ZeroPath Blog & Research
Explore our team's latest research and stay up to date with ZeroPath's capabilities.
CVE Analysis
•2026-06-11
•12 min read
Axios CVE-2026-44486: Proxy Credential Leakage via Redirect Handling in Node.js — Technical Breakdown with PoC and Patch Analysis
A brief summary of CVE-2026-44486, a high severity information disclosure flaw in the Axios Node.js HTTP adapter that leaks proxy credentials to redirect targets. Includes proof of concept details, patch analysis for both v1.x and v0.x lines, and practical detection strategies.
ZeroPath CVE Analysis
CVE Analysis
•2026-06-11
•12 min read
Axios Fetch Adapter Size Limit Bypass (CVE-2026-44488): Technical Breakdown with PoC and Patch Analysis
A brief summary of CVE-2026-44488, a high severity resource exhaustion flaw in the Axios fetch adapter that silently ignores configured size limits. Includes proof of concept, patch details, and detection strategies.
ZeroPath CVE Analysis
CVE Analysis
•2026-06-11
•12 min read
Axios CVE-2026-44492: IPv4-Mapped IPv6 NO_PROXY Bypass Enables SSRF with PoC and Patch Analysis
A brief summary of CVE-2026-44492, a high severity SSRF vulnerability in Axios that allows attackers to bypass NO_PROXY exclusions using IPv4-mapped IPv6 addresses. Includes proof of concept details, patch analysis, and detection methods.
ZeroPath CVE Analysis
CVE Analysis
•2026-06-11
•12 min read
Brief Summary: Axios CVE-2026-44494 Prototype Pollution Gadget Enables Full MITM with PoC and Detection Guidance
A brief summary of CVE-2026-44494, a high severity prototype pollution gadget in Axios that allows escalation to full Man-in-the-Middle attacks. Includes proof of concept details, detection methods, and mitigation guidance.
ZeroPath CVE Analysis
CVE Analysis
•2026-06-11
•10 min read
Brief Summary: CVE-2026-47365 — Argument Injection in cPanel WP Toolkit Breaks Tenant Isolation
A short review of CVE-2026-47365, a CVSS 9.9 argument injection flaw in cPanel's WP Toolkit before version 6.11.0 that allows authenticated users to bypass cross-tenant authorization and execute CLI commands as other accounts. Includes patch details and threat context.
ZeroPath CVE Analysis
CVE Analysis
•2026-06-11
•10 min read
Brief Summary: CVE-2026-47367 Command Injection in Ubiquiti UID Enterprise Agent (CVSS 9.9)
A short review of CVE-2026-47367, a critical command injection vulnerability in Ubiquiti's UID Enterprise Agent that allows low-privilege network attackers to execute arbitrary commands on host devices. Includes patch details and threat intelligence context.
ZeroPath CVE Analysis
CVE Analysis
•2026-06-11
•8 min read
Brief Summary: CVE-2026-47368 Path Traversal in Ubiquiti UniFi OS and Its Role in a Five CVE Bulletin
A short review of CVE-2026-47368, a high severity path traversal vulnerability in Ubiquiti UniFi OS that enables network adjacent attackers to read sensitive data from affected devices. Includes patch details across multiple device families and context on vulnerability chaining with four other CVEs in the same advisory.
ZeroPath CVE Analysis
CVE Analysis
•2026-06-11
•10 min read
Brief Summary: CVE-2026-47369 UniFi OS Privilege Escalation via Improper Input Validation (CVSS 9.9)
A short review of CVE-2026-47369, a critical CVSS 9.9 privilege escalation flaw in Ubiquiti UniFi OS that allows low privileged network attackers to escalate privileges on affected devices. Includes patch details, affected device matrix, and chaining context with sibling vulnerabilities from Security Advisory Bulletin 065.
ZeroPath CVE Analysis
CVE Analysis
•2026-06-11
•10 min read
Quick Look: CVE-2026-47370 Command Injection in Ubiquiti UniFi OS (CVSS 9.9)
A brief summary of CVE-2026-47370, a CVSS 9.9 command injection vulnerability in Ubiquiti UniFi OS that allows low privileged network attackers to hijack host devices. Includes patch information and affected version details across the full UniFi hardware console line.
ZeroPath CVE Analysis
CVE Analysis
•2026-06-11
•8 min read
Brief Summary: CVE-2026-48610 Improper Access Control in Ubiquiti UniFi OS Cloud Gateways
A short review of CVE-2026-48610, a CVSS 8.1 improper access control vulnerability in Ubiquiti UniFi OS Cloud Gateways and Dream Machines that allows network adjacent attackers to make unauthorized configuration changes. Includes patch details and affected version information.
ZeroPath CVE Analysis
CVE Analysis
•2026-06-11
•8 min read
phpBB CVE-2026-48611: Brief Summary of a Critical OAuth Authentication Bypass Enabling Account Hijacking
A brief summary of CVE-2026-48611, a critical OAuth authentication bypass in phpBB that allows account hijacking on default installations even when OAuth is not configured, affecting all versions prior to 3.3.17.
ZeroPath CVE Analysis
CVE Analysis
•2026-06-11
•10 min read
Brief Summary: CVE-2026-49982 Type-Confusion Path Traversal in node-tmp
A short review of CVE-2026-49982, a high-severity type-confusion path traversal in the node-tmp npm package (version 0.2.6) that allows arbitrary file or directory creation outside the intended temporary directory. Includes detection methods and affected version details.
ZeroPath CVE Analysis
CVE Analysis
•2026-06-11
•10 min read
Brief Summary: CVE-2026-7870 — IBM i Privilege Escalation via Unqualified Library Call Affects All Supported Releases
A short review of CVE-2026-7870, a high severity privilege escalation in IBM i caused by unqualified library calls. Patch information and affected version details are included.
ZeroPath CVE Analysis
CVE Analysis
•2026-06-10
•12 min read
UpdraftPlus CVE-2026-10795: Brief Summary of the Authentication Bypass Threatening 3M+ WordPress Sites
A brief summary of CVE-2026-10795, a CVSS 8.1 authentication bypass in the UpdraftPlus WordPress plugin affecting 3 million+ sites. Covers the dual cryptographic flaw, patch details, detection methods, and confirmed active exploitation.
ZeroPath CVE Analysis
CVE Analysis
•2026-06-10
•10 min read
Quick Look: Splunk Secure Gateway CVE-2026-20251 RCE via jsonpickle Deserialization
A brief summary of CVE-2026-20251, a high severity remote code execution vulnerability in Splunk Secure Gateway caused by unsafe jsonpickle deserialization of KV Store data, exploitable by any low privileged authenticated user.
ZeroPath CVE Analysis
CVE Analysis
•2026-06-10
•10 min read
Splunk Enterprise CVE-2026-20252: Overview of SSRF via Dashboard Studio PDF Export with Dual Bypass Mechanisms
A brief summary of CVE-2026-20252, a high severity SSRF vulnerability in Splunk Enterprise and Splunk Cloud Platform that allows low privileged users to reach arbitrary internal destinations through the Dashboard Studio PDF export feature using prefix match and redirect bypass techniques.
ZeroPath CVE Analysis
CVE Analysis
•2026-06-10
•10 min read
Brief Summary: CVE-2026-20253 — Unauthenticated File Operations in Splunk Enterprise PostgreSQL Sidecar
A short review of CVE-2026-20253, a critical (CVSS 9.8) unauthenticated arbitrary file creation and truncation vulnerability in Splunk Enterprise's PostgreSQL sidecar service, affecting multiple versions of both Splunk Enterprise and Splunk Cloud Platform.
ZeroPath CVE Analysis
CVE Analysis
•2026-06-10
•8 min read
Brief Summary: CVE-2026-3018 Unauthenticated SQL Injection in WordPress Newsletters Plugin
A short review of CVE-2026-3018, an unauthenticated time-based SQL injection in the WordPress Newsletters plugin (versions 4.13 and earlier) that allows remote attackers to extract sensitive database contents without authentication.
ZeroPath CVE Analysis
CVE Analysis
•2026-06-10
•10 min read
Quick Look: CVE-2026-35273, Unauthenticated RCE in Oracle PeopleSoft PeopleTools Updates Environment Management
A brief summary of CVE-2026-35273, a CVSS 9.8 unauthenticated remote code execution vulnerability in Oracle PeopleSoft PeopleTools affecting versions 8.61 and 8.62, along with patch information and threat intelligence context.
ZeroPath CVE Analysis
CVE Analysis
•2026-06-10
•10 min read
js-cookie CVE-2026-46625: Per-Instance Prototype Hijack Enables Cookie Attribute Injection — Quick Look with PoC and Patch Analysis
A brief summary of CVE-2026-46625, a high severity prototype pollution flaw in the widely used js-cookie npm package that allows attackers to inject arbitrary cookie attributes. Includes proof of concept details and patch analysis.
ZeroPath CVE Analysis
