Author
Ostorlab Team
Laravel Token Guard Authentication Bypass (CVE-2026-114509)
Laravel rates CVE-2026-114509 as Critical, CVSS v4.0 9.2: an unauthenticated attacker can sign in as an existing user of the legacy token API guard on MySQL or MariaDB by sending a JSON body like {"api_token": [0]}, without knowing any valid API token. Fixed in 12.68.0 and 13.29.0, with the fix also present in the 11.56.1 tag. A public proof of concept has existed since October 22, 2026, and no exploitation in the wild is known.
Oct 24, 2026
Pillow FlashPix Heap Overflow RCE (CVE-2026-112398)
Decoding a crafted FlashPix image in Pillow 12.3.0 or older with olefile installed lets an attack...
Oct 24, 2026
Collabora CODE Server RCE Exploited in the Wild (CVE-2026-110447)
Collabora rates CVE-2026-110447 as Critical, CVSS v4.0 9.2: an unauthenticated attacker can run o...
Oct 24, 2026
Sentry Next.js SDK Middleware Bypass (CVE-2026-114139)
Sentry rates CVE-2026-114139 as Critical, CVSS v4.0 9.1: the @sentry/nextjs SDK skips the applica...
Oct 24, 2026
More by Ostorlab Team
Wasmtime Sandbox Escape via Compiler Miscompilation (CVE-2026-115889)
CVE-2026-115889 is a Critical Wasmtime sandbox escape: Cranelift packs indices into 24-bit fields that a crafted module overflows. Fixed in 36.0.19 and 43.0.0.
Oct 24, 2026
GHSA-2464-fhr4-w9xw (CVE-2026-96889): Unauthenticated RCE in Next.js Image Optimization
Vercel rates GHSA-2464-fhr4-w9xw Critical, CVSS v4.0 9.5: an unauthenticated attacker can run code on a Next.js 10.0.0–15.5.27 or 16.0.0–16.4.0 server whose Image Optimization API processes SVG on glibc-based Linux. The bug is a use-after-free in librsvg (CVE-2026-96889), bundled in sharp's prebuilt binaries. Next.js 15.5.28 and 16.4.1 fix it on Node.js 20.9.0 or later by resolving sharp 0.35.5, which bundles the patched librsvg 2.63.2.
Oct 23, 2026
GHSA-673q-mjm6-r5xr: Unauthenticated RCE in Next.js "use cache" Functions
GHSA-673q-mjm6-r5xr is rated Critical, CVSS v4.0 9.5, in the GitHub Advisory Database: an unauthenticated attacker can run code on a Next.js 16 server that uses App Router with Cache Components and has a use cache function returning multiple typed arrays. The database review classifies the flaw as deserialization of untrusted data (CWE-502) in the React Server Components transport protocol that Next.js bundles. Fixed in Next.js 16.4.1, with no workaround available.
Oct 23, 2026
GHSA-cg2g-xh64-v4q7: DOMPurify SAFE_FOR_TEMPLATES Bypass in Shadow Roots
DOMPurify 3.4.4–3.4.16 lets split ${...} expressions survive SAFE_FOR_TEMPLATES inside attached shadow roots (Critical, CVSS v4.0 9.2). Upgrade to 3.4.17.
Oct 23, 2026
Your AI Pentester Now Asks Before It Takes a Risky Action
Agentic scans can now ask for your approval before a risky action. Choose how the agent handles it, answer from the Approvals tab, and decide what happens when nobody does.
Oct 23, 2026
October 2026: From Security Findings to Tested Fixes
We added approvals to control dangerous actions, introduced Ticket Agent for autonomous triage and compliance automation, and extended finding workflows with Verify Fix and unreleased-build retesting.
Oct 17, 2026
New Dashboard UI, On-Premises Scanner, Agentic Scan Knowledge, Multi-Asset Scanning, Linear & MCP Integrations, and New Model Support
This release adds a redesigned Dashboard UI (Cockpit, Focus Mode, and Custom Dashboards), keyboard shortcuts for ticket management, an on-premises vulnerability scanner for internal networks, persistent scan knowledge across runs, an MCP server for AI tools, multi-asset scanning, remediation streams with timeline tracking, Threat Center EUVD intelligence, and expanded AI model support.
Sep 02, 2026
App Vetting, Scan Coverage Heatmap, Mobile Shielding Scan, Deep Agentic Scan Improvements, Cyber Models & Source Code Scanning
This release introduces App Vetting, Scan Coverage Heatmap, Mobile Shielding Scan, Deep Agentic Scan improvements, Cyber Models, additional model support, and source code scanning.
Jul 07, 2026
Single Vulnerability Assessment (SVA), Dig Deeper, Scan Report PDF Design Improvement & Multilanguage Support
This release introduces Single Vulnerability Assessment (SVA) for targeted validation, Dig Deeper for granular root-cause investigation, Live Attack Scenario Risk & Status Tracking, Scan Report PDF Design Improvement, full multilanguage localization, and new compliance whitelisting support.
Jun 01, 2026
Deep Agentic Scan (BYOK), New CI Integrations, Scan Filters & Performance
This release highlights Agentic Deep Scan with BYOK (Bring Your Own AI Key), adds Harness + Bitrise CI documentation, introduces scan filtering by tags and owners, and delivers major performance improvements across tickets and scans.
Mar 27, 2026