Category
Deep Dive
In-depth write-ups of newly disclosed vulnerabilities: who is affected, how to fix it, and how the flaw works.
Node2Shell: Brotli RCE in Node.js, Bun and Python (CVE-2026-111497)
A decoder overflow rated CVSS v4.0 9.2, CVE-2026-111497 affects Node.js, Bun, .NET, the Python Brotli packages, Envoy and Istio; fixes shipped October 21 to 25, 2026.
Oct 25, 2026
Echo WebSocket Proxy Auth Bypass (GHSA-cxf3-9h37-7rr8)
Rejected WebSocket upgrades through Echo's Proxy middleware leave a raw tunnel open to the upstre...
Oct 24, 2026
Laravel Token Guard Authentication Bypass (CVE-2026-114509)
Laravel rates CVE-2026-114509 as Critical, CVSS v4.0 9.2: an unauthenticated attacker can sign in...
Oct 24, 2026
Collabora CODE Server RCE Exploited in the Wild (CVE-2026-110447)
Collabora rates CVE-2026-110447 as Critical, CVSS v4.0 9.2: an unauthenticated attacker can run o...
Oct 24, 2026
More in Deep Dive
Sentry Next.js SDK Middleware Bypass (CVE-2026-114139)
Sentry rates CVE-2026-114139 as Critical, CVSS v4.0 9.1: the @sentry/nextjs SDK skips the application middleware for every path under a configured tunnelRoute on webpack builds, while the tunnel rewrite serves only the exact tunnel path, so an unauthenticated request can reach a route under the tunnel path without middleware authorization. Affected are @sentry/nextjs 9.36.0 to 9.47.1, 10.x before 10.75.2 and 11.0.0 prereleases before 11.0.0-rc.1. Fixed in 9.47.2, 10.75.2 and 11.0.0-rc.1; no exploitation in the wild is known.
Oct 24, 2026
GHSA-673q-mjm6-r5xr: Unauthenticated RCE in Next.js "use cache" Functions
GHSA-673q-mjm6-r5xr is rated Critical, CVSS v4.0 9.5, in the GitHub Advisory Database: an unauthenticated attacker can run code on a Next.js 16 server that uses App Router with Cache Components and has a use cache function returning multiple typed arrays. The database review classifies the flaw as deserialization of untrusted data (CWE-502) in the React Server Components transport protocol that Next.js bundles. Fixed in Next.js 16.4.1, with no workaround available.
Oct 23, 2026