<span class="text-transparent bg-clip-text bg-gradient-to-r from-brand-purple via-brand-blue to-brand-green">Blog

BREAKING: CVE-2026-18549 - @fastify/multipart Aborted Upload DoS

CVE-2026-18549 lets unauthenticated clients leak temp files and hang request handlers in @fastify/multipart <10.1.1, causing disk and event-loop exhaustion. Upgrade to 10.1.1.

Aug 16, 2026

CVE-2026-12624: HashiCorp Vault LIST Authorization Bypass via Trailing Slash

CVE-2026-12624 lets a Vault token enumerate secrets beneath a path a deny policy was supposed to block. The ACL engine failed to enforce wildcard deny rules on LIST requests with a trailing slash. Fixed in Vault 2.0.3.

CVE-2026-9318: tablib Stored XSS via HTML Export Dataset Title

tablib, a Python tabular data library with over 147 million PyPI downloads, contains a stored cross-site scripting vulnerability in its HTML export functionality. Attackers can embed JavaScript payloads in dataset titles that execute when the exported HTML file is opened in a browser. Fixed in version 3.10.0.

CVE-2026-72880: Dokploy Certificate Path Traversal Enables Arbitrary File Write and Remote Code Execution

Dokploy prior to 0.29.13 accepts a user-supplied certificatePath without confinement, allowing authenticated users to write files to arbitrary host locations and achieve remote code execution. Fixed in 0.29.13.

CVE-2026-72693: kbd openvt Privilege Escalation Enables Passwordless Root Login

The kbd package, shipped on virtually every Linux distribution, contains a local privilege escalation in openvt -u. A flaw in how authenticate_user() verifies process ownership lets an unprivileged user trigger a passwordless login -f root on a new virtual terminal.

CVE-2026-69112: Hugging Face Accelerate Path Traversal Lets Attackers Read Arbitrary Files

Hugging Face Accelerate through 1.14.0 fails to sanitize weight_map entries in sharded checkpoint indexes, allowing arbitrary file reads and denial of service via named pipes. Affects 27M monthly downloads.

CVE-2026-66763: SAP BusinessObjects CMS Stores Credentials Behind a Hardcoded Cryptographic Key

SAP BusinessObjects BI Platform CMS encrypts sensitive credentials with a hardcoded cryptographic key baked into the source code. Anyone with high privileges and local server access can extract and decrypt every stored password.

CVE-2026-52855: Pterodactyl Wings Leaks Daemon Configuration Secrets via Egg Templates (CVSS 9.9)

Pterodactyl Wings exposes its entire daemon configuration through egg configuration-file templating, leaking API keys, SFTP credentials, and database connection strings. CVSS 9.9. Fixed in version 1.12.3.

CVE-2026-44763: Path Traversal in SAP MII Writes Files Outside Intended Directories

SAP Manufacturing Integration and Intelligence fails to validate file paths in certain functions. A privileged attacker can write files outside the intended directory, with high impact across confidentiality, integrity, and availability.

CVE-2026-38447: osTicket Generates Predictable API Keys via MD5 Hashing (CVSS 9.8)

osTicket 1.18.3 generates API keys using MD5 with predictable inputs (timestamp and client IP). An attacker can approximate the key generation time and brute-force the key space. Affects 5 million+ users and 15,000+ businesses worldwide.

CVE-2026-18108: Net::SAML2 Authentication Bypass via Unsigned Encrypted Assertions (CVSS 9.8)

Net::SAML2 before 0.86 accepts decrypted SAML assertions that carry no XML signature. Any party can encrypt an unsigned assertion to an SP's published certificate and authenticate as an arbitrary user. Affects Azure AD, Okta, Google, ADFS, and all other IdPs.

CVE-2026-6791: glibc wordexp Stack Clash via Tilde Expansion

CVE-2026-6791 is a stack-based buffer overflow in glibc's wordexp() function. The parse_tilde internal function uses strndupa to allocate stack memory sized by attacker input with no bounds check, enabling a stack clash.