2026

  • a second-order ddns authz bug in nezha

    cve-2026-53521 let a stored future ddns profile id turn into another user ddns profile context later in nezha

    b b4r
    June 10, 2026
    3 min read
    vulnerability cve web exploitation authorization

  • another sharp authz bug, this time in quick creation

    cve-2026-53634 let authenticated sharp users bypass create authorization through quick creation command endpoints

    b b4r
    June 10, 2026
    2 min read
    vulnerability cve web exploitation laravel

  • an idor in openproject through meeting agenda items

    cve-2026-49355 exposed private work package data through the single meeting agenda item api in openproject

    b b4r
    June 8, 2026
    2 min read
    vulnerability cve web exploitation idor