_2fa = OTP||passkey but login handler branches on EnabledOTP() only (45gv/107808, flag-vs-enforcement drift); incomplete fix: step-up middleware wrapped 5 sibling routers, missed the separate api/cluster router — node CRUD + cluster-wide reload/restart on bare JWT, no OTP step-up (h246/107813); backup restore extracts inner archives BEFORE consulting RestoreNginx flags + zip allows absolute symlinks confined by target-prefix then writes later entries THROUGH them → live nginx config write with both flags false (p8v3/107810); JWT-in-cookie fallback in AuthRequired + no CSRF/Origin check = ambient-credential CSRF on management APIs (33rr/107809); self-upgrade verifies binary only by a SHA-512 digest fetched from the SAME origin, no signature, runs as root + github_proxy accepts http:// (662p/107812). Rules: M2M shared secrets that select an upgraded identity are the top gate to hunt on clustered tools; credential-in-query grep on every auth middleware; enumerate all router registration sites after a security fix (vendor fix commits are attack maps); extractor-before-decide + link-target-vs-resolved-path containment checks. Folds: Argo CD repo-server SSH-proxy cmdi (j6cw/CVE-2026-55797, v2.11.0→3.3.15, project-scoped repo perm = RCE into credential-bearing pod, credential-template fan-out) on the May 4 Argo page; pyLoad 8-leg wave (password-change/permission-revoke sessions never invalidated, check_apikey CACHE bypass, XFF-trusted rate-limit/audit spoof, /web/ route auth miss, extractall lands device nodes/FIFOs, addon SSRF parity) on the June 8 pyLoad page — auth-cache revocation-free side channel is the new axis; openPDC/openHistorian OT wave (9.8 service-console client deserialization gated only by Windows-Auth config, unauth-by-default data publishers = full measurement topology recon, caller-specified Modbus host:port = internal OT mapping oracle, fixed admin cred in published Docker image) on the Sept 16 OT page. Tracked no-publish: Netcore/lwIP/illumos appliance+OS pack, PHPNuxBill RADIUS-CHAP auth bypass + unauth SQLi (small-market ISP billing, classes known), HortusFox SQLi+upload pair, KodExplorer unzip_pre_name traversal, Docker Desktop Windows unsigned-package (known update-integrity class), Affinity-by-Canva memory-safety pack, Firefox/Chrome re-listings, Open5GS heap-OOB/reachable-assert trio, gVisor VFS UAF, QA Analytics heatmap re-listing. KEV unchanged (catalog 2026.10.08, 1739, sha fb1621be); ToB feed fetch empty this run (head SequenceHash unchanged); PortSwigger 07adb06c; PD churn head Aug-16; Brutecat f099b20d; disclosed DEAD (rjewel stub)

• Oct 8 19:1xZ wave — 2 new pages + 5 folds: OpenStack Mistral orchestration-plane wave (4 GHSAs, through 23.0.0) = new page Mistral wave — std.ssh_proxied passes caller proxy_command straight to paramiko.ProxyCommand(): arbitrary command as the executor service account BEFORE the SSH connection is attempted, DEFAULT config, any project member (gxqc/93858 — enumerate built-in action catalogs on every orchestrator: legitimate feature semantics include process launch); /v2/maintenance clears request context + zero policy: any valid token sets cluster-wide PAUSED = cross-tenant kill-switch (858j/93860 — /maintenance|/admin|/service controller families with lowest-tier tokens); resolve-then-write returns another project's row, workbook name-collision adopts foreign resources into your project (73hv/97147); share-acceptor re-grants membership to a third project with owner-blind, owner-undeletable grant rows (p254/93861 — grant-creation scope-field default = persistence primitive; owner-side revoke-every-path battery on any share API). Malcolm NSM stack wave (6 GHSAs) = new page Malcolm wave — Lua RBAC pattern-matches the RAW percent-encoded URI, nginx routes on decoded/normalized: /%68tadmin.php = restricted location, gate blind (rgrh/107334, every RBAC path family); "Dashboards→Arkime" case-insensitive matcher + case-sensitive rewrite falls through to the ONLY proxied location without the auth include, X-Forwarded-User un-overwritten and trusted = unauth forged full-access identity (c366/107336); kiosk POST /script_call/<script> zero auth + wildcard CORS → CSRF control.py --wipe destroys all captured PCAPs (hfc4/107337); vendored FilePond index.php fetch route = curl-any-URL FOLLOWLOCATION + HEAD variant stores body, returns transfer ID = full-readback SSRF (6x93/107362); arkime-live host-network port 8005 on all interfaces, trusts X-Forwarded-User from ANY IP, auto-provisions full-access users, passwordSecret hardcoded "Malcolm" (9jvx/107361 — bypasses the whole proxy stack); safe-extract limits skip single-stream .gz/.bz2/.xz = gzip bomb on shared OpenSearch/Zeek volume (ffq8/107335). Rules: reverse proxy = multi-parser system, diff gate-input vs router-input (encode one char, vary case, /., ;param, duplicate slashes); enumerate per-location auth coverage in shipped configs; identity headers are credentials when the backend can't distinguish proxy from caller; decompression guards are per-format. Folds: Zimbra authorization trio promoted from release context on the Aug 21 page — GrantRightsRequest self-grants OTHER accounts loginAs = standing backdoor surviving password change (6c75/50054), Sieve notify bypasses disabled forwarding (p88h/50055 — policy-name-vs-dataflow audit of every user-scriptable egress), EWS FindItem cross-mailbox raw-MIME read while webmail enforces (7jfc/10631 — per-protocol-authorization sweep); FFmpeg RTSP 3xx Location followed without whitelist check, -protocol_whitelist defeated on the redirect hop (jhxg/107698) on the July 30 URL-policy page — guards consume hop #1 only; Obsidian Desktop pair on the Sept 23 desktop page — DOMPurify-surviving data-background-iframe consumed by bundled Reveal.js javascript: → parent.require() (fj5r/104077) + MathJax filterURL TAB-in-scheme → empty-protocol safeProtocols bypass (4pcg/104078) — sanitizer permits attribute NAMES, frameworks consume values; Node-integration+no-isolation = XSS-vs-RCE delta; bundled-framework version grep = desktop recon; go-getter S3/GCS directory-download traversal (86f4/19585) on the June 19 IaC page — object keys are archive entries; GnuTLS 3.8.13 CN-fallback hostname bypass (2j2x/88647) + accept-invalid-extensions pair + wolfSSL 5.9.x name-constraint regression (vf9w/95208) on the Oct 2 cert page — fourth week of the missing-comparison family. Tracked no-publish: FFmpeg HLS/DASH/RTSP DoS + uninitialized-disclosure + libssh no-hostkey pack, QloApps id_hotel cross-hotel IDOR, HP Sure Click kernel overflow, MainWP Child object injection, wolfSSL DoS twin, rejected duplicate CVEs. KEV unchanged (catalog 2026.10.08, 1739, sha1 4f643898); ToB 25d2bbee head SequenceHash; PortSwigger 07adb06c; PD churn 7c040f86 head Aug-16; Brutecat f099b20d; disclosed DEAD

• Oct 8 18:1xZ wave — 1 new page + 5 folds: Handlebars template-injection triple (npm handlebars 4.0.0–4.7.9 → 4.7.10) = new page Handlebars wave — 9.8: compile()/precompile() accept a JSON-shaped AST; the 4.7.9 validator checks only PathExpression/NumberLiteral/BooleanLiteral values, Program.blockParams.length (type-less object property) is written raw into container.program(...) = JS execution at render time with DEFAULT options, even when the block helper does not exist (validator-coverage ≠ compiler-consumption — enumerate what the codegen reads, not what the validator checks); Function.prototype.constructor is an OWN property → lookupProperty hasOwnProperty early-return skips the deny-list entirely → Function → RCE with allowProtoMethodsByDefault:true (own-property twins defeat prototype deny-lists — vm2/devalue genealogy; run the __proto__→constructor walk on every JS template/sandbox); precompile() JS-quotes but never HTML-escapes — </script> inside a generated string literal terminates the inline script element (escaping correctness is per embedding context; raw-curl the embedding page, DevTools DOM hides the breakout; raw-vs-escaped bytes = passive version oracle). Folds: Coraza SECOND tier (6 legs, fixed 3.8.0/3.8.1) on the Oct 6 Coraza page — JSON key-collision decoy-overwrite bypasses complete current CRS (dot-flattening without escaping: {"account":{"role":"SQLi"},"account.role":"safe"}), Content-Type media-type parameter skips form body inspection (exact-string header equality), filename*=iso-8859-1 drops WAF-side filename = decoy real-name pair, cookie CTL trim (space/tab vs RFC 6265 C0), t:jsDecode octal off-by-one nulls every \ooo escape (WAF-blind JS-octal payloads), malformed-URI branch silently empties QUERY_STRING with the compensating code commented out; rules: flattening is collision-prone, header-dispatch equality breaks on legal params, legal-but-unusual encodings on every carrier = divergence battery, commented-out fallbacks = pre-located tests. JHipster generator itself (fixed 9.4.0) on the Oct 2 UTMStack page (jhi_user fingerprint compounding) — every reactive WebFlux+R2DBC generated app: sort= renders unquoted into ORDER BY, no bound params → simple query protocol → ; stacked statements (self-registered user → read jhi_user hashes; JPA path NOT affected = edition fingerprint) + stored XSS via unrestricted Blob <field>ContentType opened same-origin by generated openFile() (content-type stored unchecked server-side, consumed as trust declaration client-side); rule: generated code = shared zero-day across every app from the generator, check generator versions like dependency versions. LangChain @langchain/mongodb session-id query-operator injection (m6rx/106119) on the Sept 18 query-grammar page — chat-history session_id never type-enforced → cross-user conversation read/modify/delete; highest-prevalence operator-injection carrier yet (session/thread IDs come off request bodies by design); operator battery on every chat-API identifier. PraisonAI same-sweep continuation, 3 more legs 30 min after the 7-leg fold on the May 29 page — .praisoncontext/.praisoninclude repo-controlled outside-workspace reads INTO the model prompt, .praisonai/commands/*.md @path interpolation reads outside project into prompts (guard-parity: one containment helper, N feature loaders), PGVector/Cassandra dimension concatenated into CREATE TABLE DDL (identifier validation without value validation; fuzz numeric fields on collection-create); meta-lesson: 4 batches in 90 min = advisory TRAIN, treat first batch as backlog sample. Pydantic AI to_web()/clai web browser-reachable tool exec pair on the Feb 6 page — no Content-Type check = visited-website simple-POST triggers agent runs + local tool exec, requires_approval trusts CLIENT-relayed approval decisions (client approval UIs are not controls); no Host validation = DNS rebinding → same-origin, LNA misses top-level navigations + Safari; third advisory generation on this surface = re-sweep. datamodel-code-generator protobuf weak-import traversal (77xj/107377) folded codegen-untrusted-specs best-practice — import paths escape temp dir, writes happen BEFORE protoc and survive compile failure. Tracked no-publish: msgpack5 septet (decoder DoS/prototype-protection singles), Coraza DoS trio, PraisonAI q7m5/xpx6 folded above, Pydantic AI v36g/v2xh/fpf4/3gh4 (DoS/telemetry class), Excelize re-sync, Ghost/Payload/Next.js republications, JHipster stored-XSS react twin folded. KEV: catalog 2026.10.08, 1739 (+5): CVE-2015-3306 ProFTPD, CVE-2015-5477 BIND, CVE-2016-3081 Struts, CVE-2021-3199 ONLYOFFICE, CVE-2023-22894 Strapi — legacy-KEV sweep candidates for recon banner classes, no new operator pages; ToB head SequenceHash (Oct 2) unchanged; PortSwigger head Aug-12 unchanged; PD churn head Aug-16 unchanged; Brutecat f099b20d unchanged; disclosed DEAD

• Oct 8 17:1xZ wave — 1 new page + 1 fold (2 folds incl. fold-on-new-page): AsyncHttpClient coordinated wave (10 GHSAs, fixed 3.0.12/3.0.13/3.0.14 + 2.16.1, 2.x EOL) = new page AHC wave — critical: request replay (documented ResponseFilter failover / IOException retry) updates current-but-not-target request, so host A's path+Host+Authorization are written into host B's correctly-handshaked CONNECT tunnel (no cert mismatch), A's creds regenerate onto B's replay, A/B pool-key crossover, and http→https replay runs with NO SSL handler = cleartext credentials; Digest challenge with absent/empty nonce downgrades to Basic, base64 password on the wire (malicious origin/proxy/plaintext-hop; realm="C:\" trailing-backslash trigger is 3.0.12-only = version fingerprint); NTLM/SPNEGO pool-key incomplete fix (default Kerberos leaves principal unset → uncredentialed request draws the service-identity socket; proxy realm never keyed; CORP\alice==OTHER\alice); plaintext HTTP Set-Cookie plants/overwrites/deletes Secure cookies (6265bis steps 13/16 unimplemented, Secure only checked on retrieval; no network position needed — plaintext sibling host suffices; 2.x never fixed); Domain=co.uk public-suffix storage residual of CVE-2026-55688; store silently replaces caller's explicit Cookie header (CVE-2024-53990 fix bypassed via header path — cross-user session bleed on shared client); ws:// CONNECT tunnel leaks Proxy-Authorization to origin (scheme-boolean consumed by sibling branches with different exclusions). Rules: client-side bugs are provable entirely on your own infra (owned 401 origin, owned plaintext host, owned listener behind own proxy — ideal evidence-kit building before scope); three legs are explicit incomplete-fix residuals + one version-gated trigger = behavioral version fingerprint for headless Java backends; cookie jars get two matrices (arrive-scheme×Secure×overlay/delete on store; domain-scope incl public suffix on retrieval); enumerate every consumer of a trust boolean separately. Fold: PraisonAI SECOND multi-leg wave (7 legs ≤1.6.77→1.6.78) on the May 29 page — approval cached by tool NAME only and reused for all later args (writeile not exempt; one benign approval = standing arbitrary writes; grep already_approved short-circuits), **SkillToolsero path containment beside FileTools.alidate_path + YAML approve: pre-answers interactive gates** (sibling-class validation pary), repo .praisonai/config.toml outputile = clone-to-file-write, FastContext abs/traversal out-of-workspe reads, sibling tools.py exec_module on string output_pydantic + plugin auto-discovery exec_module (clone-and-run PR-to-RCE; env gates guard sink A not B/C), CodeAgent ignores sandbox=True, passes full os.environ to LLM code (config-flag-doesn't-gate-sink), web_crawl check-vs-connect DNS rebinding with read-back. Third multi-leg PraisonAI wave in ten days = same-product full-re-sweep rule. Tracked no-publish: Excelize quintet (spreadsheet parser memory-safety/DoS class), Pydantic AI fpf4 ReDoS + 4x9p OTel span leak, moby sys DoS, duplicate-marker GHSAs. KEV unchanged (catalog 2026.10.04, 1734, sha f51fed1c); ToB 25d2bbee head SequenceHash; PortSwigger 07adb06c head Oct-6; PD churn 7c040f86 head Aug-16; Brutecat f099b20d; disclosed DEAD
• Oct 8 15:3xZ wave — 1 new page + 5 folds: IBM DataPower Gateway coordinated wave (~36 GHSAs; 10.5.x/10.6.x/11.0.0.x bands) = new page DataPower wave — four 9.8 unauth RCE-class legs incl RFC2047 encoded-word parser OOB write (header/MIME pre-auth parse surface; encoded-word probe battery), empty-password LDAP auth bypass ⇒ administrative access (appliance↔directory trust; empty-password login test on any LDAP-federating appliance), XXE on the XML-native gateway, WS-signature validation bypass, 10.6.0.x-band-gated unauth WebUI XSS + 11.0-only key-derivation DoS (edition/band-gated legs = version fingerprints), thin-GHSA review-dump handling (IBM vendor bulletin = the real source), KEV-watch item. Folds: 389 DS two more unauth extended-op legs (CleanAllRUV filter-injection boolean cn=config oracle r7mx/11770 + StartNSDS50ReplicationRequest pre-auth stack overflow 5gg4/15722) on the Sept 7 389 page — extended ops + replication decoders are the under-audited LDAP surface; Integrics Enswitch omitted-reset-param empty-reset_key password-update ATO (qxpp/107640) + mJobTime Login.aspx SQL-exec PageMethods with client-side-only sessionStorage auth (fw9h/9209) on the Sept 21 precedence page — absent-vs-empty-vs-garbage-vs-valid battery on security params, server-unchecked state is not a control; Ollama /api/pull digest traversal → write to writable /usr/lib/ollama → root RCE on restart (w8p2/103663) on the Oct 2 AI page — content-addressed fields are path components, write-to-load-path = deferred code exec; SGLang ZMQ PickleWrapper pickle.loads fires even with SGLANG_USE_PICKLE_IPC off (w4hv/93034) on the July 30 SGLang page — audit the unwrap hook not the serializer name, config-flag not gating the sink = no mitigation; OpenShift console /locales/resource.json lng/ns traversal + dynamic-plugin backend pivot (v74g/75887) on the July 2 dashboard page — i18n loaders are file readers, namespace-selector param doubles as SSRF pivot; Keycloak read-only-role primary client-secret read via installation/registration endpoints (ch4r/107604) + DCR update silently disables backchannel-logout offline-token revocation via response-serialization omission (qxj8/107623) on the Sept 16 IdP page — export endpoint families are the un-redacted twin, GET-then-PUT strips fields GET doesn't serialize. Tracked no-publish: ImageMagick ~14-pack (known policy-bypass/parser class), TightVNC quintet (client memory-safety/LPE), Dislocker pair, league-commonmark ReDoS/XSS, EspoCRM trio, Jacamar CI account-name gen, ILIAS arg-injection, Parse Server leak, Checkmk LPE, Insights-operator RBAC overgrant, Chrome 155 re-sync, moby/sys DoS. KEV unchanged (catalog 2026.10.04, 1734, sha f51fed1c); ToB 9498f6e8 head SequenceHash; PortSwigger 07adb06c; PD churn 3f45ebfe head Aug-16; Brutecat f099b20d; disclosed DEAD
• Oct 8 12:3xZ wave — 1 new page + 1 fold: hMailServer coordinated wave (~20 GHSAs, 6.0.0–6.3.5) = new page hMailServer wave — COM classes registered with no DCOM ACL + no CoInitializeSecurity descriptor: any local console/RDP login activates hMailServer.Message/Attachments/FetchAccount in the service → arbitrary file read/write as service account + queue mail as any sender with a never-authenticated credential (Windows service COM = standing local-privilege surface, audit DCOM SIDs not docs); loopback REST admin listener answers any Host + zero throttling on local failed logins → DNS-rebinding page = full-speed admin password oracle (July 8 loopback family, rebinding + Host-decision-table + loopback-throttling axes); root Linux update helper takes its signature-verification program from a service-account-written request file (the verifier must never be data from a lower tier); admin-rights Windows CLI follows junctions/mount points into service-writable log/cert/data folders (reparse-point genealogy); installer leaves data/log/db folders + INI with DB password readable by local Users; webmail client-side S/MIME/OpenPGP decrypt offers parts as blob URLs with attacker-declared media type → decrypted text/html opens in webmail origin (decrypt raises click-through; encryption as lure for XSS) + untrusted signer cert auto-saved keyed on cert's first address not From → future replies silently encrypted to attacker (long-standing correspondence compromise from one signed mail); DANE fail-open pair: non-complete DNSSEC answer / missing RRSIG / no-absence-proof ⇒ treated as unsigned, and DANE-TA-only TLSA sets ⇒ opportunistic TLS (validation-to-decision drift = downgradable mail path from on-path/resolver position); 12-leg quadratic-complexity parser pack = mail-protocol fuzzing map. Tracked: Blowfish decode/encode heap overflows 103010/103011, detail-free troubleshooting arg-injection 9.1 hgvr, DoS pack. Fold: Eclipse Ditto Explorer split-authority OAuth (g8w6/CVE-2026-107503) on the Sept 16 IdP page — genuine IdP login, code + PKCE verifier exchanged at attacker-chosen token endpoint via crafted environments link with autoSso, config persists = one-click standing token-theft implant; PKCE binds code↔client not code↔token-endpoint; audit where the discovery URL came from
• Oct 8 12:1xZ wave — two folds, no new page: DeepSeek Harness local HTTP control-plane auth bypass (GHSA-8m2g-8cgm-3vcp/CVE-2026-82533, critical, < 0.1.2-alpha.1) folded on the July 8 browser-to-loopback section — the gate validates the client-supplied Host header instead of the TCP connection origin, so any request carrying the expected Host: localhost value gets full agent control with zero credentials: commands/execute with danger-full-access, session approval-policy escalation to unconfined, all stored conversations. Header-spoof branch of the loopback family: same-origin/CORS/rebinding assumptions no longer bound it — any same-host SSRF, front proxy, or co-tenant reaching the socket is in scope. Rules: Host is data not identity — run the Host decision table (expected loopback/public/empty/absent/numeric) before attacking token format on any local control plane; fingerprint guard implementation (socket-peer/UDS-cred check vs header string-compare); grep capability surfaces for danger/unconfined/approval — a control plane that widens its own execution policy needs no second bug. lz4-java shared-temp native-library hijack (GHSA-mcr4-qmvw-px4g/CVE-2026-106451, high, < 1.11.4) folded on the April 30 OTLP shared-temp page — .lck sentinel is randomly named but the .so path is derived by string-stripping, predictable, non-exclusive open → co-tenant wins race, controls code System.load()ed by every JVM using the lib; shared-host recon rule: enumerate loader-written predictable temp artifacts; grep fingerprint createTempFile + derived path into System.load/dlopen/exec (lock file ≠ payload file; same genealogy as Nx daemon UDS). Tracked no-publish: Ghost 1056xx second republication twins (already Aug 4 page + Sept 22 state notes: gfjp/v6q3/4pvx/53vv/v3xr/347q/jj74/m382/hqq2/322m/105647 hash-ordering), Docling p944 DoclingDocument-JSON local-image embed (already tracked-in-place June 3 page), Docling cgc7 rowspan/colspan DoS, RabbitMQ cqgh/53vv RPC-parser DoS pair, LZ4 343h/gm45 DoS pair, Langflow 8qpj re-sync (Oct 6 fold), PraisonAI fj8f duplicate marker, Next.js/Payload Oct 6-wave republications. KEV unchanged (catalog 2026.10.04, 1734, sha f51fed1c); ToB 9498f6e8/25d2bbee head SequenceHash; PortSwigger 07adb06c head Oct-6; PD churn 6dfcef86 head Aug-16; Brutecat f099b20d; disclosed DEAD. Strict build clean
• Oct 8 03:31Z wave — 1 new page + 1 fold: Brocade Fabric OS SAN management-plane wave (fixed < 10.0.1) = new page Brocade Fabric OS wave — in-band Fibre Channel vendor-unique CT requests from a compromised peer switch bypass administrative authentication entirely (password reset / reboot / firmware download with zero credentials: the fabric is a trusted message bus and an HBA foothold joins it), RADIUS VSA / directory-claim returned by any configured IdP selects root-equivalent role (validate which IdP sent the attribute, not that it arrived), RBAC engine misclassifies non-standard management opcodes (read-only user executes admin ops — proprietary opcode space is wider than the classifier), REST internal endpoints gated exclusively by client-controlled headers + management-VLAN trust decided from the Host header instead of the socket source IP, cross-logical-switch MAPS chassis dump with any authenticated user (logical-switch = tenant), session-verification cmdi where the named exploit principal is a compromised directory-service account (AD credential → SAN appliance RCE pivot), unauthenticated SNMPv3 context-name overflow + IKEv2 FCIP single-packet UDP/500 overflow + web-daemon query-param OOB, FA IdP-issuer directive injection via config-import file, SupportLink cleartext proxy credentials in support bundles, FCIP concurrent-request response crosstalk. Fold: Octopus Server multi-scoped permission aggregation over-grants (w6j2/CVE-2026-102488, SA2026-12) on the Sept 21 auth-precedence page — scope-combination matrix sweep; second Octopus authorization leg in two weeks = same-product re-sweep rule. Tracked no-publish: Uncanny Automator PHP object injection, Ticket Ryutsu Center pair, NXP legacy pair, WSO2 OTP no-expiry, Firefox mitigation bypass, Chrome WebAPK single
• Oct 7 21:3xZ wave — 1 new page + 2 folds: Splunk Enterprise coordinated wave (CVE-2026-76264–76286) = new page Splunk coordinated wave page — 9.8 unauthenticated Patroni REST API OS command execution on search head cluster members (10.4.x/10.2.x only; 10.0.x/9.4.x unaffected by topology = deployment shape is the fingerprint; second Splunk sidecar RCE-class leg after the June PostgreSQL KEV — inventory sidecars beside 8089, probe config routes with zero Authorization), search-job query-text + results + preview disclosure by job ID for any non-admin (two-principal tenancy harness over the whole async-job verb set), SPL2 module filter SQL injection (concatenated filter values, private module definitions readable), Secure Gateway sign-anything confused deputy via two independent legs + writable alert/mobile-recipient KV-store collections (trusted-notification-plumbing injection), scripted lookups created through raw transforms config endpoints that skip the capability check the UI handler enforces (raw-config-vs-modeled-config gate parity, scripted lookup = OS command), collect whitespace-before-ACL index-write escape + system-message content injection, trailing-period username directory collision, o11y-app SSRF leaking the configured API token, MCP Server relays the runner's platform token to another user's custom-tool URL (config-plane token exfil: who-can-write vs who-can-execute), and maintainer-script root-time trust of splunk-writable content (read rpm -q --scripts before the upgrade window). Folds: OpenStack Zaqar WebSocket transport authenticates at connect then never binds project scope to in-protocol messages (foreign-project UUID = full queue CRUD) on the Sept 18 ignored-scope page — tenancy harness per transport: STOMP/MQTT/GraphQL-subscription/JSON-RPC frames that re-carry scope are the substitution target; Cyrus SASL DIGEST-MD5 challenge buffer sized before quoting → server-to-client heap OOB write on the Sept 15 parser page — the auth-challenge direction: fuzz realm/nonce with quote-heavy length-inflating payloads at your own client stack; libsasl2 underlies mail/LDAP connectors as a coerced-authentication pivot. Tracked no-publish: GitLab CSV Sidekiq DoS, Athena cross-account metadata read (remediated, no action), OpenShift cluster-samples RBAC overgrant (post-compound-leg latent), Johnson Controls hardcoded key thin, Secure Access DoS/auth singles, Telerik SpreadProcessing XLS loop, ImageSharp memory-safety pack, LZ4/RabbitMQ/Geode singles, Johnson/ADVMS. KEV unchanged (catalog 2026.10.04, 1734, sha f51fed1c; CVE-2026-84411 RouterOS still not in KEV); ToB 9498f6e8 head SequenceHash processed; PortSwigger 07adb06c head Oct-6 processed; PD churn 12a2a340 head Aug-16 processed; Brutecat f099b20d; disclosed DEAD
• Oct 7 18:32Z wave — 1 new page + 3 folds: Cisco 35-GHSA coordinated "internal review" dump = new page Cisco review-dump page — four 9.8 NGOAM unauthenticated root RCEs (VXLAN/MPLS/SRv6 OAM: crafted IP traffic to any interface with the feature enabled; show running-config | include oam|srv6|mpls = surface fingerprint, config state not just version), NX-API root RCE (device HTTP management API is a separate product from the CLI), Cisco License On-Prem CVSS 10.0 + unauth arbitrary file write + password-reset flaw (licensing appliances join the forgotten-perimeter class at a 10.0 ceiling), and the review-dump handling rule (empty version fields in GHSA = pivot to vendor advisories; review dumps cluster by BU; patch-skew across License On-Prem/Finesse vs NX-OS = the engagement opening). Folds: LMCache HTTP control-plane four-pack (/run_script guarded __import__ defeated via injected FastAPI app object → real __builtins__; unauth GET /env//config credential read; attacker-writable proxy allowlist POST /api/proxies → SSRF — audit the write path of every security-relevant allowlist; tenant-quota field as cross-tenant eviction control) on the Oct 2 UTMStack page; Gophish five-leg wave (sending-profile IDOR = SMTP-cred read, /api/import/site dialer deny-list SSRF with error-oracle, XFF-keyed rate limiter = decoration, bcrypt-timing username enum → enumerate+unthrottled-crack chain, SMTP-error-text stored XSS → admin API-key theft — third-party protocol error strings rendered in operator browsers are attacker input) on the Sept 21 mgmt-plane page; DB-GPT third upload route re-advisory + sandbox API silent fallback to LocalRuntime host execution (every degraded-mode branch of a security control is a test case) on the Aug 26 DB-GPT page; OVH default include:mx.ovh.com SPF = any hosted tenant SPF-passing as any co-tenant domain (provider-default include = shared authorization pool; envelope/header From-differential + DMARC-absent co-tenants) on the Sept 20 Exim mail page. Tracked no-publish: GIMP plug-in overflow trio, WP Data Access SQLi + TEC/Unlimited Elements deser WP wave, Jackrabbit session fixation, MISP OTP double-use race + sync silent-drop, Devolutions global-vault write-on-read-perm (Oct 6 Payload axis). KEV unchanged (catalog 2026.10.04, 1734, sha f51fed1c); ToB 25d2bbee; PortSwigger 07adb06c; PD head Aug-16; Brutecat f099b20d; disclosed DEAD. Strict build clean
• Oct 7 16:1xZ wave — six folds, no new page: (1) Homer SIP-capture three-leg wave (empty-jwtSecret unregisters the auth middleware entirely — probe protected routes with no Authorization header before attacking token format; admin/sipcapture bootstrap password compiled into source, no forced change; V4StatisticsQuery skips the codebase's own ValidateRawSQL that search.go uses — enumerate every DB call site and diff validator invocation) + smart_proxy_dynflow optional-token callback forgery (job report accepted when the one-time token is absent — optional security tokens are absent security tokens) on the Sept 21 mgmt-plane page; (2) PraisonAI deploy/api.py f-string codegen injection (agents_file config/CLI field interpolated into generated executed source = repo-to-RCE; codegen quote-context is the injection boundary) on the May 29 page — third distinct PraisonAI bug class same-day; (3) SonicWall SMA1000 fourth wave (Work Place alternate-access-path pre-auth SSRF, AMC Zip Slip→RCE, admin cmdi, AMC stored XSS) extending the combined boundary matrix on the July 14 page — 3 SSRF + 2 cmdi + Zip Slip + XSS on one appliance line; (4) Express Gateway OAuth pair (refresh_token grant validates neither secret nor issuing client — a token ID is not the token, sweep each grant type independently; default cipherKey=sensitiveKey makes Redis-read = any-user bearer tokens) on the May 6 ingress page; (5) Quasar SSR getHead() raw-template meta serializer (client apply() DOM-escapes, SSR path escapes nothing — escaping is a per-render-path property; fingerprint via raw curl response head, not DevTools) on the June 9 Svelte page; (6) Telegram Desktop tg:// semicolon record injection → interpret: handler uploads local files incl. tdata session keys (custom-scheme handlers are parsers with undocumented grammars — fuzz separators) + kube-compare container:// executes the image entrypoint ("inspect" tools that start a process — canary-entrypoint-image proof) on the Sept 23 desktop page; plus MISP forced-TOTP guard bypassed by any non-browser request shape (redirect-gated controls lose to X-Requested-With/JSON-suffix; first-fix-covers-one-shape drift) on the Sept 17 page. Tracked no-publish: Fanvil x7a seven-pack (appliance CORS/websocket/log singles), m17n-lib quintet + libexpat/llama.cpp/GIMP memory-safety class, Chrome 155 pack, Atlassian DC gr66 re-surfacing (already Sept 22 page), Zammad xmw5 (already Oct 2 page), LogicalDOC blind SQLi thin, Sungrow login_type:5 bypass (detail-free), MultiversX multisig, VisiData/unzip_http traversals (class-covered). KEV unchanged (catalog 2026.10.04, 1734, sha f51fed1c); ToB 25d2bbee head SequenceHash processed; PortSwigger 07adb06c head Oct-6 processed; PD churn head Aug-16; Brutecat f099b20d; disclosed DEAD. Strict build clean
• Oct 2 23:18Z wave — two folds, no new page: Gitea act_runner container.options host-namespace escape (GHSA-x4q3-gcj3-m6cf / CVE-2026-73802, 9.9) folded onto the June 17 Gitea page — workflow YAML container.options is appended verbatim to the job container's Docker HostConfig; with privileged mode disabled as the control, the sanitizer forces only Privileged=false and filters only Binds/Mounts, so --pid=host --ipc=host --cap-add=ALL --security-opt seccomp=unconfined survive the parser → nsenter -t 1 root on the runner host from any user who can submit a workflow to a shared Docker-backed runner. Single-flag sanitization of a CLI-shaped option string enforces nothing — enumerate every HostConfig field the parser can set. SiYuan AI/MCP agent plane (fixed 3.8.1) folded onto the July 10 page: (1) agent http_request/web_fetch DNS-rebinding TOCTOU past CheckHostSSRF (x8gv, 8.2) — guard-time resolution checked, connection re-resolves via the default dialer with no connect-time check, and the repo's own SSRFSafeDialer hardening was never wired into the agent tool paths: any guard that resolves DNS without pinning the answer to the socket is rebinding-testable by construction; (2) MCP asset.upload takes absolute paths with zero boundary checks (p23f) — siblings file/unzip go through escape-proof resolvePath, the MCP hardening pass never touched this handler; copies arbitrary host files into the syncable workspace assets/ = local-read-to-remote-disclosure sink. Diff boundary-check symbol coverage per agent-tool handler, not per server — same sweep as the block.go 17/28 finding. Tracked no-publish: chi RedirectSlashes Host-header open redirect (vrw8, duplicate-paired, known header class), SiYuan Oct-1 publish-tier quintet already on the Sept 4 page, gitea-runner details promoted above, Dulwich/Trigger.dev/Vibe-Trading/Airflow re-surfacing (grep-verified processed). KEV unchanged (2026.10.02, 1733, sha d2c8c6cb); ToB 9498f6e8 head SequenceHash processed; PortSwigger e2bf4e9b Sept-23 processed; PD head Aug-16; Brutecat f099b20d; disclosed cc969a5f unchanged. Strict build clean. Baseline 1f1ef2c
• Oct 2 23:1xZ wave — Airflow 3.3.1 wave (new page) + three folds: Apache Airflow 3.3.1 enrichment wave (11 GHSAs, updated-feed 23:1xZ) = new page deserializer gadgets into the scheduler, parser-discrepancy authz, masker shape gaps — four separate branch fixes of the same reconstruct-from-serialized-blob pattern: exception-node import_string() → arbitrary callable in Scheduler + API server via executor_config (58076 — different sink from CVE-2026-33264's trigger branch, patched deployments still exposed); awaiting_input 15s sweep deserializes DAG-author next_kwargs with no allow-list coverage (67260); Task SDK Callback constructor import passes the default allow-list because it's an Airflow class (67587); XCom ?deserialize=true skips the forbidden-keys guard = write-then-read-back instantiation (59242). Parser-discrepancy auth bypass: Backfill API authorization parses backfill_id with int(), handler with pydantic NonNegativeInt (1.0 accepted) — dependencies run before validation so the two act on different DAGs; edit on any one DAG → read/pause/cancel any other DAG's backfills (68968). Masker is a shape parser: bulk endpoints nest entities below the masker's top-level field check → secrets in cleartext audit log readable without Variables-read (68969); team-prefixed sections evade the sensitivity-name match (65017); dict-valued var.json fails the isinstance(str) mask (59244); list/tuple depth-limit residual (54183); env-var + Yandex Lockbox backends fall through team scope (underscore-in-name pattern miss, team-agnostic lookup-on-miss) → cross-team credential use via connections/test (68076/68871). Folds: Trigger.dev second tier on the Oct 2 AI page (hardcoded .env.example secrets + validateSessionMagicLink=false → forge magic link to admin, pqxw; Socket.IO /coordinator default secret undocumented outside source + READY_FOR_EXECUTION returns decrypted run env vars cross-tenant, gg6r; TSQL→ClickHouse compiler window-function-name concatenation via backtick-identifier = cross-tenant subquery SQLi outside the tenant guard, 9q4r; cancel-by-projectId-only vs env-scoped GET asymmetry, 4672; "backwards compatibility" comment = intentionally unauthed realtime stream injection route, 59h8; CLI debug log serializes envVars plaintext, fj2x); Vibe-Trading three-GHSA CVSS-10 stack (commented-out API_AUTH_KEY + require_auth() early-return + no USER + 0.0.0.0 bind = unauth root RCE chain; BashTool shell=True zero-filter + exec_module before class check = signature filters miss second exec sink; safe_user_path() envelope = all of /root; prompt-injected PDF → tool call = same primitives without any auth, v2f8/jqmf/5rmq); Headroom LLM proxy CSWSH (no Origin check before accept() + Authorization-fallback injects the server's OPENAI_API_KEY → any visited page spends the operator's key, 71416); SiYuan pair on the July 10 page (bulk per-function symbol sweep of block.go = 17/28 handlers zero publish checks incl content-derived getRefText + existence oracles, 74904; admin forward-proxy WS hard-coded CheckOrigin: true, unfixed, 74802); Xray-core pinned-CA MITM on the Oct 2 cert page (pinning forces InsecureSkipVerify and hysteria/gRPC-IP construction sites omit WithDestination → empty ServerName = name check skipped = any leaf under the pinned CA hijacks, 5wf9). Tracked no-publish: HTTP/2 HPACK bomb via pingora-fork missing default h2 options (Praxis cjcg — DoS class, note the fork-missed-PR fingerprint), sqlite3-ruby aggregate UAF (GC-triggered, no controlled write), Wasmtime epoch-preemption VM-state (embedder-pattern-gated), aws-smithy-json recursion DoS, a2ui openUrl javascript: (already on Aug 4 page), OpenNLP XXE/CXF XXE/LlamaIndex ref_doc_id SQLi/GPT Researcher MCP stdio re-surfacing (class-covered), geopy/figlet/braces ReDoS-DoS singles. KEV unchanged (2026.10.02, 1733, sha d2c8c6cb); ToB 9498f6e8, PortSwigger e2bf4e9b, PD head Aug-16, Brutecat f099b20d, disclosed cc969a5f unchanged
• Oct 2 21:32Z wave — UTMStack page (new) + two folds: UTMStack <11.2.16 SIEM/UTM manager — InternalApiKeyFilter accepts a Utm-Internal-Key header matching the INTERNAL_KEY env var for any endpoint, no path restriction/const-time compare/rate limit/audit (phx4, 9.8) = accountless admin API for anyone who learns one env value; UTMIncidentCommandWebsocket.processCommand() on the /command/{hostname} STOMP destination has no role check, no command allowlist — any authenticated user pushes root/SYSTEM OS commands to any agent by hostname (q995, 9.9) — transport-parity rule: authorization lives at REST; the WebSocket/message bus beside it enforces nothing; enumerate STOMP/SockJS destinations with a lowest-priv lab principal. Plus JHipster-scaffold SQLi/JPQL legs (String.format→native query + em.createQuery), PDF-render SSRF read-back + IdP-metadata-URL SSRF. Fold: wolfSSL ≤5.9.x six-leg cert-validation pack onto the Oct 2 BC page: name-constraint state reset on unconstrained intermediate tier (vrp7), CN-fallback gated on altNames==NULL not "no dNSName SAN" = incomplete fix of CVE-2026-6731 (p2xv, 9.1), MatchTrustedPeer ignores the public key → forged same-subject CA clone passes WOLFSSL_TRUST_PEER_CERT auth in nginx/haproxy/stunnel/autoconf builds (22fm, 8.2), failed X509_verify_cert permanently plants attacker CA in the shared CertManager for TLS/OCSP/CRL siblings (m732), split-verify precedence inversion under SMALL_CERT_VERIFY accepts garbage-signature CA-subject certs (q4rg), out-of-order CCS installs null-secret read keys = handshake-completion injection on TLS/DTLS 1.2 clients (vpg5). Fold: Dogtag CMCAuthForEST fail-open upward onto Sept 21 precedence page: EST BasicAuth without client cert leaves the subsystem's agent cert in SSL_CLIENT_CERT → EST user gets arbitrary-subject CA-signed certs (qgmm, 8.1) — missing credential defaults to the highest ambient session identity, not anonymous. Tracked no-publish: Digi unauth-root POST (detail-free), Exchange 96940, H3C/Weaver backfills, Trivy Terraform traversal, MAAS/pg-operator log-cred, Phproject missing allowAccess call, unnamed six-pack CVE-2026-90452-90457. KEV unchanged (2026.10.02, 1733, sha d2c8c6cb); ToB 9498f6e8, PortSwigger e2bf4e9b, PD head Aug-16, Brutecat f099b20d, disclosed cc969a5f unchanged
• Oct 2 18:31–19:14Z wave — five folds, no new page: Dulwich four-GHSA cluster (8.6–8.8 each, all → .git/hooks RCE) onto July 1 repo-trust page: checkout(paths=[]) raw os.open without O_NOFOLLOW bypasses the hardened blob writer entirely (alternate-path drift), filter_branch ancestor-commit symlink persists in CWD across commits, stash.pop os.path.exists() follows symlinks, Windows NTFS validator misses DOS drive-letter tree entries (C: discards join root; C git's has_dos_drive_prefix() is the deny-list the reimplementation skipped — cross-platform payload authoring). MISP stale-correlation-snapshot trio (qxmx/w4mw/mw5r, CVE-2026-104910/912/914) onto Sept 21 auth-precedence page: correlation table copies distribution/sharing-group at write time, correlation-driven routes authorize against the stale snapshot lacking the published flag → read events you can't open after ACL narrowing; soft-deleted attribute listing drops the owning-org predicate the detail view enforces — derived-index denormalization = authorization time bomb. Anubis X-Original-URI policy bypass (6wcg/CVE-2026-62314, default config, one-header challenge skip via path-only ALLOW rules) onto Sept 15 header-route page: forged original-URI header family applied to a policy engine. LocalAI /models/apply unauth gallery SSRF with error-body leak (8c5q/CVE-2026-59707) + agent-framework code-injection second wave (pandas-ai CodeExecutor, agentscope execute_shell_command, FinRobot CodingUtils, vanna get_plotly_figure, SuperAGI 7-GHSA cross-tenant project_id agent CRUD, TaskingAI plugin save-path traversal) onto Oct 2 AI page. Composer symlinked-bin fix bypass + Copernik XInclude stock-JDK-provider gap onto July 31 library page: fix-battery targets the fix's representation assumption (symlink + installed.json replay), hardening wrappers' guarantees are provider-conditional, XXE battery must include xi:include. Tracked no-publish: ATS r73v generic 9.3 (await differential), image-downloader h4gg detail-free, OpenOffice Java-integration, Meari IoT IDOR pair, ruby_llm ReDoS, Chrome 154 pack. KEV unchanged (2026.10.02, 1733, sha d2c8c6cb); ToB 9498f6e8, PortSwigger e2bf4e9b, PD head Aug-16, Brutecat f099b20d, disclosed cc969a5f unchanged
• Oct 2 12:31Z wave — YesWiki 36-GHSA page (new) + two folds: 36 GHSAs for YesWiki <4.6.7 = a complete wiki/CMS secondary-handler audit: unauthenticated attachment download, recentchangesrssplus RSS 500-char excerpts of restricted pages, and unfiltered tag listings all bypass read ACLs, while Bazar id_fiche-overwrite, pointimage save, and comments-API pagetag-vs-victim-tag bypass write ACLs — the ACL is written where the page renders, not where page data is read/written. Feature-flag axis: public-API mode makes admin routes (update_config, archives list/download/delete) unauthenticated (59xh/104467, 8.1 critical). Empty-filter scope bypass on triples delete deletes the admins-group triple (gr78/104443). Federation invariant: ActivityPub inbox verifies HTTP signature but never binds signer to actor → any keypair Delete/Updates others' mirrored entries (px48/104445). SSRF cluster upgrades blind fetch to read-back (fetched content stored as readable Bazar entries), link-chained multi-hop crawl (attacker-controlled outbox first/next), enclosure download into webroot, numeric-host Webfinger form, and an isValidURL() that always returns true. Deferred identifier SQLi trio: double-quote username into ACL LIKE clause, planted Bazar option id into REGEXP boolean oracle, trailing-backslash quote-parity MySQL breakout → UNION (m352/f8w7/3q4q). Five unprotected destructive GETs (page/attachment/tag/package/revision delete, 6qxf 8.1), no-session-regen fixation, never-expiring reset tokens, AJAX-shape mail relay, extension-only SVG upload skipping the file purifier. Folds: Ghost 6.64 wave onto Aug 4 page (locale/theme translation-file JSON traversal → admin RCE + config-JSON read; pending-invite token disclosure × unscoped accept = accept someone else's admin invite; Editor assigns own role; oEmbed/bookmark-card/extension-derived-content-type stored-XSS trio with newsletter-email render leg); SiYuan publish trio onto July 10 page (export-preview reads protected embedded DB rows, getNotebookInfo hidden-doc metadata, create/save-path helpers leak hidden notebook IDs — sweep export/preview and create-path routes, not just reads). Tracked no-publish: Thrift <0.25.0 seventeen-GHSA binding pack (per-binding fingerprint note kept), Zcash Zebra 18-GHSA consensus pack, YesWiki XSS/DoS/enum singles, HospitalManagementSystem thin SQLi, GRUB lockdown, detail-free protocol-gateway overflow. KEV unchanged (2026.10.01, 1731, sha 4e47d6936857ccf0); ToB 25d2bbee, PortSwigger head Sep-23 HTTP/3, PD head Aug-16, Brutecat f099b20d, disclosed cc969a5f unchanged
• Oct 2 09:31Z wave — Bouncy Castle .NET wave (new page) + one fold: ~20 GHSAs for bc-csharp <2.7.0 = a complete attacker inventory for .NET crypto parsers. Decision oracles: CMS RSA PKCS#1 v1.5 unwrap keeps a distinct "bad padding" exception → Bleichenbacher key recovery (xx4m/63573); IES block mode decrypt+pads before MAC, distinct error + skipped MAC computation → CBC padding oracle (6w4x/63567); IES stream mode keystream-then-MAC-key layout means one known-plaintext message leaks the MAC key for all shorter messages, permanently (43qj/16001); CCM decrypt accepts aes-ICVlen=0 (validated only on encrypt, 499v/15999); DSTU CCM G1 block processed only with AD → nonce-free tag forgery (m3jv/16000); failed CCM decrypt leaves plaintext in the caller buffer (v84x); critical: raw DH agreement raises unchecked peer value to the static private key → small-order attack + key leak mod small factors (m2m9/63569). PKIX bypasses: directoryName constraint matches first RDN anywhere not as prefix (437r), URI host sliced without isolating authority (3248), trailing-dot FQDN misses excluded subtree (mx2f), attribute-certificate validator never verifies the AC signature (cwfr/63571 — forged role grants), PKCS#12 AKI-cycle infinite loop (g2c8). Pre-auth work-before-auth inventory with published thresholds: 8 KB nested SEQUENCE uncatchable StackOverflow process death (xp76), 75-te PFX negative iterations = minutes of CPU (7c84), iteration counts to 2^31 before MAC check (v54c/4583), OpenPGP 5-octet length → 2 GB alloc from bytes (576x), HSS/LMS level count → 17 GB (gpr4), DTLS fragment declares 16 MB unauthenticated ×16 (496x), quadratic DN escaping fires during constraint checks (p48w). Java BC legs: NTRU % on secret operands = PQC decapsulation timing leak (frjj), MLS signed-int leaf index passes membership check negative (x7w3), KDF costs from untrusted input incl. scrypt p evading N/r ceiling (m3x3). Fold: JSON API Auth ≤3.1.2 cached cookie-minting response (pmrp/97637 — transient keyed by URI only ignores method+body → anonymous GET replays admin logged_in cookie for 24h; insecure=cool literal bypass param) onto Sept 19 WP page. Tracked no-publish: cPanel WHM XSS→RCE trio detail-free, MStore/WebToffee client-trusted-amount (Sept 23 WC page canonical), Dc MultiVendor ORDER BY SQLi (class canonical), HAVELSAN Sef detail-free trio, ~25 generic WP XSS/enum singles. KEV unchanged (2026.10.01, 1731, sha 4e47d6936857ccf0); ToB new head SequenceHash (Oct 2 — defensive crypto-construction post, not promotable as operator guidance), PortSwigger 6940c4db, PD head Aug-16, Brutecat f099b20d, disclosed cc969a5f unchanged
• Oct 2 02:1xZ wave — two folds, no new page: Foreman/Red Hat Satellite provisioning-plane legs folded onto the Sept 21 management-plane page (96658/56098/56097 already on the Sept 21 precedence page from the Oct 1 late wave) — template-preview endpoints render host root passwords to Viewer role, RCE if safemode off (2fj2/96659: preview route ≠ edit route role map), /unattended/provision verifies token exists in DB rather than present in request → tokenless kickstart access (6m3j/12423 — "does the token exist ≠ was the token presented"; probe token-gated endpoints with the token omitted during bootstrap windows), effective_user overridable job-template metadata cmdi during environment instantiation (9jhx/12405 — fuzz meta-params around templates, the runner builds its own command line), Katello cross-org Content View history by-id (xqhp/79654). PCP monitoring stack: unauthenticated pmproxy /store overwrite-any-PMDA-metric → code exec (cf63/16527) + network.persocket.filter shell metachars executed on metric refresh (f5qw/16524 — ZLMediaKit write-now/execute-later twin in a metrics store) + root LPE via unsecured internal linux_sockets connection (534w/16526); pmproxy :44322 recon rule. SConnect native host web-content→native-messaging RCE critical (cq27/CVE-2026-18397) folded onto the Sept 23 desktop-surface page — MFA/SSO client native hosts are browser-reachable command endpoints; enumerate NativeMessagingHosts manifests, test extension-identity binding. Tracked: dracut die() trio, GLib key-file off-by-one + D-Bus SHA1 SASL, libarchive RAR5 double free, PCP __pmGetPDU blind-DoS, hammer_cli/foreman-rake local cmdi (local-position class), 2009-era GHSA backfill batch. KEV unchanged (2026.10.01, 1731, sha 4e47d6936857ccf0); ToB fc79e024, PortSwigger 6940c4db, PD head Aug-16, Brutecat f099b20d, disclosed cc969a5f unchanged
• Oct 1 21:3xZ wave — httpd second tier + seven folds, no new page: same 18:32Z httpd train carries a module-primitives tier landing 21:33Z: mod_rewrite %{LA-U:} lookahead UAF 9.8 (f5cw, sub-request re-entrancy = auth-state lifecycle in rewrite clothing) + mod_vhost_alias stack overflow via Host >8192 bytes with VirtualDocumentRoot format specifier (f6c9 — oversized-Host is a black-box config oracle) + mod_proxy_ftp PASV-reply = forward-proxy pivots to arbitrary third-party host (6wv6) + mod_proxy_uwsgi response smuggling via TE (9fgx) + /./ userdir equivalence (cr6f) + CGI-redirect-target executes as CGI (rxhx) + GET /.DAV/ dead-property read (p249) — all folded on the Oct 1 httpd page. Seven folds: DB-GPT second upload route python_file_upload traversal 9.1 (wmgw — the fixed handler is the map to its unfixed siblings; grep every filename param) onto Aug 26 DB-GPT page; Lektor admin blueprint zero-CSRF/zero-Origin cross-origin file-write + rebinding read leg 8.1 (76hh — textbook rebinding exemplar: try a cross-origin form POST before rebinding) onto DNS-rebinding methodology; agent-zero FileBrowser.__init__ workspace = host root 7.5 (j6rq — fingerprint the root the framework instantiates, not the config displays) onto Sept 5 agent page; Authlib ≤1.7.2 discovery JSON cached with no issuer-origin binding → poisoned metadata replaces every endpoint incl. jwks_uri (8wx9 — the OIDC trust bootstrap is attacker-reachable fetched material; issuer-equality + origin-binding probes) onto OAuth/MCP misconfig methodology; Laravel APP_DEBUG=true = one-request whole .env plaintext disclosure, 9.3 (2h69 — one predictable-500 request is the first-touch check; app-key leak = signed-cookie forgery) onto Aug 20 Laravel page; pgvector <0.8.7 IVFFlat index build = low-priv DDL crosses into postgres-process memory, 8.8 (pw7q — enumerate pg_extension, extension DDL paths are native-code contexts; lab-only crash proofs) onto June 15 DB-privilege page; FortiMail KEV GHSA twin lands (6gxc 9.8) + FLIR Aware2 authless-web/traversal/hardcoded-creds four-pack folded on the FortiMail page. Tracked no-publish: DeepTutor ExecTool cmdi 9.8 (folded to MCP agent page — agent tool registry = risk ceiling), Joyland AI Android TLS-absence/Weex-bridge pack (mobile classes already covered), FLIR cluster legs (class-covered), Confluent Vault KMS client cert-validation absence (r743), Wormhole coturn open TURN relay = third-party-IP pivot + metadata reach (7r4f, fixed, relay-abuse class noted), TP-Link TDDPv2 overflow/cmdi pair (router class), Podgrab unauth /ws + DoS pair, PEA archive OOB. KEV unchanged (2026.10.01, 1731, sha 4e47d6936857ccf0); ToB fc79e024, PortSwigger 6940c4db, PD head Aug-16, Brutecat f099b20d, disclosed cc969a5f unchanged
• Oct 1 20:1xZ KEV wave — FortiMail IBE unauthenticated file-write (new page): CVE-2026-104286 (CVSS 9.8, exploited in the wild, added 10-01, due 10-04) — path traversal + NULL-byte neutralization in FortiMail 8.0.0–8.0.1 / 7.6.0–7.6.6 / 7.4.0–7.4.8 / 7.2.0–7.2.9, unauthenticated arbitrary file write via crafted HTTP/HTTPS. Three durable operator rules: (1) the vendor workaround names the feature gate — disable IBE (config system encryption ibe) = the exploited handler is behind the IBE feature; feature toggles are free attack-surface maps, enumerate feature-specific pre-auth families (IBE enrollment/decrypt, quarantine, guest approval, recipient lookup) separately from the admin GUI on every appliance engagement. (2) CWE-22+CWE-158 writer pairs: validator normalizes the filename, writer consumes raw bytes — %00/%2500 truncation + traversal in upload/save-name parameters, prove with validator-visible-vs-on-disk differential in lab only. (3) the published IoC set is a mail-appliance persistence-pattern reference: ld.so.preload+liblog.so preload rootkit (one write primitive = code-exec persistence), modified /bin/smit + httpd.conf, drops under /data/bin surviving upgrades, and a rogue archive account entry as the exfil channel (attacker remote-ip, allowlisted-looking outbound). Also KEV 2026.10.01 (1731): one net addition; GHSA published/updated sweeps clean since the 18:3xZ head; ToB fc79e024, PortSwigger 6940c4db, PD Aug-16 head, Brutecat f099b20d, disclosed cc969a5f unchanged
• Oct 1 18:3xZ late wave — Apache httpd auth-state lifecycle page (new) + two folds: httpd 2.4.0–2.4.68 quad: mod_auth_digest capture-replay auth bypass at MITM position when AuthDigestNonceLifetime 0 (crafted requests trigger GC of the client's shared-memory entry, 73636) + unauthenticated concurrent-Digest UAF auth-state corruption when AuthDigestNcCheck On or lifetime 0 (73637) + mod_http2 session->bbtmp re-entrancy UAF (57941) + SSLRequire file-expression privilege mismanagement (59797) — durable rule: auth state living in server memory has a lifecycle; probe it black-box (nonce-reuse + nc-replay + concurrent-issue Digest probes are non-invasive config oracles; race auth-state, don't just fuzz it; re-run h2 raw-byte batteries on just-patched builds). Folds: Tapo C120 v1/C200 v5 onboarding quad onto the Oct 1 wireless page — HTTPS onboarding scan/connect actions stay unauthenticated after setup (camera wardrives APs for the attacker, do-method connect relocates the device), login-challenge replay mints admin sessions (challenge = token), privileged service becomes reachable only after enable+reboot (two-stage activation gates hide services from static scans), MacTool cmdi = full chain (xrj7/7ch5/5hx8/gq3v); Foreman/Katello/Keycloak trio onto the Sept 21 precedence page — Foreman safemode allowlist self-extension via delegated-method handling → low-priv RCE 9.9 (96658: try to add to the sandbox allowlist from inside the sandbox), Katello registry_authorize calls unauthorized but missing return → fall-through into business logic = instance-wide User/Org/Product enumeration oracle under a 403 (56098 — the check fired ≠ the check stopped; diff unauthorized-vs-nonexistent-id responses), Katello raw-SQL from request-path labels reachable with only create_personal_access_tokens (56097), Keycloak X.509 CRLDP file-path read — crafted cert makes the server read local files/OOM (103884 — cert extension fields are attacker-chosen paths dereferenced server-side; sweep CRLDP/AIA/OCSP on every mTLS surface, also folded on the June 11 Keycloak page). Tracked no-publish: hammer_cli $EDITOR→system() + foreman-tail eval local cmdi (12545/12542, local-position class), VxWorks shell per-user privilege-check miss (104018, detail-light), Geyser 2021 JWT impersonation late publish (h77f), Zod uncapped-array OOM (54404), Smile validateNameLength never invoked (68496, constraint-coverage class already promoted Oct 1), TL-WR841N admin IPv6-gateway cmdi (102294). KEV unchanged (2026.09.30, 1730, sha 41a998d171e4b29a); ToB fc79e024, PortSwigger 6940c4db, PD head Aug-16, Brutecat f099b20d, disclosed cc969a5f all unchanged
• Oct 1 15:1xZ wave — vm2 seventeen-GHSA escape wave (new page) + three folds: largest single-library wave tracked; four audit rules for any JS-sandbox/plugin-isolation product: (1) vm.readonly() wraps assignment, not call authority — one narrow builtin grant crosses the boundary: https → globalAgent.on('free') hands sandbox host Bearer tokens + released TLS sockets (h85j), tls+url → setDefaultCACertificates() replaces the host's trust store (98xx), crypto → setEngine() runs a bundled library's constructor before OpenSSL validation (46pr), node:sqlite → loadExtension() native exec, node:test run({execArgv:['--eval=…']}) spawns unrestricted host Node on Node 24+ (qhwx) — the last two via the double-prefix spelling require('node:node:X') (one strip); (2) allowlist grammar drift: -fs misses fs/promises (6rh5), -node:child_process misses canonical child_process (8686), raw startsWith admits prefix-sharing sibling foo2 (7q3f), unanchored allowlist regex admits evil-left-pad loaded in host context by the custom resolver (c48m) — battery: subpath, scheme-prefix, sibling, colliding-name; (3) shape-typed guards + fix-site gates: require: [] passes typeof===object → nesting guard fails open → inner host-vm2 RCE (8hr7); vm.freeze() bypassed by getOwnPropertyDescriptor().set.call() (633r); GHSA-m283-3h24-438v fix re-bypassed via p.then.call() indirection skipping the sanitizer → err.detail=process → RCE (647f); stale PromiseThenLookupChain protector escape on Node 26, no fix at advisory time — escapes are runtime-gated, fingerprint Node/V8 alongside sandbox version (27g9); (4) the documented vm2 <file> CLI has zero isolation — host-realm require(__filename) self-echo = node ./script.js (jxxv). Folds: JupyterLab 4.5–4.6 trio onto June 19 page (paste-clipboard XSS via self-declared metadata.trusted 6966 — trust flags arriving inside attacker data; language-pack Plural-Forms start-anchored-regex new Function XSS 3jqq; install validated, uninstall not → -r file pip argument-injection file oracle 3325); SiYuan publish-mode pair onto Sept 4 page (getUniqueFilename binder does required+non-empty only → anonymous whole-host existence oracle hf8h; getOutlineStorage admin-gated writes, open read — the read path is the leak, the write path is the benchmark 53fp); devalue null-prototype key coercion reopens __proto__ rejection (4q55) onto May 14 page. Tracked: pypdf resource-exhaustion septet, jackson pair, devalue CPU singles, basic-ftp ReDoS. KEV unchanged (2026.09.30, 1730, sha 41a998d171e4b29a); ToB fc79e024, Brutecat f099b20d unchanged; PortSwigger blog hash churn head Aug-12 processed; PD churn head Aug-16; disclosed sitemap now serves an empty-loc shell, head cc969a5f
• n8n seventeen-GHSA credential relay + approval forgery + node filter-injection wave (Oct 1 12:31Z — new page + seven folds): the most complete public map of workflow-automation breakage: credential-test endpoint resolves other projects' variables into test requests sent to your host (103252) + inline agent introspection decrypts arbitrary credential IDs to attacker hosts (103246) + credential host-field repoint ships unencrypted passwords (103256) + resolver-registration captures collaborator session tokens (103259) + duplicate node-ID defeats the tamper guard (103247) — the platform is the confused deputy: sweep every endpoint that uses credentials, varying target-URL / credential-ID / scope-field independently. Approval gates: Send-and-Wait resume verifies neither identity nor permission (103260), signed approval URLs mintable cross-project via unresolved traversal in node IDs (103254 — signed ≠ scoped), Webflow trigger never verifies its HMAC (103245). Node query layer: Supabase filter-string injection = read/update/delete-all (103248), tableId path traversal to Auth/Storage with serviceRole key, RLS bypassed (103255), Mongo sessionId accepts query operators unauthenticated (103250), Oracle table/schema quote-injection DDL (103253), SendGrid/Freshservice/ServiceNow literal-breakout to match-all (103258), dropdown stored XSS persisting through workflow shares (103249). Queue-mode Redis = unauthenticated cluster-wide npm install past every check (103251). Folds: Ghost 25-advisory wave onto Aug 4 page (suspended-account password-reset reactivation 103268, password-only login-as-staff 2FA bypassed 103283, invite-accept binds any email 103267, oEmbed executes scripts in admin session 103277, URL-encoded extension bypass 103276, low-role reads Admin API keys 103281); APISIX trio onto Sept 21 precedence page (encoded-path route/policy mismatch 94269, cross-issuer OIDC introspection replay 94276, saml-auth default config = no signature verification 94212); Fleet critical: device API accepts hostname/serial as auth tokens → unauth authenticate as iOS host, install software, MDM migrate (103264) + cross-team MDM results via shared command UUID (103265); Forminator unauth stored XSS via nonce minted by public wp_ajax_nopriv_ endpoint (92144, Sept 19 WP page — nopriv-minted nonce = no auth signal); Camel Quarkus Xalan JAXP-default XXE (88789) + Budibase raw-node-fetch AI-table SSRF (103757) onto Oct 1 guard-coverage page; Obot deny list misses /mcp-connect-composite/ (103758) onto Oct 1 MCP page; ansible-runner worker-stream symlink/chmod unpack (103754) onto July 28 unpack page; oc-mirror cache registry 0.0.0.0 unauth image push (96577) + MISP write-lags-read ACL (103858) + ground-station setup-mode SQL admin-plant (103244) onto Sept 21 page; second Tornado StaticFileHandler symlink advisory = same defect, dup-triage lesson (103263, July 26 page). Tracked no-publish: Tornado query-field/mem-accum pair (103261/103262, prior class), Ghost CSRF/enumeration singles, YouTrack ten-pack (Mermaid/LaTeX stored XSS 103493 + GitHub-VCS-integration SSRF 103497 noted, group-link priv-esc pair thin), Pandora FMS blind SQLi via Grafana-style module concat (75786 thin), oauth-proxy rd open redirect (83589 class), File-Manager/Entradium/CSRF singles, APISIX DoS/log singles, tnef memory-safety trio. KEV unchanged (2026.09.30, 1730, sha 41a998d171e4b29a); ToB fc79e024, PortSwigger 6940c4db, PD churn-hash head Aug-16 processed, Brutecat f099b20d, disclosed cc969a5f all unchanged
• [Oct 1 08:1xZ wave — escaper/parser boundary mismatches trio (three folds, no new page): (1) league/commonmark DisallowedRawHtml end-of-line tag bypass (GHSA-97jj-33gv-5xf9, fixed 2.10.2) onto the May 28 commonmark page — the escaper regex requires one character after a disallowed tag name ([\s\/>]) but the block parser accepts end-of-input there, so a Markdown line ending in <script passes through unescaped and the next block supplies attributes (<span src=...> reassembles as <script src=...> in the browser); an escape regex and a parser grammar disagreeing at EOF/newline boundary conditions is the reusable class — second regression of this exact filter (GHSA-4v6x-c7xx-hw9f). Sweep bare tag-prefix forms (<script, <iframe, <style) as final lines and diff parser-accept vs escaper-accept character sets. (2) serialize-javascript 7.1.1 function-body </script> swallow (CVE-2026-97711, fixed 7.1.2) onto the May 9 render/Markdown page — SCRIPT_CLOSE_REGEXP's greedy [^>]* ran from one `