securityboulevard.com resources

securityboulevard.com

Resources curated from this publisher and indexed across appsec.fyi topic pages. Last item added: 2026-05-17.

Supply Chain 13 RCE 10 API Sec 7 SSRF 7 AI 6 XSS 6 Secrets 2 AuthN 1 AuthZ 1 Burp 1 Deser 1 JWT 1 Mobile 1 SQLi 1

Date Added	Resource	Excerpt
2026-05-17 2026	OpenAI Urges macOS Users to Update After TanStack Supply Chain Attack Hits Signing Keys Supply Chain	OpenAI is strongly advising macOS users to update their systems following a supply chain attack on TanStack. The attack compromised signing keys, potentially affecting applications that rely on them. While specific details about the extent of the compromise or any direct impact on OpenAI products are not immediately clear, the alert highlights a significant security incident within the software development ecosystem. Users should ensure their macOS and any affected applications are updated to the latest versions to mitigate potential risks. No bug bounty payout amount was specified.
2026-05-15 2026	Nginx Remote Code Execution Vulnerability (CVE-2026-42945) Notice RCE	Nginx has a critical remote code execution (RCE) vulnerability, tracked as CVE-2026-42945. This flaw allows attackers to execute arbitrary code on affected Nginx servers. The exact impact and exploitability details are still emerging, but it represents a significant security risk for websites and applications relying on Nginx. Users are advised to monitor official Nginx advisories for patches and mitigation strategies. No bug bounty payout amount is mentioned in this notice.
2026-05-13 2026	DDoS Protection for Insurance: Always-On Defense for Claims Quotes & APIs API Sec	This article highlights the critical need for Always-On DDoS protection for insurance companies, specifically for their claims, quotes, and API services. It emphasizes that continuous availability is paramount to maintain customer trust and operational integrity. The proposed solution focuses on robust defense mechanisms to prevent service disruptions, ensuring that policyholders can access essential services like submitting claims or getting quotes without interruption, even under attack.
2026-05-12 2026	How AICanDetect Lateral Movement in Supply Chain Attacks Supply Chain	This content likely discusses how Artificial Intelligence (AI) can be employed to identify lateral movement within supply chain attacks. Lateral movement is a critical phase where attackers expand their access within a compromised network. AI's capabilities in analyzing large datasets and detecting anomalous patterns would be key to spotting these advanced persistent threats. The focus is on leveraging AI to enhance security defenses against sophisticated attacks that exploit the interconnectedness of supply chains.
2026-05-10 2026	Ivanti Warns of New EPMM Flaw Exploited in Zero-Day Attacks RCE	Ivanti has issued a warning about a new critical vulnerability in its Endpoint Manager Mobile (EPMM) software that is already being exploited in zero-day attacks. The flaw, identified as CVE-2024-22053, allows unauthenticated attackers to gain administrative access to affected systems. Ivanti is urging customers to immediately apply a patch to mitigate the risk. No specific bounty payout amount was mentioned in the provided content.
2026-05-08 2026	CVE-2026-23918: Apache HTTP/2 Double-Free Vulnerability with Possible RCE RCE	Apache HTTP/2 has a critical double-free vulnerability (CVE-2026-23918) that could lead to remote code execution (RCE). The vulnerability stems from improper handling of connection state during graceful shutdown when certain HTTP/2 frames are processed. This could allow an attacker to trigger the double-free condition, potentially gaining control of the server. This issue affects all Apache HTTP Server versions from 2.4.51 to 2.4.53. Users are strongly advised to update to version 2.4.54 or later to mitigate this risk.
2026-05-07 2026	API Security Operations: How to Move from Visibility to Measurable Risk Reduction API Sec	This article, "API Security Operations: How to Move from Visibility to Measurable Risk Reduction," discusses the transition from simply identifying API security vulnerabilities to actively reducing measurable risk. It likely outlines strategies and best practices for organizations to enhance their API security posture. The core message centers on moving beyond basic detection to implementing proactive measures that demonstrably improve security and minimize potential threats. The provided link points to further details on this topic. No specific bounty payout amount is mentioned.
2026-05-01 2026	CVE-2026-42208: Pre-Authentication SQL Injection in LiteLLM Exposes API Credentials API Sec SQLi	A critical SQL injection vulnerability, CVE-2026-42208, has been discovered in LiteLLM. This pre-authentication flaw allows attackers to execute arbitrary SQL queries without needing to log in. The exploitation of this vulnerability can lead to the exposure of sensitive API credentials, posing a significant security risk. This allows unauthorized access and potential compromise of services integrated with LiteLLM.
2026-05-01 2026	How Escape AI Pentesting Exploited SSRF in LiteLLM SSRF	Writeup detailing SSRF vulnerabilities in LiteLLM, specifically highlighting three sinks found by Escape AI pentesting. The first sink, a blind SSRF via the `/v1/rag/ingest` endpoint, is exploitable by any authenticated user, allowing access to loopback and cloud-metadata addresses without destination validation. The second sink, found in `/search_tools/test_connection`, bypasses a previously implemented security gate by nesting `api_base` within `litellm_params`, enabling SSRF for admin users. The third sink, `/health/test_connection`, also requires admin privileges and demonstrates full-read SSRF through a similar nested `api_base` parameter.
2026-04-30 2026	Escape AI Pentesting Agents 2.0 AuthZ	Library for agentic pentesting, offering a multi-agent architecture with a coordinator agent orchestrating specialized agents for tasks like reconnaissance, XSS detection (including reflected, stored, DOM-based, CSP bypasses, and framework-specific attacks), and application crawling. This system chains multiple techniques, adapts strategies in real-time, and produces evidence-rich findings with executable proof and reasoning traces, designed to improve upon traditional DAST scanner limitations and provide programmable security gates for CI/CD pipelines.
2026-04-30 2026	Benchmarking AI Pentesting Tools: A Practical Comparison AI	This article provides a practical comparison of AI-powered penetration testing tools. It evaluates their effectiveness and efficiency in various cybersecurity scenarios. The focus is on how these tools leverage AI to automate and enhance aspects of the pentesting process, such as vulnerability detection and exploitation. The comparison aims to help security professionals choose the most suitable AI tools for their needs. No specific bounty payout amounts are mentioned in the provided content.
2026-04-29 2026	7 MCP Authentication Vulnerabilities B2B SaaS Vendors Must Prevent AuthN	Analysis of 281 MCP implementations by Pynt reveals significant authentication vulnerabilities in AI agent integrations. B2B SaaS vendors must address token leakage via tool results, confused deputy via token passthrough, prompt injection leading to auth bypass, and over-scoped OAuth grants. Prompt injection, exemplified by a Supabase Cursor incident, allows attackers to exploit untrusted external content as executable instructions. Mitigations include sanitizing tool results, independent authentication to downstream services, strict input validation, and enforcing least-privilege OAuth scopes, aligning with MCP spec updates like RFC 8707.
2026-04-28 2026	FIRESIDE CHAT: Leaked secrets are now the go-to attack vector and AI is accelerating exposures AI Secrets	Library for scanning public GitHub commits and private repositories for hard-coded secrets. It detects over 28.6 million leaked credentials in 2025, a 34% year-over-year increase, with AI infrastructure secrets like OpenRouter and DeepSeek API keys spiking significantly. The library addresses the remediation problem, noting that 64% of leaked credentials from 2022 remain active. It highlights how AI-assisted code, like commits co-signed by Claude Code, contains secrets at a 33% rate, and emphasizes the need for governance alongside tools like SPIFFE for machine identity.
2026-04-28 2026	Bitwarden CLI Compromise Linked to Ongoing Checkmarx Supply Chain Campaign Supply Chain	Writeup of the Bitwarden CLI compromise, a supply chain attack orchestrated by the Checkmarx campaign targeting developers. Threat actors compromised version 2026.4.0 by hijacking an npm package and injecting malicious code designed to steal credentials for GitHub, npm, AWS, GCP, Azure, AI tools like Claude Code, and even GitHub Actions secrets. The attack leveraged a GitHub Action within Bitwarden’s CI/CD pipeline, redirecting preinstall scripts to a custom loader that executed an obfuscated JavaScript payload. Stolen data was exfiltrated to a domain impersonating Checkmarx, with valid GitHub tokens used to enumerate and inject malicious workflows into repositories, turning compromised machines into pivot points for broader supply chain attacks.
2026-04-24 2026	Microsofts April Security Update of High-Risk Vulnerability Notice for Multiple Products RCE	Microsoft's April Security Update addresses high-risk vulnerabilities across multiple products. The notice, detailed in a linked article, highlights critical security flaws requiring immediate attention for users of affected Microsoft software. While the article itself does not specify a bug bounty payout, the update aims to patch these significant security risks to protect users from potential exploitation.
2026-04-23 2026	No Off Season: Three Supply Chain Campaigns Hit npm PyPI and Docker Hub in 48 Hours Supply Chain	Analysis of three supply chain attacks—Checkmarx KICS, CanisterSprawl, and xinference—that targeted npm, PyPI, and Docker Hub between April 21-23, 2026. These campaigns focused on stealing secrets like API keys, cloud credentials, and SSH keys from developer environments and CI/CD pipelines, with threat actors including TeamPCP utilizing techniques such as obfuscated payloads, postinstall hooks, and decentralized C2 channels.
2026-04-22 2026	Supply Chain Attacks Are Getting WorseHow to Shrink Your Exposure Supply Chain	Library for mitigating supply chain attacks, focusing on techniques to shrink exposure following incidents like the Trivy and Axios compromises. It details strategies for containing damage through short-lived credentials, least-privilege access, and blast radius separation. Proactive measures include eliminating "latest" tag usage, implementing cool-down periods for package upgrades, requiring immutable release packages, and adopting dependency management tools like Renovate and Fairwinds Nova for automated patching and chart updates.
2026-04-17 2026	JWT Security in 2025: Critical Vulnerabilities for B2B SaaS JWT	Reference of six critical JWT vulnerabilities in 2025, including CVE-2025-4692 (privilege escalation on cloud platforms), CVE-2025-30144 (issuer validation flaws in fast-jwt), CVE-2025-27371 (OAuth audience ambiguity), CVE-2025-27144 (resource exhaustion via malformed tokens in Go JOSE), CVE-2025-24976 (signing key injection via JWK issues), and CVE-2025-2079/CVE-2025-20188 (hard-coded secrets). These highlight the need for strict validation, least privilege, precise claim handling, input validation, thorough key verification, and robust secret management for B2B SaaS companies.
2026-04-17 2026	CVE-2026-34197: Apache ActiveMQ Jolokia RCE Vulnerability RCE	CVE-2026-34197 is an authenticated RCE vulnerability in Apache ActiveMQ Classic stemming from how the Jolokia JMX-HTTP bridge handles management operations. Exploitation involves an attacker invoking operations like `addNetworkConnector` with a crafted `brokerConfig` parameter, forcing the broker to load and execute a remote Spring XML configuration file, leading to code execution within the broker JVM. This long-standing behavior, present for nearly 13 years, can be exacerbated by CVE-2024-32114, making it unauthenticated RCE.
2026-04-16 2026	DAST Tools: Complete Buyer's Guide & 10 Solutions to know in 2026 API Sec	Guide to Dynamic Application Security Testing (DAST) tools focusing on critical features for modern applications. It details common frustrations with legacy scanners, such as excessive configuration, high false positive rates, poor API testing capabilities (specifically for GraphQL and REST), and weak CI/CD integration. The guide highlights essential criteria for evaluating new DAST solutions, including business logic vulnerability detection (BOLA, IDOR), low false positive rates with proof-based scanning, native API protocol support for REST and GraphQL, and deep CI/CD integration. It contrasts these with the limitations of older tools, emphasizing the need for DAST solutions that can keep pace with rapid development cycles and complex application architectures.
2026-04-16 2026	Windows IKE Service Extensions Vulnerability Enables Remote Code Execution (CVE-2026-33824)RCE	Writeup of CVE-2026-33824, a critical remote code execution vulnerability in Windows IKE Service Extensions. This memory management error, a double free condition, allows unauthenticated network-based exploitation via UDP ports 500 and 4500. Affecting multiple Windows versions, it enables attackers to gain system control, particularly impacting VPN infrastructure and exposing internal networks. Microsoft released updates in April 2026 to address this issue.
2026-04-15 2026	News alert: GitGuardian study shows AI coding tools double leak rates as 29M credentials hit GitHub Secrets	Analysis of GitGuardian's 5th "State of Secrets Sprawl" report reveals AI coding tools doubled secret leak rates in 2025, contributing to 29 million credentials detected on GitHub. Leaks associated with AI services increased 81% YoY, while MCP configuration risks and widespread secrets sprawl across collaboration tools and developer machines expanded the attack surface. The report highlights that 64% of valid secrets from 2022 remain unrevoked, underscoring critical gaps in governance and remediation for non-human identities.
2026-04-15 2026	GitHub Actions Supply Chain Attack: Trivy Breach & Workflow Supply Chain	Library detailing the GitHub Actions supply chain attack targeting the Trivy security scanner, where attackers leveraged misconfigured workflows and compromised credentials. This campaign, initially led by Hackerbot-claw and later by the TeamPCP group, resulted in code execution, token exfiltration, malicious artifact injection into Trivy's VSCode extension, and force-pushing of version tags. The attacks later expanded to compromise NPM packages and the Checkmarx AST GitHub Action, highlighting the pervasive risks of insecure CI/CD pipelines.
2026-04-14 2026	Microsofts April 2026 Patch Tuesday Addresses 163 CVEs (CVE-2026-32201)RCE	Reference of Microsoft's April 2026 Patch Tuesday, addressing 163 CVEs including critical vulnerabilities like CVE-2026-33824 in Windows IKE Service Extensions and CVE-2026-33826 in Windows Active Directory. This release also features patches for zero-day exploits, such as CVE-2026-32201 affecting Microsoft SharePoint Server and the publicly disclosed BlueHammer exploit targeting Microsoft Defender (CVE-2026-33825). Elevation of privilege vulnerabilities constitute the largest portion of this update, followed by information disclosure and remote code execution flaws.
2026-04-14 2026	Claude Mythos Changed Everything. Your APIs Are the First Target.AI	Platform for agentic security, Salt's Agentic Security Platform addresses the immediate threat posed by AI models like Claude Mythos, which can autonomously discover and exploit zero-day vulnerabilities. It provides continuous, real-time discovery of all API assets, including undocumented and shadow APIs, mapping the full agentic attack surface. The platform then assesses posture, identifying exposures like unauthenticated APIs and excessive permissions, enabling prioritized remediation to fix vulnerabilities before they can be exploited by AI-powered attackers.
2026-04-11 2026	Exploiting API4: 8 Real-World Unrestricted Resource Consumption Attack Scenarios API Sec	Library of resources detailing 8 real-world Unrestricted Resource Consumption (API4:2023) attack scenarios, including large file uploads, high-latency responses, financially impactful API abuse (e.g., SMS gateways, LLM APIs), GraphQL batching and query abuse, data bombs, and buffer overflows like CVE-2025-22457. These scenarios illustrate how attackers can cause denial of service, performance degradation, and financial losses through various API vulnerabilities.
2026-04-10 2026	Crushing the Axios supply chain threat with Tenable Hexa AI: Use cases for agentic AI Supply Chain	Tool for detecting and mitigating the Axios npm supply chain attack. Tenable Hexa AI, an agentic engine, automates scan configuration, identifies impacted assets, and prioritizes remediation, mirroring workflows applicable to emerging threats like CVEs or zero-days. Specific remediation steps for Axios include downgrading to safe versions, removing phantom dependencies, and rotating secrets.
2026-04-10 2026	Crushing the Axios supply chain threat with Tenable Hexa AI: Use cases for agentic AI AI	Tool for identifying exposure to the Axios npm supply chain attack using Tenable Hexa AI. This agentic AI automates scanning, asset identification, and remediation verification, mirroring workflows applicable to other emerging threats like CVEs and zero-days. It enables rapid assessment of exposure, scoping blast radius through asset tagging, and efficient prioritization, transforming emergency response from manual scripting to conversational command.
2026-04-10 2026	Renovate & Dependabot: The New Malware Delivery System Supply Chain	Library for detecting supply chain attacks that exploit automated dependency updates. It analyzes how tools like Renovate and Dependabot, designed to streamline updates, can inadvertently accelerate malware distribution. The library highlights real-world incidents, including the compromise of tj-actions/changed-files, Salesloft Drift, Shai-Hulud, trivy-action, and the Axios package, demonstrating how malicious code can be integrated into CI/CD pipelines and production code through compromised dependencies and automated merges.
2026-04-10 2026	Update on React Server Components RCE (CVE-2025-55182 / CVE-2025-66478)RCE	Writeup detailing the evolving exploitation of React Server Components RCE (CVE-2025-55182, CVE-2025-66478), discussing the invalid early PoC, the emergence of scanning utilities from Assetnote, and the eventual discovery of real RCE exploit chains that leverage unsafe export resolution and prototype chain manipulation for arbitrary code execution via mechanisms like `process.mainModule.require('https')` and runtime memory shells, with observed data exfiltration via response body output, OAST/DNSLog callbacks, and Next.js redirect headers.
2026-04-10 2026	CVE-2026-20963: SharePoint Deserialization RCE Analysis Deser	Analysis of CVE-2026-20963 details a critical remote code execution vulnerability in Microsoft SharePoint stemming from unsafe deserialization of user-controlled data. Attackers exploit this by crafting malicious .NET gadget chains within serialized payloads, allowing arbitrary code execution with low-privileged authenticated access. This vulnerability, listed on CISA's Known Exploited Vulnerabilities catalog, enables attackers to compromise SharePoint servers, pivot to other network systems, and access sensitive enterprise data. Detection requires layered monitoring of application requests, process behavior, and network traffic, as exploitation often bypasses traditional signature-based methods.
2026-04-09 2026	LangChain Langflow LiteLLM: When AI's Foundation Code Becomes the Attack Surface AI	Library of vulnerabilities impacting foundational AI frameworks like LangChain, LangGraph, Langflow, and LiteLLM, including path traversal (CVE-2026-34070), serialization injection (CVE-2025-68664), SQL injection (CVE-2025-67644), and remote code execution (CVE-2026-33017). The article also details a supply chain attack on LiteLLM via a compromised Trivy security scanner, highlighting the systemic risks in AI infrastructure.
2026-04-08 2026	AI Security Risks: How Enterprises Manage LLM Shadow AI and Agentic Threats AI	Library for AI Security Posture Management (AISPM) designed to provide enterprises with visibility and control over LLM shadow AI and agentic threats. It addresses risks including prompt injection, jailbreaking, data poisoning, and data leakage from unsanctioned AI tools. The library focuses on the emerging threat landscape of agentic AI, where autonomous systems can execute multi-step actions, and highlights the critical risk of Agent Goal Hijacking as outlined in the OWASP Agentic Top 10.
2026-04-06 2026	7 Identity and API Security Tools Modern SaaS Teams Should Evaluate in 2026 API Sec	Library for assessing application security in modern SaaS environments. It highlights tools addressing enterprise SSO provisioning, API runtime protection, AI agent security, and passwordless authentication. Key solutions include SSOJet for SSO integration, Gopher Security for quantum-resistant MCP protection, Salt Security for API threat detection, 42Crunch for OpenAPI-driven security, Akto for API discovery, StackHawk for CI/CD-native DAST, and MojoAuth for passwordless CIAM. These tools aim to mitigate risks from increased API attacks, broken authentication (52% of API incidents per Wallarm), and growing AI agent adoption.
2026-04-05 2026	Critical Remote Code Execution Vulnerability in Cisco Secure Firewall Management Center (CVE-2026-20131)RCE	Writeup on CVE-2026-20131, a critical RCE vulnerability in Cisco Secure Firewall Management Center, exploitable via insecure deserialization of Java objects. This unauthenticated attack allows arbitrary code execution and privilege escalation to root. Active exploitation was observed, leading to inclusion in CISA's KEV catalog and a mandate for remediation in federal agencies. Exploitation leverages YSoSerial, with techniques including command-and-control communication.
2026-04-04 2026	Supply Chain Attacks Surge in March 2026 Supply Chain	Library for detecting and mitigating supply chain attacks impacting open-source software. It details compromises of the Axios NPM package, which distributed a cross-platform RAT via a hidden dependency ([email protected]), and the LiteLLM PyPI package, which aimed to harvest cloud credentials and SSH keys using a malicious `.pth` file and obfuscated payloads. Recommendations include reviewing lockfiles, searching for malicious domains, using SCA tools, implementing MFA, and revoking compromised secrets.
2026-04-04 2026	Supply chain attack on Axios npm package: Scope impact and remediations Supply Chain	Analysis of the Axios npm package supply chain attack details how attackers compromised versions 1.14.1 and 0.30.4 by injecting a malicious dependency, `plain-crypto-js`, which executed a remote access trojan dropper. This attack, targeting a popular HTTP client, poses significant risks of data theft, including credentials and API keys. The article stresses the need for immediate incident response, secret rotation, and proactive defense strategies like dependency pinning and environment scanning to mitigate future supply chain compromises.
2026-04-04 2026	Critical Grafana Vulnerabilities Enable Remote Code Execution and DoS Attacks RCE	Writeup of critical Grafana vulnerabilities, CVE-2026-27876 and CVE-2026-27880, enabling remote code execution and denial-of-service attacks. CVE-2026-27876, a CVSS 9.1 flaw in SQL expressions, allows arbitrary file writes leading to RCE and SSH access. CVE-2026-27880 affects OpenFeature validation endpoints, permitting instance crashes via large requests. Recommendations include immediate upgrades, disabling SQL expressions, and edge-level DoS mitigation using reverse proxies like Nginx or Cloudflare.
2026-04-04 2026	AutoSecT Mobile: Automating Android and iOS Security Testing Mobile	Platform that automates Android and iOS application security testing by performing deep APK/IPA structural analysis, integrating Static and Dynamic Application Security Testing (SAST and DAST), and mapping findings to the OWASP Mobile Top 10. AutoSecT Mobile, built by Kratikal, continuously scans applications, identifies vulnerabilities like hardcoded secrets and insecure data storage, and tests backend APIs to detect issues such as SQL injection and broken authentication, facilitating early detection and remediation within existing development workflows.
2026-04-03 2026	The developer credential economy: Why exposure data is the new front line in the supply chain war Supply Chain	Analysis of the "Developer Credential Economy" highlights how supply chain attacks leverage exposed developer credentials, such as API keys and cloud access tokens, creating a lucrative black market. Endpoint detection and response (EDR) tools are insufficient as they operate reactively and lack visibility into CI/CD environments where credential theft occurs. A Continuous Threat Exposure Management (CTEM) strategy is crucial for proactively identifying and eliminating exposure conditions like long-lived access tokens before they can be exploited, as demonstrated by the Axios and Anthropic Claude Code incidents.
2026-04-03 2026	API Attack Awareness: BOLA - Why It Tops the OWASP API Top 10 API Sec	Analysis of Broken Object Level Authorization (BOLA) vulnerabilities, a top OWASP API Top 10 risk, detailing how unauthenticated access to objects can lead to data leakage, account compromise, and business impact. The entry highlights common exploitation methods, the difficulty in detecting these stateful flaws with traditional tools, and emphasizes the need for robust backend authorization checks, mentioning Wallarm's capabilities in detecting and preventing BOLA attacks through API discovery and custom controls.
2026-04-03 2026	CyCognito Details Axios Supply Chain Attack After Malicious npm Releases Deliver Remote Access Trojan Supply Chain	Analysis of a software supply chain attack detailing how malicious versions of the npm package axios ([email protected] and [email protected]) delivered a remote access trojan during installation. The incident, identified by CyCognito, affected developer workstations, CI/CD runners, and other environments resolving dependencies during a limited exposure window, potentially exposing credentials and secrets within trusted engineering workflows. Recommended responses include precise exposure identification via lockfiles and build logs, credential rotation, and hardening dependency handling by limiting install-time script execution.
2026-04-02 2026	Frequently Asked Questions About the Axios npm Supply Chain Attack by North Korea-Nexus Threat Actor UNC1069 Supply Chain	Library details a supply chain attack on the popular axios npm package, where North Korea-nexus threat actor UNC1069 injected malicious versions (1.14.1 and 0.30.4). This compromise, live for approximately three hours, delivered the WAVESHAPER.V2 cross-platform remote access trojan via a malicious dependency, plain-crypto-js. The attack targeted millions of developer environments, with affected systems needing to be treated as fully compromised. Remediation involves downgrading axios, blocking C2 traffic, and rotating credentials.
2026-03-18 2026	When HttpOnly Isnt Enough: Chaining XSS and GhostScript for Full RCE Compromise XSS	Library for analyzing vulnerabilities in document processing applications, specifically detailing a chained attack that bypasses HttpOnly cookie protections via an unauthenticated XSS vulnerability. This XSS allows an attacker to steal an administrator's session cookie by exploiting a GWT RPC endpoint that reflects sensitive information. Further, the library demonstrates how to achieve Remote Code Execution by injecting commands into GhostScript rendering options, disabling its SAFER mode to execute arbitrary operating system commands.
2026-03-09 2026	CVE-2026-27739: Angular SSR Request Vulnerability Enabling Server-Side Request Forgery SSRF	Writeup of CVE-2026-27739, a critical Server-Side Request Forgery (SSRF) vulnerability in Angular Server-Side Rendering (SSR). Exploitation occurs when attackers manipulate HTTP headers like Host and X-Forwarded-* to trick Angular SSR into making requests to unintended destinations, potentially exposing internal services or sensitive data. Affected versions include Angular prior to 21.2.0-rc.1, 21.1.5, 20.3.17, and 19.2.21. Mitigation involves updating Angular dependencies and validating forwarded headers.
2026-01-21 2026	Tenable Discovers SSRF Vulnerability in Java TLS Handshakes That Creates DoS Risk SSRF	Writeup of CVE-2026-21945, a Java SSRF vulnerability impacting TLS handshakes. Tenable Research discovered that malicious client certificates with the AIA extension can trigger Server-Side Request Forgery (SSRF) and Denial-of-Service (DoS) attacks. The exploit highlights that client certificates in mTLS configurations act as user input and require strict validation to prevent servers from accessing potentially malicious URIs. Oracle addressed this critical vulnerability in their January 2026 Critical Patch Update, necessitating immediate updates for Java environments utilizing mTLS and AIA fetching.
2026-01-13 2026	Lack of isolation in agentic browsers resurfaces old vulnerabilities XSS	Library for analyzing agentic browser security, detailing a threat model with four trust zones and four violation classes: INJECTION, CTX_IN, REV_CTX_IN, and CTX_OUT. It outlines real-world exploits like false information dissemination and session confusion, enabled by inadequate isolation and prompt injection vulnerabilities, resurfacing older web attack patterns such as XSS and CSRF. Recommendations focus on extending the Same-Origin Policy to AI agents.
2025-12-18 2025	DeepChat AI agent XSS-to-RCE via Mermaid and Electron IPC XSS	Writeup detailing CVE-2025-67744, a critical remote code execution vulnerability in DeepChat AI agent versions prior to 0.5.3. Exploiting a combination of unsafe Mermaid diagram rendering and direct Electron IPC exposure in the renderer context, an attacker can escalate from injected JavaScript to arbitrary command execution. This vulnerability highlights emerging risks in AI-driven desktop applications that ingest and render untrusted content.
2025-11-26 2025	Paris The Thinker and why your WAF should block XSS by default XSS	Library that advocates for blocking Cross-Site Scripting (XSS) by default in Web Application Firewalls (WAFs), aligning with the OWASP Top 10's emphasis on injection risks. It highlights the ineffectiveness of alert-only modes and the severe consequences of missed XSS vulnerabilities, including account takeover and application compromise. The library promotes Imperva's WAF, which offers out-of-the-box XSS blocking through a combination of signature and behavior-based detections, reducing dwell time for opportunistic attacks and accelerating mean time to protection.
2025-11-18 2025	NDSS 2025 - EvoCrawl: Exploring Web Application Code And State Using Evolutionary Search XSS	Paper on EvoCrawl, a web crawler utilizing evolutionary search to explore web application code and state, outperforming state-of-the-art scanners with a 59% increase in code coverage and 5x more successful form submissions. EvoCrawl's ability to reach specific application states enabled the discovery of eight zero-day IDOR and XSS vulnerabilities in WordPress, HotCRP, Kanboard, ImpressCMS, and GitLab.
2025-11-07 2025	NDSS 2025 - YuraScanner: Leveraging LLMs For Task-driven Web App Scanning4 XSS	Tool for task-driven web application scanning, YuraScanner, leverages LLMs to autonomously execute tasks and discover deeper application states. It bridges the semantic gap through goal-based agents and extracts semantic information from webpages, making it web application-agnostic. YuraScanner utilizes the XSS engine of Black Widow to test input points, outperforming traditional scanners by identifying new attack surfaces and significantly improving vulnerability detection, as evidenced by the discovery of 12 zero-day XSS vulnerabilities compared to Black Widow's three.
2025-09-20 2025	How Tenable Found a Way To Bypass a Patch for BentoMLs Server-Side Request Forgery Vulnerability CVE-2025-54381 SSRF	Analysis of CVE-2025-54381 details how Tenable Research discovered a patch bypass for a critical Server-Side Request Forgery vulnerability in BentoML. The bypass exploits the absence of DNS rebinding protection, allowing attackers to first resolve a domain to a public IP that passes BentoML's validation, and then resolve it to a private or loopback IP on subsequent requests to access restricted resources. Users should update to BentoML version 1.4.22 or later.
2025-08-14 2025	7 Essential Burp Extensions for Hacking APIs - Security Boulevard Burp	Extensions for Burp Suite that enhance API security testing, including Logger++ for advanced log filtering and analysis, OpenAPI Parser for generating baseline requests from documentation, Param Miner for discovering hidden parameters, Autorize for detecting authorization flaws like BOLA/IDOR, JOSEPH for tampering with JWTs, Content Type Converter for format manipulation to find XXE and other vulnerabilities, and Attack Surface Detector for mapping risk levels.
2025-08-14 2025	Penetration Testing for Server-Side Request Forgery (SSRF) in E-commerce Pl SSRF	Walkthrough detailing Server-Side Request Forgery (SSRF) penetration testing techniques for e-commerce platforms. It explains how SSRF attacks exploit manipulated requests to access internal or external resources, leading to data breaches, network mapping, and potential remote code execution. The walkthrough outlines essential steps including scope definition, threat modeling, vulnerability scanning, manual testing, and exploitation, emphasizing the importance of input validation and network segmentation for mitigation.
2025-06-11 2025	Apache Kafka Arbitrary File Read and SSRF Vulnerability (CVE-2025-27817)SSRF	Analysis of CVE-2025-27817, an arbitrary file read and SSRF vulnerability affecting Apache Kafka versions 3.1.0 through 3.9.0. This flaw allows unauthenticated attackers to exploit insecure input validation in the Kafka client to access environment variables or arbitrary disk content via the REST API, or direct requests to unintended locations. Mitigation involves upgrading to Kafka 3.9.1 or later, or implementing temporary measures like filtering sensitive file paths in requests or restricting access to Kafka Connect instances.
2025-03-13 2025	OpenAI Under Attack: CVE-2024-27564 Actively Exploited in the Wild SSRF	Writeup detailing the active exploitation of CVE-2024-27564, a Server-Side Request Forgery (SSRF) vulnerability impacting OpenAI's ChatGPT infrastructure. The analysis highlights over 10,479 attack attempts, with financial institutions being prime targets due to their reliance on AI services. It emphasizes that 35% of analyzed organizations remain unprotected due to misconfigured IPS, WAF, and firewall settings, underscoring the real-world risk posed by even medium-severity vulnerabilities and malicious IPs like 31.56.56[.]156.