CVEOCT 1810m
CVE-2026-111998 — Vanus: the Hardcoded `admin` Token That Owns the Cluster
A hardcoded admin token in Vanus grants cluster-admin to anyone who guesses it.
- #Vanus
- #DefaultCredentials
- #CWE-1392
IndexAll entries
newest first.
Root cause first. Public advisories, patch diffs, and the detection gaps that survive the patch.
CVE ROOT CAUSE◆IMPLANT ENGINEERING◆AD ATTACK PATHS◆DETECTION FIRST◆LAB-DERIVED ONLY◆NO CLIENT DATA◆CVE ROOT CAUSE◆IMPLANT ENGINEERING◆AD ATTACK PATHS◆DETECTION FIRST◆LAB-DERIVED ONLY◆NO CLIENT DATA◆
CVE Research
Root cause first. Public advisories, patch diffs, and the detection gaps that survive the patch.
CVEOCT 1811m
CVE-2026-111999 — Vanus: Unauthenticated CloudEvents Publish on Port 8081
Unauthenticated CloudEvents publish on Vanus gateway port 8081.
- #Vanus
- #MissingAuth
- #CWE-306
CVEOCT 1812m
CVE-2026-112000 — Vanus: Missing Authorization in Gateway Streaming RPCs
Missing authorization in Vanus gateway streaming RPCs and default-allow policy.
- #Vanus
- #MissingAuthz
- #CWE-862
CVEOCT 0714m
CVE-2026-106058 — GNU GitAhead: OS Command Injection in Filter.cpp → Live RCE
OS command injection in GitAhead Filter.cpp via unquoted filenames handed to bash -c.
- #GitAhead
- #CommandInjection
- #CWE-78
CVEOCT 0713m
CVE-2026-106059 — GNU GitAhead: \"Show in Finder\" AppleScript Injection on macOS
AppleScript injection in GitAhead ShowTool on macOS via unescaped filenames.
- #GitAhead
- #AppleScript
- #macOS
CVEOCT 0511m
CVE-2026-105295 — GNU GitAhead: Unverified Update Installation and TLS Bypass
Unverified update installation and a persistent TLS bypass in GitAhead 2.5.0-2.7.1.
- #GitAhead
- #Updater
- #TLS
CVESEP 2812m
CVE-2026-102333 — or: How a Pure-Python HTTP Debug Tool Taught Me Not to Trust Lovingly Escaped HTML
Stored XSS in httpdbg via a javascript: URL scheme that survives Mustache HTML-encoding.
- #httpdbg
- #StoredXSS
- #Python
No index is complete without the next one.
The dispatch carries one long-form writeup, roughly twice a month. Same standard, same lab, no drip feed.