ZeroPath Blog & Research
Explore our team's latest research and stay up to date with ZeroPath's capabilities.
CVE Analysis
•2026-11-05
•8 min read
Overview of CVE-2026-92857: Keycloak Dynamic Client Registration Flaw Lets IAT Holders Forge sub and aud in Signed Tokens
A brief summary of CVE-2026-92857, an input validation flaw in Keycloak Dynamic Client Registration that lets an Initial Access Token holder make Keycloak sign tokens carrying attacker-chosen sub and aud claims. Covers root cause, attack flow, upstream patch status in 26.8.2, and Red Hat downstream status.
Gaurav Sarraf
CVE Analysis
•2026-11-05
•8 min read
Overview of CVE-2026-107123: Unauthenticated CPU Exhaustion in Keycloak SAML dateTime and Duration Parsing
A brief summary of CVE-2026-107123, an unauthenticated denial of service in Keycloak's SAML XML processing where overly long dateTime and duration values trigger quadratic parsing cost. Includes the upstream patch details for Keycloak 26.8.2 and the current Red Hat product status.
Gaurav Sarraf
CVE Analysis
•2026-11-05
•6 min read
Brief Summary: Keycloak SAML SOAP Endpoint Memory Exhaustion Denial of Service (CVE-2026-82965)
A brief summary of CVE-2026-82965, an unauthenticated denial of service in Keycloak's SAML Artifact Resolution and ECP SOAP endpoints, where unbounded XML processing can exhaust memory and crash the server. Covers root cause, affected distributions, the documented upstream fix in 26.8.2, and related SAML availability issues.
Gaurav Sarraf
CVE Analysis
•2026-11-05
•7 min read
Brief Summary: Keycloak UMA Protection API Missing Authorization (CVE-2026-114232) Enables Cross-Owner Resource Access
A brief summary of CVE-2026-114232, a missing authorization flaw in Keycloak's UserManagedPermissionService. An authenticated realm user can create a UMA policy with an unvalidated resourceType that matches resources owned by other users.
Gaurav Sarraf
CVE Analysis
•2026-11-04
•8 min read
Brief Summary: GPUStack CVE-2026-102895 Loopback Authentication Bypass Granting Unauthenticated Admin Access
A brief summary of CVE-2026-102895, a critical authentication bypass in GPUStack before 2.2.0 that let remote unauthenticated requests gain administrator access through loopback trust. Includes patch information from the fixing commit.
Gaurav Sarraf
CVE Analysis
•2026-11-04
•9 min read
Quick Look: Linksys E5350 CVE-2026-121932 Pre-Auth OS Command Injection in the Setup Wizard
A short summary of CVE-2026-121932, an unauthenticated OS command injection in the Linksys E5350 setup wizard that runs as root during the factory setup window. Includes the public proof of concept and affected version details.
Gaurav Sarraf
CVE Analysis
•2026-11-04
•12 min read
Brief Summary: FreeRDP Proxy CVE-2026-121952, an Out-of-Bounds Write in Bitmap Cache v2 Capability Handling (with PoC, Patch, and Detection Analysis)
A brief summary of CVE-2026-121952, an out-of-bounds write in the FreeRDP proxy triggered when a connecting client declares fewer than five bitmap cache v2 cells. Includes the maintainer PoC, patch commit analysis, and crash-based and protocol-level detection notes.
Gaurav Sarraf
CVE Analysis
•2026-11-04
•11 min read
FreeRDP CVE-2026-121953: a client-side rdpgfx use-after-free, with PoC and patch analysis
A summary of CVE-2026-121953, a client-side use-after-free in FreeRDP's rdpgfx dynamic virtual channel, with the maintainer PoC, patch details, and detection guidance.
Gaurav Sarraf
CVE Analysis
•2026-11-04
•9 min read
Brief Summary: Traefik ForwardAuth CVE-2026-121966 NTLM and Negotiate Identity Leak Through a Shared Auth Server Connection Pool
A brief summary of CVE-2026-121966, a Traefik ForwardAuth flaw where a shared auth server connection pool lets connection-bound NTLM or Negotiate identity leak between unrelated clients. Covers root cause, attack flow, affected versions and the patch in 2.11.60 and 3.7.16, plus the later 2.11.61 and 3.7.17 follow-up.
Gaurav Sarraf
CVE Analysis
•2026-11-04
•9 min read
Brief Summary: Rails Active Storage CVE-2026-122006, ImageMagick Arbitrary File Write and Read on Attachment
A brief summary of CVE-2026-122006, a critical Rails Active Storage issue in which the ImageMagick analyzer runs on attachment without a security policy. This allows arbitrary file writes and, with the Disk service, file reads. Includes patch details from activestorage 8.0.5.2 and 8.1.4.1.
Gaurav Sarraf
CVE Analysis
•2026-11-04
•12 min read
Brief Summary: Kyverno CVE-2026-122303, Cross-Namespace Resource Overwrite via NamespacedMutatingPolicy
A brief summary of CVE-2026-122303, an authorization bypass in Kyverno where a NamespacedMutatingPolicy mutate-existing CEL target expression lets a tenant overwrite resources in other namespaces. Includes the advisory PoC, patch details, and detection guidance.
Gaurav Sarraf
CVE Analysis
•2026-11-04
•11 min read
Brief Summary: Kyverno CVE-2026-122310, a Policy apiCall urlPath Parser Differential Leading to Cluster Admin
A brief summary of CVE-2026-122310, a critical parser differential in Kyverno's Policy apiCall urlPath handling that lets a namespace tenant reach cluster-scoped endpoints as the controller ServiceAccount. Includes the maintainer-published PoC, patch details, and detection guidance.
Gaurav Sarraf
CVE Analysis
•2026-11-04
•13 min read
Brief Summary: Kyverno CVE-2026-122311 Path Traversal in Namespaced CEL Policies with PoC and Patch Analysis
A summary of CVE-2026-122311, a path traversal flaw in Kyverno namespaced CEL policies that lets a single-namespace tenant escape to full cluster compromise. Includes the published PoC, patch details, and detection guidance.
Gaurav Sarraf
CVE Analysis
•2026-11-04
•11 min read
Brief Summary: Kyverno CVE-2026-122313, Cross-Namespace Privilege Escalation via NamespacedMutatingPolicy
A brief summary of CVE-2026-122313, a cross-namespace privilege escalation in Kyverno's NamespacedMutatingPolicy, covering the maintainer-published PoC and the v1.19.2 patch.
Gaurav Sarraf
CVE Analysis
•2026-11-04
•10 min read
Brief Summary: Oracle WebLogic Server CVE-2026-35263, a Core Improper Access Control Flaw Enabling Server Takeover
A brief summary of CVE-2026-35263, a CVSS 9.9 improper access control flaw in the Core component of Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 that lets a low-privileged HTTP user take over the server. Covers the June 2026 CSPU patch mapping, version-based detection, and behavioural hunting guidance.
Gaurav Sarraf
CVE Analysis
•2026-11-04
•9 min read
Brief Summary: Oracle Identity Manager CVE-2026-35265, a Missing Authentication Flaw Enabling Product Takeover
A brief summary of CVE-2026-35265, a CVSS 8.8 missing authentication flaw in the Security component of Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 that allows a low-privileged HTTP user to take over the product. Covers the June 2026 CSPU fix and practical detection approaches.
Gaurav Sarraf
CVE Analysis
•2026-11-04
•8 min read
Overview of CVE-2026-93389: LiteSpeed Cache Public REST Caching Exposes WooCommerce Shopper Data and Cart Tokens
A brief summary of CVE-2026-93389, an unauthenticated information disclosure in LiteSpeed Cache for WordPress through 7.9.1, where WooCommerce Store API cart and checkout responses were cached as public objects. The post covers the root cause, the 7.9.2 patch, and affected configurations.
Gaurav Sarraf
CVE Analysis
•2026-11-04
•11 min read
Overview of CVE-2026-122302: Kyverno Generate Rule Privilege Escalation via Controller Permission Check
A brief summary of CVE-2026-122302, a Kyverno flaw that let namespace administrators use namespaced Policy generate rules to create or clone resources beyond their RBAC. Covers the root cause, the fixes in v1.19.2, and configuration-based detection guidance.
Gaurav Sarraf
CVE Analysis
•2026-11-04
•9 min read
Overview of CVE-2026-35259: Open Redirect in the Oracle WebLogic Server Console Rated CVSS 8.8
A brief summary of CVE-2026-35259, an open redirect (CWE-601) in the Oracle WebLogic Server Console that Oracle rates CVSS 8.8 and says can lead to server takeover. Covers affected versions, the June 2026 Patch Set Updates, and practical detection approaches.
Gaurav Sarraf
CVE Analysis
•2026-11-03
•9 min read
Overview of CVE-2022-29966: Missing Authentication in Emerson Ovation Controller Protocols
CVE-2022-29966 is a missing authentication weakness in several Emerson Ovation protocols, affecting Ovation 3.8.0 Feature Pack 1 and earlier. This summary covers the root cause, the Feature Pack 3 vendor fix, and the available detection options.
Gaurav Sarraf
