<![CDATA[Advisories]]>https://ole-hartwig.eu/en/advisoriesen-GBThu, 01 Oct 2026 10:05:28 +0200<![CDATA[Review 2026: Security advisories from May to September]]>https://ole-hartwig.eu/en/advisories/review-2026https://ole-hartwig.eu/page-3753Tue, 29 Sep 2026 21:48:43 +0200<![CDATA[Sylius Security Release 1.12.25 / 1.13.17 / 1.14.20 / 2.1.16 / 2.2.9: JWT Audience Confusion Lets a Shop Customer Take Over the Admin API]]>https://ole-hartwig.eu/en/advisories/sylius-security-release-1-12-25-1-13-17-1-14-20-2-1-16-2-2-9-jwt-audience-confusionhttps://ole-hartwig.eu/page-2885Thu, 24 Sep 2026 08:33:19 +0200<![CDATA[TYPO3 14.3.7 and 13.4.35: Information Disclosure in the Localization Wizard and Missing Authorization for Configuration Commands Fixed]]>https://ole-hartwig.eu/en/advisories/typo3-14-3-7-13-4-35-security-release-sa-022-sa-023https://ole-hartwig.eu/page-2877Sat, 19 Sep 2026 08:22:15 +0200<![CDATA[redis-parser CVE-2026-93435: Unbounded Recursion in RESP Parsing Crashes ioredis Clients]]>https://ole-hartwig.eu/en/advisories/redis-parser-cve-2026-93435-ioredis-resp-recursion-doshttps://ole-hartwig.eu/page-2875Sat, 19 Sep 2026 08:19:54 +0200<![CDATA[GitLab CVE-2026-85706: Path Traversal in the Commits API Allows Unauthenticated Reading of Arbitrary Files — Actively Exploited, CVSS 10.0, Now in the CISA KEV]]>https://ole-hartwig.eu/en/advisories/gitlab-cve-2026-85706-commits-api-path-traversal-unauthenticated-file-read-kevhttps://ole-hartwig.eu/page-2837Thu, 17 Sep 2026 08:21:20 +0200<![CDATA[TYPO3-EXT-SA-2026-025: Five CVEs in “Apache Solr for TYPO3” — from broken access control to PHP object injection]]>https://ole-hartwig.eu/en/advisories/typo3-ext-sa-2026-025-apache-solr-broken-access-control-deserializationhttps://ole-hartwig.eu/page-2776Sat, 29 Aug 2026 08:23:47 +0200<![CDATA[SCTPhantom (CVE-2026-64564): An 18-Year-Old Use-After-Free in the Linux Kernel's SCTP Stack — Root Claim Disputed]]>https://ole-hartwig.eu/en/advisories/cve-2026-64564-sctphantom-linux-kernel-sctp-use-after-free-container-escapehttps://ole-hartwig.eu/page-2763Sat, 08 Aug 2026 08:21:53 +0200<![CDATA[Keyv/Cacheable npm Compromise: Mini Shai-Hulud Worm Poisons Hundreds of Packages via preinstall Hook and Claude Code/VS Code Autostart]]>https://ole-hartwig.eu/en/advisories/keyv-cacheable-npm-mini-shai-hulud-supply-chain-wormhttps://ole-hartwig.eu/page-2759Wed, 05 Aug 2026 08:25:15 +0200<![CDATA[TYPO3-EXT-SA-2026-013 (CVE-2026-46725): Insecure Deserialization in “Content Element Selector” (ceselector) — Unauthenticated RCE, Fixed in 6.0.1/5.0.1/4.0.2/3.0.3]]>https://ole-hartwig.eu/en/advisories/typo3-cve-2026-46725-ceselector-deserialization-rcehttps://ole-hartwig.eu/page-2758Wed, 05 Aug 2026 08:20:26 +0200<![CDATA[PHP 8.5.9, 8.4.24, 8.3.33, 8.2.33: coordinated security release fixes PostgreSQL SQL injection and BCMath memory corruption]]>https://ole-hartwig.eu/en/advisories/php-8-5-9-8-4-24-8-3-33-8-2-33-security-release-cve-2026-17543-17544https://ole-hartwig.eu/page-2755Thu, 30 Jul 2026 18:05:02 +0200<![CDATA[Langflow CVE-2026-0770: exec_globals Enables Unauthenticated RCE — Langflow's Second CISA KEV Entry, No Patch in Sight]]>https://ole-hartwig.eu/en/advisories/langflow-cve-2026-0770-exec-globals-unauthenticated-rcehttps://ole-hartwig.eu/page-2706Mon, 27 Jul 2026 08:22:01 +0200<![CDATA[NGINX CVE-2026-42533: Heap Buffer Overflow from Capture-Variable Ordering in map/regex — Patch Mandatory for Kubernetes Ingress]]>https://ole-hartwig.eu/en/advisories/nginx-cve-2026-42533-heap-buffer-overflow-map-regexhttps://ole-hartwig.eu/page-2674Thu, 23 Jul 2026 08:20:08 +0200<![CDATA[LiteLLM CVE-2026-47101, -47102, -40217: From a Low-Privilege User to proxy_admin and RCE — a Three-Bug Chain in the AI Gateway]]>https://ole-hartwig.eu/en/advisories/litellm-cve-2026-47101-47102-40217-privilege-escalation-rce-chainhttps://ole-hartwig.eu/page-2564Sat, 18 Jul 2026 09:17:20 +0200<![CDATA[TYPO3 SA-2026-020 (CVE-2026-15305): the Form Framework's MimeTypeValidator was never registered — fixed in 14.3.5]]>https://ole-hartwig.eu/en/advisories/typo3-cve-2026-15305-form-framework-mimetypevalidatorhttps://ole-hartwig.eu/page-2394Thu, 16 Jul 2026 08:28:00 +0200<![CDATA[Sylius Mollie Plugin: payment webhook forgery and order ID enumeration — fixed in 2.2.9 / 3.2.5 / 3.3.2]]>https://ole-hartwig.eu/en/advisories/sylius-mollie-plugin-payment-webhook-forgery-order-enumerationhttps://ole-hartwig.eu/page-2386Wed, 15 Jul 2026 10:28:30 +0200<![CDATA[GhostLock (CVE-2026-43499): a 15-year-old futex race in the Linux kernel opens the door to root and container escape]]>https://ole-hartwig.eu/en/advisories/ghostlock-cve-2026-43499-linux-kernel-futex-use-after-free-root-container-escapehttps://ole-hartwig.eu/page-2378Tue, 14 Jul 2026 11:09:08 +0200<![CDATA[npm v12: install scripts are now off by default — what it means for your CI]]>https://ole-hartwig.eu/en/advisories/npm-v12-install-scripts-off-by-defaulthttps://ole-hartwig.eu/page-2373Tue, 14 Jul 2026 10:58:30 +0200<![CDATA[GitLab patch release 19.0.2 / 18.11.5 / 18.10.8: two High flaws allow account takeover and XSS — update self-managed now]]>https://ole-hartwig.eu/en/advisories/gitlab-patch-release-19-0-2-18-11-5-18-10-8-cve-2026-6552-10087https://ole-hartwig.eu/page-2123Sat, 13 Jun 2026 11:32:22 +0200<![CDATA[TYPO3 14.3.3 & 13.4.31: 14 security advisories in one day — every one of the 15 vulnerabilities analysed individually]]>https://ole-hartwig.eu/en/advisories/typo3-14-3-3-13-4-31-security-release-14-advisorieshttps://ole-hartwig.eu/page-2047Tue, 09 Jun 2026 14:16:00 +0200<![CDATA[Miasma moves from the package manager into the editor: a clone + “open folder” in Claude Code, Cursor, Gemini CLI or VS Code is enough — and it hit Azure/durabletask too]]>https://ole-hartwig.eu/en/advisories/miasma-ai-coding-agent-config-injection-claude-cursor-gemini-vscodehttps://ole-hartwig.eu/page-2027Sun, 07 Jun 2026 09:29:00 +0200<![CDATA[PHP SOAP: CVE-2026-6722 — unauthenticated use-after-free RCE in ext-soap (plus four more PHP findings in the same release)]]>https://ole-hartwig.eu/en/advisories/php-soap-cve-2026-6722-use-after-free-rce-clusterhttps://ole-hartwig.eu/page-2029Sat, 06 Jun 2026 10:30:00 +0200<![CDATA[IronWorm: a Rust npm worm that abuses npm Trusted Publishing, vanishes behind an eBPF rootkit and exfiltrates without C2]]>https://ole-hartwig.eu/en/advisories/ironworm-rust-npm-worm-trusted-publishing-ebpf-rootkithttps://ole-hartwig.eu/page-2127Sat, 06 Jun 2026 07:26:00 +0200<![CDATA[binding.gyp - an npm supply chain worm that abuses node-gyp instead of postinstall — and harvests CI/CD credentials]]>https://ole-hartwig.eu/en/advisories/binding-gyp-npm-node-gyp-supply-chain-worm-credential-harvestinghttps://ole-hartwig.eu/page-2010Thu, 04 Jun 2026 21:37:06 +0200<![CDATA[FrankenPHP 1.12.4 closes underscore-header spoofing — and bundles the security patches from Caddy 2.11.4 and Mercure 0.24.2]]>https://ole-hartwig.eu/en/advisories/frankenphp-1-12-4-underscore-header-spoofing-caddy-2-11-4-mercure-0-24-2https://ole-hartwig.eu/page-2004Thu, 04 Jun 2026 16:37:00 +0200<![CDATA[Sylius security release 2.0.18 / 2.1.15 / 2.2.6 — three flaws in the shop and payment API path (cart LiveComponent, payment IDOR, channel bypass)]]>https://ole-hartwig.eu/en/advisories/sylius-security-release-cart-livecomponent-payment-idor-channel-bypasshttps://ole-hartwig.eu/page-1991Wed, 03 Jun 2026 17:13:59 +0200<![CDATA[CVE-2026-1784: OpenShift Ingress Operator — RCE via HAProxy config injection in the Route spec.path]]>https://ole-hartwig.eu/en/advisories/cve-2026-1784-openshift-ingress-operator-haproxy-config-injection-route-path-rcehttps://ole-hartwig.eu/page-1927Tue, 02 Jun 2026 15:52:00 +0200<![CDATA[Miasma: The Spreading Blight — when a trusted npm namespace becomes the supply chain for a cloud-identity worm]]>https://ole-hartwig.eu/en/advisories/miasma-redhat-cloud-services-npm-mini-shai-hulud-cloud-identity-wormhttps://ole-hartwig.eu/page-1919Tue, 02 Jun 2026 09:37:00 +0200<![CDATA[CVE-2026-48736: SSRF bypass in Symfony's NoPrivateNetworkHttpClient — when the IPv6 transition forms aren't on the block list]]>https://ole-hartwig.eu/en/advisories/cve-2026-48736-symfony-noprivatenetworkhttpclient-ipv6-transition-ssrfhttps://ole-hartwig.eu/page-1914Sun, 31 May 2026 22:44:23 +0200<![CDATA[CVE-2026-48489: Symfony Firewall Bypass via failure_forward — when an internal subrequest skips the access_control line]]>https://ole-hartwig.eu/en/advisories/cve-2026-48489-symfony-firewall-bypass-failure-forward-subrequesthttps://ole-hartwig.eu/page-1913Sun, 31 May 2026 22:22:07 +0200<![CDATA[BadHost (CVE-2026-48710): One line in the Host header switches auth off — Starlette, FastAPI and every MCP server below 1.0.1 are the line]]>https://ole-hartwig.eu/en/advisories/cve-2026-48710-badhost-starlette-mcp-fastapi-host-header-auth-bypasshttps://ole-hartwig.eu/page-1861Thu, 28 May 2026 19:18:41 +0200<![CDATA[Six TYPO3 extension advisories on 19 May 2026 — two RCEs, two SQL injections, ke_search times three, one access-control gap, and what patch order the cluster demands]]>https://ole-hartwig.eu/en/advisories/typo3-ext-sa-2026-008-to-013-extension-cluster-may-2026https://ole-hartwig.eu/page-1625Sun, 24 May 2026 14:00:00 +0200<![CDATA[Twin Composer Incident on 22 May 2026 — Laravel-Lang Tag Injection (Aikido) and Postinstall Wave in 8 Composer Packages + 700+ GitHub Repositories (Socket)]]>https://ole-hartwig.eu/en/advisories/laravel-lang-tag-injection-supply-chain-may-2026https://ole-hartwig.eu/page-1836Sat, 23 May 2026 06:28:33 +0200<![CDATA[Symfony 5.4.52 / 6.4.40 / 7.4.12 / 8.0.12 — seven CVEs in a single maintenance window, from SMTP header injection in Mime\Address to the UrlGenerator route-requirement bypass]]>https://ole-hartwig.eu/en/advisories/symfony-5-4-52-6-4-40-7-4-12-8-0-12-disclosure-wave-cve-45064-45065-45066-45753-50340https://ole-hartwig.eu/page-1633Wed, 20 May 2026 13:40:00 +0200<![CDATA[FrankenPHP 1.12.3 closes CVE-2026-45062 — when Unicode path splitting becomes an RCE path]]>https://ole-hartwig.eu/en/advisories/frankenphp-cve-2026-45062-unicode-cgi-rce-may-2026https://ole-hartwig.eu/page-1436splitPos() function in cgi.go used search.IgnoreCase Unicode equivalence folding for non-ASCII path bytes. Two logic flaws allow files like shell﹒php or shell.ｐhp to be executed as PHP scripts. Wherever an attacker can place a file in the FrankenPHP web root (uploads, file storage), this becomes unauthenticated RCE. I rebuilt the TYPO3 and Sylius container images with FrankenPHP 1.12.3 and rolled them out via Renovate.]]>Fri, 15 May 2026 18:00:00 +0200<![CDATA[NGINX Rift CVE-2026-42945: How an 18-year-old assumption in the rewrite module rips through the reverse proxy — what 1.30.1 actually changes]]>https://ole-hartwig.eu/en/advisories/nginx-rift-cve-2026-42945-rewrite-module-may-2026https://ole-hartwig.eu/page-1415Fri, 15 May 2026 14:00:00 +0200<![CDATA[Composer token leak in CI logs (GHSA-f9f8-rm49-7jv2): patch to 2.9.8 / 2.2.28 / 1.10.28 now]]>https://ole-hartwig.eu/en/advisories/composer-token-leak-ghsa-f9f8-rm49-7jv2-may-2026https://ole-hartwig.eu/page-1165Wed, 13 May 2026 12:00:00 +0200<![CDATA[Apache HTTP/2 double-free (CVE-2026-23918) — why the mod_http2 layer in Apache 2.4.66 sat open for eight days]]>https://ole-hartwig.eu/en/advisories/apache-http2-cve-2026-23918-may-2026https://ole-hartwig.eu/page-1193Wed, 13 May 2026 12:00:00 +0200<![CDATA[When the image builder accepts the wrong letter: three flaws in apko (CVE-2026-42574 / -42575 / -42576) and what Wolfi build pipelines need today]]>https://ole-hartwig.eu/en/advisories/apko-cve-2026-42574-42575-42576-wolfi-image-build-supply-chain-may-2026https://ole-hartwig.eu/page-1067Mon, 11 May 2026 22:26:06 +0200<![CDATA[Broadly executable MCP servers: what the Anthropic SDK chain means for AI agents in the mid-market]]>https://ole-hartwig.eu/en/advisories/mcp-stdio-rce-anthropic-sdk-may-2026https://ole-hartwig.eu/page-874Thu, 07 May 2026 22:03:26 +0200<![CDATA[When a composer install becomes code execution: CVE-2026-40176 and CVE-2026-40261 in the Composer supply chain]]>https://ole-hartwig.eu/en/advisories/composer-cve-2026-supply-chainhttps://ole-hartwig.eu/page-863Thu, 07 May 2026 10:03:57 +0200<![CDATA[When the CMS writes backend passwords in plain text: TYPO3 14.2 and CVE-2026-6553]]>https://ole-hartwig.eu/en/advisories/typo3-cve-2026-6553-cleartext-passwordshttps://ole-hartwig.eu/page-862Thu, 07 May 2026 10:00:43 +0200