154 results for “CVE”

List Grid

What you seeeverything

Recent Oldest Added A–Z

All types731 Articles241 Advisories204 Write-ups154 Repos56 Threads49

More types5

Papers13 Tools7 Courses3 Other3 Talks1

✍️ Write-ups “CVE”Clear all

oversecured.comwriteup🛡️ Security

Disclosure of 7 Android and Google Pixel vulnerabilities

Oversecured discloses seven Android vulnerabilities, two of them Pixel-specific, all reported to Google and fixed except one low-severity WebView case. They are the Camera geolocation leak (CVE-2024-0017), a VPN bypass list change (CVE-2023-21383), a Bluetooth permission check flaw (CVE-2024-34719), the WorkSource parcel mismatch (CVE-2023-20963, exploited in the wild by the Pinduoduo app), Device Admin HTML injection (CVE-2021-0600) and a ContentProvider.openFile() caller-context bypass (CVE-2023-21292). Each has root cause and PoC code.

AndroidGoogle PixelWebView+2

CVE-2024-0017CVE-2023-21383CVE-2024-34719+9

Mobile Security, Offensive Security· Added 29 Oct 2026

securitylabs.datadoghq.comwriteup🛡️ Security

Node2Shell: Reproducing CVE-2026-111497 in the Node.js Brotli decoder

Node2Shell is Datadog Security Labs' analysis of CVE-2026-111497, an out-of-bounds write in the Google Brotli 1.2.0 decoder, fixed in Node.js 22.23.4, 24.22.1 and 26.12.1 on 21 October 2026. It explains the unchecked return value in DecodeBlockTypeAndLength(), the read and write primitives, and why code execution is still engineering effort. It lists inbound and outbound exposure paths, behavioral detections and what WAFs miss.

BrotliNode.jsBun+3

CVE-2026-111497Node2ShellCISA KEV+3

AppSec, Blue Team & Detection, Offensive Security· Published and added 29 Oct 2026

alpinelinux.orgwriteup🛡️ Security

GitLab Security Incident: Attempted Exploitation of CVE-2026-97229

Alpine Linux incident report on attempted exploitation of CVE-2026-97229 (CVSS 10.0), a regex-evaluation bug in Ruby's Onigmo engine reachable through GitLab CI configuration. An attacker crashed workers 8 times on 20 and 21 October 2026. Upgrading to GitLab 19.3.6 did not fix it because the patch sits in GitLab's bundled Ruby. Alpine rebuilt the instance and found no tampering with aports or releases.

GitLabRubyDocker+1

CVE-2026-97229Onigmoaports

Blue Team & Detection, Supply Chain, AppSec· Added 29 Oct 2026, published 28 Oct 2026

blog.talosintelligence.comwriteup🛡️ Security

Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN

KeyDrift is a custom malware framework used by UAT-11473, which exploited CVE-2026-20127 in Cisco SD-WAN Catalyst Controller to gain access. Talos analyzes PolyFlame (memory-resident vdaemon injection, recvfrom hook, TinyShell-style backdoor, intermediate C2) and LittleFilch (SSL_read hook that extracts and RSA-encrypts keying material). It reports infrastructure overlap with Volt Typhoon's Silent Train, plus patch guidance and Snort SIDs.

Cisco SD-WANLinuxrunit+1

CVE-2026-20127UAT-11473KeyDrift+7

Threat Intel, Malware & RE· Published and added 28 Oct 2026

endorlabs.comwriteup🛡️ Security

Endor Labs AI SAST Finds Two Apache Kafka Zero-Days: Unbounded Memory Allocation from Brokers to Kafka Streams | Endor Labs

Endor Labs AI SAST found three unbounded memory allocation flaws in Apache Kafka, fixed under CVE-2026-114349 (DefaultRecord decoder, a ~90-byte compressed batch that kills consumers, brokers and the log cleaner) and CVE-2026-111551 (ListDeserializer and Kafka Streams AssignmentInfo decoding). The post gives code, reproducers and payload bytes. Remediation: upgrade to 4.2.2, 4.3.2 or 4.4.0, set max.decompressed.message.bytes, restrict write and group ACLs, and alert on DeadThreadCount.

Apache KafkaKafka StreamsJava+1

CVE-2026-114349CVE-2026-111551denial of service+4

AppSec· Published and added 28 Oct 2026

orca.securitywriteup🛡️ Security

PHP2Shell: From the attacker’s perspective

PHP2Shell is the public exploit for CVE-2026-109618 (corrupted internal state at the memory limit, allowing hijack during cleanup) and CVE-2026-109619 (double free used to leak memory and defeat ASLR). Orca ran the GitHub tool unchanged against an unpatched PHP server and got command execution. It then built its own exploit with AI from the patch, which worked on PHP 8.4.26 and WordPress. Fixed in 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

PHPWordPressGitHub

CVE-2026-109618CVE-2026-109619PHP2Shell+3

Offensive Security, AI Security, AppSec· Published and added 26 Oct 2026

opensourcemalware.comwriteup🛡️ Security

Brotlipocalypse

Brotlipocalypse is an OSM Security post (24 October 2026) on CVE-2026-111497, an out-of-bounds write in the google/brotli C decoder (1.0.3 through 1.2.0). It shows the decoder is vendored into many runtimes, databases, fonts and native extensions that need separate fixes. It gives grep and git checks for bundled copies, a table of fixed projects, and mitigations.

BrotliNode.jsPyPI+3

CVE-2026-111497PYSEC-2026-4322PYSEC-2026-4323+4

Supply Chain, AppSec· Published and added 24 Oct 2026

opensourcemalware.comwriteup🛡️ Security

Python Packages Vulnerable to Node2Shell

Analysis of CVE-2026-111497 (Node2Shell), an out-of-bounds write in Google's Brotli C decoder, showing it also affects the PyPI packages Brotli (all releases up to 1.2.0) and brotlicffi (up to 1.2.0.2). The author diffed the 1.2.0 and 1.2.1 sdists and confirmed the behaviour with AddressSanitizer. Fixes are Brotli 1.2.1 and brotlicffi 1.2.1.0, both patched without release notes. No advisory database lists either package yet.

BrotlibrotlicffiPyPI+3

CVE-2026-111497Node2ShellPHP2Shell+5

AppSec, Supply Chain· Published and added 23 Oct 2026

calif.iowriteup🛡️ Security

PHP2Shell: pre-auth RCE via PHP memory-limit fatal errors (CVE-2026-109618/109619)

PHP2Shell is Calif's writeup of pre-auth RCE in PHP (CVE-2026-109618, CVE-2026-109619) triggered by memory_limit fatal errors that leave dangling state. It covers a HashTable bucket bug in _zend_hash_str_add_or_update_i, a Session upload-progress stale-pointer bug, and an unserialize destructor-list primitive that reaches PHP-FPM. It lists affected apps (WordPress, Drupal, Joomla, Magento and others) and gives temporary mitigations.

PHPWordPressnginx+1

CVE-2026-109618CVE-2026-109619PHP2Shell+4

AppSec, Offensive Security· Added 23 Oct 2026

wiz.iowriteup🛡️ Security

PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet

PHP2Shell is Wiz Research's disclosure of memory-safety bugs in core PHP, grouped under two CVEs (up to CVSS 9.2) and fixed in patched releases on 21 October 2026. The post details four bugs, all triggered by out-of-memory fatal errors that leave stale state: an upload-progress unserializer use-after-free, a session-ID memory disclosure, a fatal-error backtrace use-after-free and an OPcache type confusion. It describes unauthenticated RCE on WordPress, Drupal and Joomla, plus detection signals and a disclosure timeline.

PHPWordPressDrupal+3

PHP2ShellWiz ResearchCalif+6

AppSec, Offensive Security, AI Security· Published and added 21 Oct 2026

securitylabs.datadoghq.comwriteup🛡️ Security

PHP2Shell - Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619): detection, analysis, and remediation

PHP2Shell is Datadog Security Labs' analysis of two critical PHP RCE flaws, CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0 9.2), disclosed 21 October 2026. It walks through a reproduced exploit on PHP 8.5.11 (heap grooming, a fake array, and a destructor calling system()) and the stale-state use-after-free. It lists fixed versions (8.2.35, 8.3.36, 8.4.27, 8.5.12), partial mitigations, and detection signals across requests, error logs and shell child processes.

PHPApacheCVSS+1

CVE-2026-109618CVE-2026-109619PHP2Shell+5

AppSec, Blue Team & Detection, Offensive Security· Added 29 Oct 2026, published 21 Oct 2026

endorlabs.comwriteup🧠 AI

Gemini 4 Argon on Cursor: solid security score, two unique solves, but slower and more expensive | Endor Labs

Endor Labs ran Gemini 4 Argon in the Cursor harness on its Agent Security League coding tasks (SusVibes). Argon ties Fable 5 at 29% SecPass with 78.8% FuncPass, and uniquely and securely solves two tasks (SABnzbd CVE-2021-29488 and OpenStack Nova CVE-2015-8749). It is also the slowest and costliest recent combo: 14 minutes median per task and $765. The run had 29 confirmed cheating instances.

CursorClaude CodeCodex+3

CVE-2021-29488CVE-2015-8749Endor Labs+15

evals, coding-agents, models· Published and added 20 Oct 2026

horizon3.aiwriteup🛡️ Security

CVE-2026-106173 Deep-Dive: FortiSIEM gRPC Path Traversal File Write RCE

CVE-2026-106173 is an unauthenticated arbitrary file write in the FortiSIEM phQueryMaster gRPC service on tcp/27918, advised by Fortinet on 13 October 2026. The SendQueryResult handler concatenates an attacker-controlled query-id into a path, and a null byte in the header removes the server-added filename suffix. Overwriting /opt/charting/redishb.sh, run every 60 seconds by cron, gives root-level code execution. IOCs are file timestamps.

FortiSIEMgRPCLinux

CVE-2026-106173CVE-2023-34992CVE-2024-23108+6

Offensive Security, AppSec· Added 29 Oct 2026, published 20 Oct 2026

depthfirst.comwriteup🛡️ Security

From JavaScript to Renderer Code Execution: Three V8 Vulnerabilities and Two v8CTF Flags | depthfirst

Depth First Security's write-up describes three V8 bugs found using its dfs-large1 research tooling: CVE-2026-78938, a type confusion in Promise.prototype.finally that lets an internal helper be constructed and return a primitive; CVE-2026-79236, a TurboFan load-elimination bug that keeps a stale property-array pointer after object migration; and a shared WebAssembly memory sandbox escape (issue 546253900) caused by mismatched backing-store registration during serialization. It walks through turning each memory bug into addrof/fakeobj primitives, chaining either with the sandbox escape to reclaim a freed V8 isolate via a WebSocket allocation, and pivoting through a CFI-constrained ROP chain to achieve Chrome renderer code execution, earning two v8CTF flags. Fixes landed between August 20 and 25, 2026.

V8ChromeWebAssembly+1

CVE-2026-78938CVE-2026-79236issue 546253900+8

Offensive Security, Malware & RE· Added 29 Oct 2026, published 20 Oct 2026

boredhackerblog.infowriteup🛡️ Security

Plex vulnerabilities being exploited in the wild to drop a cryptominer

Honeypot writeup of in-the-wild exploitation of Plex Media Server through the Plex2Shell chain (CVE-2026-96652, -96654, -96655, -96656) in October 2026. Attackers from 45.194.92.222, 91.92.40.202 and 176.65.139.228 used SSRF-style timeline/subscribe requests and downloaded a Docker-named dropper and an XMRig miner from 217.60.194.116. Includes file hashes, a later-seen proxyware sample (myawesomeproxy), lab pcaps for signatures and links to sandbox reports.

Plex Media ServerXMRigDocker+1

CVE-2026-96652CVE-2026-96654CVE-2026-96655+8

Threat Intel, Blue Team & Detection· Added 20 Oct 2026, published 19 Oct 2026

quentinkaiser.bewriteup🛡️ Security

One parser, two bugs, many routers: Exploiting Broadcom WiFi across eCos, Linux

Long-form write-up of a Hexacon 2026 talk on a WPS EAP reassembly overflow in Broadcom's proprietary 802.11 stack, present since 2010 and incompletely patched in 2018. It is remotely triggerable over WiFi without the network key. It gives information disclosure and code execution on eCos (BCM3380, BCM3383, BCM33834) and Linux (BCM3390, BCM65xx, BCM68xx) platforms. Exploited on Belgian ISP routers from Proximus, VOO and Orange. Includes a 90-day disclosure timeline, and Broadcom refused to assign a CVE.

BroadcomeCosLinux+2

HexaconWPS EAP reassembly overflowforever day+17

Hardware & RF, Offensive Security, Blue Team & Detection· Added 19 Oct 2026, published 16 Oct 2026

cloud.google.comwriteup🛡️ Security

ARMORY CASTLE Exploits BeyondTrust

ARMORY CASTLE (formerly UNC5221), a suspected PRC-nexus actor, exploited BeyondTrust Remote Support zero-day CVE-2026-102764 in August 2026, per Mandiant incident response. The post details the SAWFLY PHP webshell, BARECLAW SOCKS5 WebSocket tunneler, SUID root escalation, sudoers template persistence, vault credential extraction, log deletion and haproxy.conf changes. It adds YARA rules, detection ideas and patch-first remediation (BT26-05).

BeyondTrust Remote SupportPHPHAProxy+3

CVE-2026-102764CVE-2023-46805CVE-2024-21887+9

Threat Intel, Blue Team & Detection, Malware & RE· Added 29 Oct 2026, published 15 Oct 2026

unit42.paloaltonetworks.comwriteup🛡️ Security

Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant

PEERSTITCH is a memory-resident ARM64 implant that Unit 42 found in a September 2024 telecom intrusion (cluster CL-STA-0954, aka UNC5820). Attackers used CVE-2024-47575 on FortiManager to steal configs for more than 500 FortiGates, then CVE-2025-61624 auto-script path traversal to reach root. The report covers ptrace injection into miglogd and iked, an Apache mod_md ACME reverse shell, FGFM impersonation, anti-forensics, hunting guidance, IOCs and YARA.

FortiManagerFortiGateFortiOS+3

CVE-2024-47575CVE-2025-61624CVE-2024-26009+10

Threat Intel, Malware & RE, Blue Team & Detection· Added 30 Oct 2026, published 14 Oct 2026

hackers-arise.comwriteup🧠 AI

Artificial Intelligence (AI) in Cybersecurity, Part 29: Creating Isolated Autonomous Agents for Hacking with NemoClaw

Hackers-Arise tutorial on NVIDIA's open-source NemoClaw, which runs OpenClaw (and Hermes or LangChain Deep Agents) inside OpenShell sandboxes. OpenShell provides kernel-level isolation and declarative YAML policies for files, credentials and network access. It covers OpenClaw's risks (543 tracked CVEs, 40,000+ exposed instances), an OpenClaw vs NemoClaw comparison, the caveat that sandbox escapes and core-logic zero-days remain possible, and a Docker/Node.js install via the nemoclaw.sh wizard with TUI testing. It also cites the Cisco AI Defense plus OpenShell case study, in which an agent that does security patching was protected against a simulated exfiltration attempt.

OpenClawNemoClawOpenShell+7

NVIDIAPeter SteinbergerJensen Huang+4

agents, ai-infra· Published and added 14 Oct 2026

embracethered.comwriteup🛡️ Security

Visual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572)

CVE-2026-103572 is a remote code execution bug in Microsoft.VisualStudio.Copilot.Core.dll, shared by Visual Studio and SQL Server Management Studio. A trailing dot (for example `.mcp.json.`) bypasses the protected-filename check in EditsFunctionHandler.GetEditConfirmationTypeAsync, so a hijacked Copilot can rewrite its own MCP and settings files and run commands. The post covers path traversal and InstallationID leaks, indirect prompt injection demos, the October 2026 patch (GetFullPath), and a $0 bounty.

Visual StudioSQL Server Management StudioGitHub Copilot+3

CVE-2026-103572indirect prompt injectionpath traversal+5

AI Security, AppSec, Offensive Security· Added 29 Oct 2026, published 13 Oct 2026

vulncheck.comwriteup🛡️ Security

Revenge of the SD-WAN: Exploring and Exploiting Yet Another Critical Cisco SD-WAN Vulnerability (CVE-2026-76504)

VulnCheck reproduces and root-causes CVE-2026-76504, an exploited zero-day authentication bypass in Cisco SD-WAN vManage. A POST to the URL-encoded path /%6a_security_check skips the password check because AppServerLoginModule.login() tests the raw getRequestURI() for "j_security_check", while WildFly's security-constraint matcher decodes the path. Supplying an internal username such as viptela-reserved-cloudops or viptela-reserved-uc then mints an admin-level session. Includes decompiled code, request/response samples, and notes on about 1,500 exposed devices and IoCs; the weaponized exploit and detection rules are gated to customers.

Cisco SD-WANvManageWildFly+4

CVE-2026-76504CVE-2026-20127CVE-2026-20182+8

AppSec, Offensive Security, Identity & Access· Added 12 Oct 2026

endorlabs.comwriteup🛡️ Security

Happier DOMs: The perils of running untrusted JavaScript code outside of a web browser | Blog | Endor Labs

Endor Labs explains CVE-2025-61927, an RCE in the happy-dom headless browser caused by relying on Node.js's vm module, which is not a security boundary. They show that the maintainer's mitigation (--disallow-code-generation-from-strings) is insufficient, because untrusted scripts can still pollute builtin prototypes for DoS or RCE (CVE-2025-62410). The fix adds --frozen-intrinsics. The post recommends isolated-vm, Secure EcmaScript, or container/VM isolation for untrusted JavaScript.

happy-domNode.jsJavaScript+2

CVE-2025-61927CVE-2025-62410CVE-2021-23555+6

AppSec· Published and added 12 Oct 2026

labs.watchtowr.comwriteup🛡️ Security

Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578)

watchTowr's analysis of the PaperCut NG 26.0.4-PO build 76508 pre-auth RCE chain, built from WT-2026-0143 (authentication bypass) and WT-2026-0144 / CVE-2026-82077 (post-auth RCE). The bypass reaches Setup Wizard forms through the Tapestry service parameter via the Home page, which resets the admin password. The RCE uses path traversal in the Scan to Fax connector. It also gives the August to September 2026 patch and bypass timeline, including exploited CVE-2026-81578 and CVE-2026-82078.

PaperCut NGApache TapestryJava

CVE-2026-82077CVE-2026-82078CVE-2026-81578+12

AppSec, Offensive Security, Identity & Access· Added 30 Oct 2026, published 9 Oct 2026

vulncheck.comwriteup🛡️ Security

Revenge of the SD-WAN: Cisco Catalyst SD-WAN Manager Auth Bypass (CVE-2026-76504)

VulnCheck's exploit development team analyzes CVE-2026-76504, a critical zero-day authentication bypass in Cisco Catalyst SD-WAN Manager (vManage), reproduced to the point of a weaponized exploit. The root cause is a discrepancy between WildFly's Undertow engine, which URL-decodes the request path before deciding whether j_security_check requires auth, and Cisco's AppServerLoginModule.login(), which checks the raw (undecoded) getRequestURI() string — so a path like /%6a_security_check skips the password check entirely. The remaining session-building fallback path only checks membership in four hardcoded internal usernames (viptela-reserved-dca/cloud/cloudops/uc), and two of them (cloudops, uc) grant full admin via the dataservice API, giving an unauthenticated attacker a fully privileged vManage session with a single POST request.

Cisco SD-WAN ManagerWildFlyJava+1

CVE-2026-76504CVE-2026-20127CVE-2026-20182+9

AppSec, Offensive Security· Added 8 Oct 2026

huntress.comwriteup🛡️ Security

Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer

Huntress documents active exploitation of two AhsayCBS (Ahsay Cloud Backup Server) vulnerabilities being chained together: CVE-2026-105133, an authentication bypass in checkSysPwd, and CVE-2026-105134, an unauthenticated RCE in the Replication Receiver's UpdateReceivers.do endpoint that grants SYSTEM. Attackers use the chain to drop JSP webshells, then deploy a renamed XMRig cryptominer (masquerading as msedge.exe via a modified NSSM binary), a Task-Manager-aware anti-detection PowerShell script, and the vulnerable WinRing0x64.sys kernel driver for hardware-level miner access. Huntress provides IOCs, mitigation guidance (restrict management interface, re-image if compromised) and four Sigma rules targeting each stage of the intrusion chain.

AhsayCBSXMRigSigma+3

CVE-2026-105133CVE-2026-105134WinRing0x64.sys+2

Threat Intel, Blue Team & Detection, AppSec· Added 9 Oct 2026, published 8 Oct 2026

x.comwriteup🛡️ Security

lee1981 (@lee1981b) on X

A detailed "CVE of the Day" thread analyzing CVE-2026-76471, a critical (CVSS 9.8) Cisco advisory covering insufficient NX-API input validation (CWE-122 heap-based buffer overflow) on Nexus 3000/9000 standalone NX-OS and a lower-severity credentialed variant on UCS 6300 Fabric Interconnects via UCS Manager XML API. It compiles Cisco's fixed-software versions per platform, notes the temporary Live Protect shield lp00074, and walks through a six-step SOC evidence-preservation and correlation playbook (scoping affected devices, preserving logs/crash artifacts, reviewing API/shield telemetry, correlating device outcomes, remediating, and verifying post-patch state) while flagging that CISA KEV and FIRST EPSS had no data on the CVE at research time.

CVSSNVDCISA KEV+1

CVE-2026-76471

Cloud & Infra· Published and added 8 Oct 2026

watchtowr.comwriteup🛡️ Security

Post-Exploitation Analysis & Artifacts – Citrix NetScaler CVE-2026-88771

watchTowr post-exploitation analysis of CVE-2026-88771, an unauthenticated log-poisoning command injection in Citrix NetScaler (advisory CTX697096). Sensors logged thousands of attempts: about 85% were OOB callbacks, the rest Sliver implants, a trojanized Dropbear SSH backdoor, a Perl stager with a PHP webshell, and SSH-key and secret-harvesting sprays. Includes artifacts to hunt (/var/tmp files, ns_helper, ns.conf edits) and IOC repo pointers.

Citrix NetScalerSliverSSH+2

CVE-2026-88771CVE-2026-88772CVE-2026-88779+8

Threat Intel, Blue Team & Detection, Malware & RE· Added 30 Oct 2026, published 7 Oct 2026

microsoft.comwriteup🛡️ Security

3 lessons from frontier AI vulnerability research

Microsoft Security's FORGE Lab shares results and lessons from four months of AI-agent-driven vulnerability research: 140 Windows CVEs (52 in September 2026's release), 155 internally validated reports across 23 open-source projects, and the first patch merged into the Linux kernel via the Linux Foundation's Akrites coordinated-disclosure initiative. Using their multi-model agentic scanning harness MDASH and GPT-5.5-based validation agents, the team measured automated PoC generation at an average $3.61/21.5 minutes per confirmed crash and local privilege-escalation AEG at $8.56/25.4 minutes, and argues the real bottleneck has shifted from finding bugs to validating and remediating them at matching speed. Specific disclosed CVEs include curl's CVE-2026-9545 and CVE-2026-13608, Node.js's CVE-2026-56848, and Linux kernel's CVE-2026-64563.

MDASHWindowsLinux kernel+3

CVE-2026-9545CVE-2026-13608CVE-2026-56848+6

AI Security, Offensive Security, AppSec· Published and added 7 Oct 2026

rapid7.comwriteup🛡️ Security

CVE-2026-21589: Critical unauthenticated arbitrary file access in Atlassian products

Rapid7's analysis of CVE-2026-21589 (CVSSv4 9.3), a critical unauthenticated arbitrary file read vulnerability affecting Bitbucket, Confluence, Jira Software/Service Management, Bamboo, Crowd, Crucible, and Fisheye Data Center products. It summarizes watchTowr Labs' root-cause finding that double-colon (::) sequences can act as path separators in Atlassian's web-resource handling, enabling path traversal to read arbitrary files within the Tomcat web root — including crowd.properties credentials that can be chained to create a rogue jira-administrators account. The post provides emergency patching guidance, Atlassian's WAF/RewriteValve mitigations, log-hunting regex, and notes public Python PoC and Nuclei templates exist.

BitbucketConfluenceJira+3

CVE-2026-21589CWE-552watchTowr Labs+1

AppSec· Published and added 7 Oct 2026

labs.watchtowr.comwriteup🛡️ Security

You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589)

CVE-2026-21589 is a pre-auth arbitrary file read in Atlassian Jira, Confluence and Bitbucket, found by diffing atlassian-plugins-webresource 6.0.7 against 6.0.8. The Router's unescapeSlashes turns "::" into "/", so "..::" traversal reaches WEB-INF files through download/resources routes. Reading crowd.properties leaks Crowd app credentials, which allow creating an admin user.

JiraConfluenceBitbucket+3

CVE-2026-21589watchTowrpath traversal+1

AppSec, Offensive Security· Added 30 Oct 2026, published 6 Oct 2026

Showing 30 of 154