Threat Research - Safe Security
SAFE Named a Leader in the 2026 IDC MarketScape for TPRM. Get the Report →
Book a demo

Threat Research

Threat Research CVE-2026-101894: Symlink-Chain Path Traversal in @xhmikosr/decompress 1. Introduction The @xhmikosr/decompress package extracts tar, tar.gz, tar.bz2, and ZIP archives in Node.js applications. CVE-2026-101894 is a symlink-chain path traversal in its default decompress(input, output) API: crafted… SAFE Safe Security Oct 20, 2026 10 min read
Threat Research CVE-2026-41948 Dify ≤ 1.14.1 – Unauthenticated Plugin Daemon Internal API Exposure via Path Traversal in the Console Icon Proxy 1. Introduction This document illustrates a relative path traversal vulnerability in Dify, the open-source large language model (LLM) application development platform used by more than 50,000 organisations to… SAFE Safe Security Oct 19, 2026 10 min read
Threat Research CVE-2026-45332 Automad Flat-File CMS Unauthenticated Admin Password Hash Disclosure via Broken Setup Endpoint — Offline Hash Cracking 1. Introduction This document illustrates an unauthenticated sensitive data exposure vulnerability in Automad — a modern flat-file content management system. The vulnerability, tracked as CVE-2026-45332, allows any unauthenticated… SAFE Safe Security Oct 19, 2026 9 min read
Threat Research CVE-2026-48611 phpBB Forum Software Unauthenticated Authentication Bypass via OAuth Login-Link Flow — Full Admin Takeover 1. Introduction This document illustrates a critical authentication bypass vulnerability in phpBB — the most widely deployed open-source forum software in the world, powering over 500,000 active forum… SAFE Safe Security Oct 14, 2026 9 min read
Threat Research This Week in CVEs: Exploitation Expands Across Backup, Remote Access, and Developer Infrastructure By SAFE Threat Research Team This week’s exploitation activity expanded across some of the most operationally important layers of enterprise infrastructure – from backup platforms and remote-access appliances… SAFE Safe Security Oct 13, 2026 9 min read
Threat Research CVE-2026-33032 nginx-ui ≤ 2.3.3 – Unauthenticated MCP Authentication Bypass via Missing AuthRequired() Middleware on /mcp_message 1. Introduction This document illustrates an unauthenticated authentication bypass in nginx-ui, the open-source web interface used to manage Nginx web servers. The flaw lets an anonymous network client… SAFE Safe Security Oct 9, 2026 9 min read