Vulnerability News & CVE Analysis

Technical root-cause analyses, proof-of-concept verification, and defensive mitigations for documented CVEs.

Documented Vulnerabilities & Breakdowns

2 Analyses

Vulnerabilities

2026-08-26•5 min read

Next.js Unauthenticated RCE: CVE-2026-75604 Windows Path Traversal and the AVIF libheif Heap Overflow

Vercel's accelerated August 25, 2026 Next.js security release patched two unrelated critical, unauthenticated remote code execution flaws: a Windows-only path traversal (CVE-2026-75604, CVSS 9.0) with no workaround and a public PoC, and an AVIF image-decoding heap overflow (GHSA-2xp9-vwfh-vxw4, CVSS 4.0 9.5) inherited from the libheif library via the sharp dependency.

Read Intel→

Vulnerabilities

2026-08-12•5 min read

Microsoft SharePoint BDC RCE (CVE-2026-63520): Authenticated .NET Gadget Chain with Unauthenticated Chain via CVE-2026-55040

A remote code execution flaw in the Microsoft SharePoint Business Data Connectivity subsystem allows an authenticated attacker to instantiate arbitrary .NET types from BDC model XML and trigger OS command execution. Chained with the CVE-2026-55040 authentication bypass, the result is unauthenticated RCE with the SharePoint site service account's privileges.

Read Intel→