ZeroPath Blog & Research
Explore our team's latest research and stay up to date with ZeroPath's capabilities.
CVE Analysis
•2026-04-23
•6 min read
ExactMetrics WordPress Plugin CVE-2026-5464: Overview of Chained Authorization Bypass Leading to Remote Code Execution
CVE-2026-5464 is a high-severity authorization bypass in the ExactMetrics WordPress plugin. It chains three weak endpoints so that an authenticated attacker can install arbitrary plugins and achieve remote code execution.
ZeroPath CVE Analysis
CVE Analysis
•2026-04-23
•7 min read
ByteDance verl CVE-2026-6878: Unsafe eval() in ML Training Pipeline Enables Remote Code Execution via Indirect Prompt Injection — Quick Look with Public PoC
A summary of CVE-2026-6878, an unsafe eval() vulnerability in ByteDance's verl reinforcement learning framework that allows remote code execution through indirect prompt injection of training data. A public PoC exploit is available.
ZeroPath CVE Analysis
CVE Analysis
•2026-04-22
•5 min read
ThinkPHP 5.0.23 CVE-2018-25270: Brief Summary of a Critical Unauthenticated RCE via invokeFunction Routing
A brief summary of CVE-2018-25270, a critical unauthenticated remote code execution vulnerability in ThinkPHP 5.0.23 that lets attackers invoke arbitrary PHP functions through the framework's routing parameter. The flaw has a CVSS score of 9.8. Attackers have exploited it in the wild since 2018, and campaigns continued into 2024.
ZeroPath CVE Analysis
CVE Analysis
•2026-04-22
•6 min read
Brief Summary: Dell PowerProtect Data Domain CVE-2026-26354 Stack Based Buffer Overflow Enabling Unauthenticated Remote Command Execution
A short review of CVE-2026-26354, a stack-based buffer overflow in Dell PowerProtect Data Domain OS that lets unauthenticated remote attackers execute arbitrary commands on affected backup appliances.
ZeroPath CVE Analysis
CVE Analysis
•2026-04-22
•8 min read
Brief Summary: CVE-2026-3844 — Unauthenticated Arbitrary File Upload in Breeze Cache for WordPress
A short review of CVE-2026-3844, a critical unauthenticated arbitrary file upload vulnerability in the Breeze Cache WordPress plugin (versions up to 2.4.4), with an analysis of the patch and the configurations it affects.
ZeroPath CVE Analysis
CVE Analysis
•2026-04-22
•6 min read
GitLab GraphQL CSRF Vulnerability CVE-2026-4922: Brief Summary of a High Severity Mutation Hijacking Flaw
A brief summary of CVE-2026-4922, a high-severity CSRF vulnerability in GitLab's GraphQL API that lets unauthenticated attackers execute mutations on behalf of logged-in users. Covers the patch and the affected versions.
ZeroPath CVE Analysis
CVE Analysis
•2026-04-22
•7 min read
Brief Summary: GitLab CE/EE CVE-2026-5262 XSS Token Exposure in Storybook Environment
A short review of CVE-2026-5262, a high-severity XSS vulnerability in GitLab CE/EE's Storybook integration that could allow unauthenticated attackers to steal tokens through improper input validation. Includes patch details and affected version ranges.
ZeroPath CVE Analysis
CVE Analysis
•2026-04-22
•5 min read
Brief Summary: GitLab Web IDE XSS via Path Equivalence (CVE-2026-5816)
A short review of CVE-2026-5816, a high-severity unauthenticated XSS vulnerability in GitLab CE/EE's Web IDE caused by improper path equivalence handling, with patch details and affected versions.
ZeroPath CVE Analysis
CVE Analysis
•2026-04-21
•7 min read
Spring Security CVE-2026-22753: Brief Summary of Servlet Path Matching Bypass in 7.0.x
A brief summary of CVE-2026-22753, a high-severity path-matching flaw in Spring Security 7.0.0 through 7.0.4 that silently disables authentication and authorization on protected endpoints. Covers the patch and an interim workaround.
ZeroPath CVE Analysis
CVE Analysis
•2026-04-21
•6 min read
Spring Security CVE-2026-22754: Brief Summary of an XML Authorization Bypass in the 7.0.x Line
A brief summary of CVE-2026-22754, a CVSS 7.5 authorization bypass in Spring Security 7.0.0 through 7.0.4. The cause is a discarded return value from an immutable builder in XML intercept-url processing. The post covers the patch and the affected versions.
ZeroPath CVE Analysis
CVE Analysis
•2026-04-21
•5 min read
Brief Summary: CVE-2026-34275 — Oracle E-Business Suite Advanced Inbound Telephony Unauthenticated Takeover via HTTP
A short review of CVE-2026-34275, a CVSS 9.8 vulnerability in Oracle E-Business Suite's Advanced Inbound Telephony that lets unauthenticated attackers fully compromise the system over HTTP.
ZeroPath CVE Analysis
CVE Analysis
•2026-04-21
•6 min read
Brief Summary: Oracle Enterprise Manager CVE-2026-34279 Critical Event Management Takeover Vulnerability
A brief summary of CVE-2026-34279, a critical (CVSS 9.1) vulnerability in Oracle Enterprise Manager Base Platform's Event Management component. It enables full platform takeover, and because its scope is changed, the impact reaches beyond the vulnerable component. Includes patch information from Oracle's April 2026 CPU.
ZeroPath CVE Analysis
CVE Analysis
•2026-04-21
•6 min read
Quick Look: CVE-2026-34286, Critical Unauthenticated Access Flaw in Oracle Identity Manager Connector
A brief summary of CVE-2026-34286, a CVSS 9.1 vulnerability in Oracle Identity Manager Connector that lets unauthenticated attackers read and modify critical identity data over HTTPS. Includes patch information from Oracle's April 2026 CPU.
ZeroPath CVE Analysis
CVE Analysis
•2026-04-21
•6 min read
Brief Summary: CVE-2026-34287 — Unauthenticated Data Access in Oracle Identity Manager Connector Core Component
A short review of CVE-2026-34287, a CVSS 9.1 vulnerability in Oracle Identity Manager Connector that lets unauthenticated attackers read and modify critical identity data over HTTPS. Covers patch information and affected versions.
ZeroPath CVE Analysis
CVE Analysis
•2026-04-21
•6 min read
Brief Summary: Oracle HTTP Server CVE-2026-34291 Core Component Vulnerability with Scope Change
A short review of CVE-2026-34291, a high-severity vulnerability in Oracle HTTP Server's Core component that lets unauthenticated attackers compromise confidentiality and integrity, with potential impact beyond the web tier. Includes patch information from Oracle's April 2026 Critical Patch Update.
ZeroPath CVE Analysis
CVE Analysis
•2026-04-21
•6 min read
Brief Summary: CVE-2026-34305 — Unauthenticated Data Exposure in Oracle WebLogic Server Web Services
CVE-2026-34305 is a high-severity information disclosure vulnerability in Oracle WebLogic Server's Web Services component that lets unauthenticated attackers access critical data over HTTP. This review covers the flaw and the patch guidance from Oracle's April 2026 Critical Patch Update.
ZeroPath CVE Analysis
CVE Analysis
•2026-04-21
•5 min read
Brief Summary: Oracle Database Server Java VM Unauthenticated Data Exposure (CVE-2026-35229)
A short review of CVE-2026-35229, a high-severity vulnerability in the Oracle Database Server Java VM component that lets unauthenticated attackers access critical data over Oracle Net without any privileges or user interaction.
ZeroPath CVE Analysis
CVE Analysis
•2026-04-20
•6 min read
Brief Summary: Dell PowerProtect Data Domain CVE-2026-26943 OS Command Injection Leading to Root Execution
A short review of CVE-2026-26943, a high-severity OS command injection vulnerability in Dell PowerProtect Data Domain that lets a privileged remote attacker execute arbitrary commands as root across multiple release trains.
ZeroPath CVE Analysis
CVE Analysis
•2026-04-20
•7 min read
Brief Summary: CVE-2026-26944 Missing Authentication in Dell PowerProtect Data Domain Enables Remote Root Command Execution
A short review of CVE-2026-26944, a missing-authentication vulnerability in Dell PowerProtect Data Domain that lets an unauthenticated remote attacker execute commands as root, with user interaction. Includes patch details and affected version ranges.
ZeroPath CVE Analysis
CVE Analysis
•2026-04-20
•6 min read
Brief Summary: Spinnaker CVE-2026-32604 Remote Code Execution via GitRepo Artifact Input Injection
A short review of CVE-2026-32604, a critical remote code execution vulnerability in Spinnaker's clouddriver component caused by improper input validation in the branch and path fields of gitrepo artifacts.
ZeroPath CVE Analysis
