Threat Research - Page 2 of 6 - Safe Security
SAFE Named a Leader in the 2026 Liminal Index for Cyber TPRM. Get the Report →
Book a demo

Threat Research

Threat Research CVE-2026-44381 MISP Threat Intelligence Platform Authenticated SQL Injection via ORDER BY Parameter POST /events/index — Boolean-Blind + Time-Based Oracle 1. Introduction This document illustrates a SQL injection vulnerability in MISP — the Malware Information Sharing Platform and Threat Sharing system — an open-source threat intelligence platform used… SAFE Safe Security Oct 21, 2026 9 min read
Threat Research One Person, Five AI Tools, a Country’s Banks: Inside South Korea’s AI-Run Breach A financially motivated hacker used a stack of AI tools to hit South Korean banks at the speed of a whole team. The tooling was new. The way… Rahul Tyagi Safe Security Oct 20, 2026 9 min read
Threat Research CVE-2026-101894: Symlink-Chain Path Traversal in @xhmikosr/decompress 1. Introduction The @xhmikosr/decompress package extracts tar, tar.gz, tar.bz2, and ZIP archives in Node.js applications. CVE-2026-101894 is a symlink-chain path traversal in its default decompress(input, output) API: crafted… SAFE Safe Security Oct 20, 2026 10 min read
Threat Research CVE-2026-41948 Dify ≤ 1.14.1 – Unauthenticated Plugin Daemon Internal API Exposure via Path Traversal in the Console Icon Proxy 1. Introduction This document illustrates a relative path traversal vulnerability in Dify, the open-source large language model (LLM) application development platform used by more than 50,000 organisations to… SAFE Safe Security Oct 19, 2026 10 min read
Threat Research CVE-2026-45332 Automad Flat-File CMS Unauthenticated Admin Password Hash Disclosure via Broken Setup Endpoint — Offline Hash Cracking 1. Introduction This document illustrates an unauthenticated sensitive data exposure vulnerability in Automad — a modern flat-file content management system. The vulnerability, tracked as CVE-2026-45332, allows any unauthenticated… SAFE Safe Security Oct 19, 2026 9 min read
Threat Research CVE-2026-48611 phpBB Forum Software Unauthenticated Authentication Bypass via OAuth Login-Link Flow — Full Admin Takeover 1. Introduction This document illustrates a critical authentication bypass vulnerability in phpBB — the most widely deployed open-source forum software in the world, powering over 500,000 active forum… SAFE Safe Security Oct 14, 2026 9 min read
Threat Research This Week in CVEs: Exploitation Expands Across Backup, Remote Access, and Developer Infrastructure This week’s exploitation activity expanded across some of the most operationally important layers of enterprise infrastructure – from backup platforms and remote-access appliances to collaboration and developer systems.… Threat Research Team Safe Security Oct 13, 2026 9 min read
Threat Research CVE-2026-33032 nginx-ui ≤ 2.3.3 – Unauthenticated MCP Authentication Bypass via Missing AuthRequired() Middleware on /mcp_message 1. Introduction This document illustrates an unauthenticated authentication bypass in nginx-ui, the open-source web interface used to manage Nginx web servers. The flaw lets an anonymous network client… SAFE Safe Security Oct 9, 2026 9 min read
Threat Research CVE-2026-87902 WordPress: Unauthenticated Path Traversal Leading to Conditional RCE 1. Introduction CVE-2026-87902 is an unauthenticated path traversal vulnerability in WordPress page-template resolution. Under specific theme and server conditions, a remote attacker can include a readable local PHP… SAFE Safe Security Oct 7, 2026 8 min read
Threat Research CVE-2026-63077 : JetBrains TeamCity On-Premises – Unauthenticated Remote Code Execution via Agent Polling Deserialization 1. Introduction This document illustrates an unauthenticated Remote Code Execution (RCE) vulnerability in JetBrains TeamCity On-Premises – the widely deployed commercial Continuous Integration and Continuous Delivery (CI/CD) server… SAFE Safe Security Oct 6, 2026 9 min read
Threat Research CVE-2026-62201 OpenClaw: Sandbox Exec-Server SSRF and Network Policy Bypass 1. Introduction This article examines a Server-Side Request Forgery (SSRF) and network policy bypass in OpenClaw, a local-first AI assistant platform that supports execution through sandboxed backends. Tracked… SAFE Safe Security Oct 5, 2026 9 min read
Threat Research CVE-2026-34486 | Apache Tomcat: EncryptInterceptor Bypass to Remote Code Execution 1. Introduction This article examines a Missing Encryption of Sensitive Data vulnerability in Apache Tomcat, a widely deployed open-source Java servlet container. The flaw allows an attacker with… SAFE Safe Security Oct 2, 2026 9 min read