Tag archive
CVE-2026-76519 turns an inspected attachment into a root-level write on Cisco Secure Email Gateway. The feature preconditions, the fixed builds, and why the KEV deadline was three days.
A JWT library that can be talked into using a public key as an HMAC secret, and a decompression library that follows symlinks out of the target directory. Both have fixes; neither is fixed by upgrading Node.
An unauthenticated file read in a popular WordPress form builder, and why the files it can reach are credentials.
Assessing Real-World Risk From CVE-2026-78249 Without Overstating It
MFP Web Management Interfaces and CVE-2026-78249: Why Reachability Decides the Risk
Why a CVSS 10.0 path traversal in GitLab's commits API is more dangerous than the bug class suggests, and how to remediate beyond patching.
A critical WordPress core traversal reachable without credentials, and the PEAR helper step that turns file inclusion into code execution.
MCPVault compares paths as strings. A case variant defeats the check on a case-insensitive filesystem, and a root-anchored deny list misses nested directories.
CVE-2026-85706 is an unauthenticated arbitrary file read in GitLab's repository commits API. On a DevSecOps platform, that read is a credential incident, not just a confidentiality bug.
Patch Priorities for CVE-2026-78249: What MFP Owners Should Do First
An unauthenticated path-control flaw in an on-premises communications server that is usually older than the rest of the estate.
Two Check Point flaws share a product family and a deadline but not a mechanism. Separate verification steps for a trust decision failure and a file access failure on the same gateway.