Blog
Insights, updates, and deep dives on AI agents, decentralized standards, and the future of HOL.
BREAKING: WatchGuard Fireware iked type-confusion on IKE_AUTH
How to fix CVE-2026-19315: upgrade Fireware OS to 2026.2.2, 12.12.2, or 12.5.20
CVE-2026-81934: Redis TLS pending-list use-after-free (public RCE PoC)
How to fix CVE-2026-81934: upgrade Redis to 8.2.9, 8.4.6, 8.6.6, 8.8.2, or 8.10.1
HOL Guard
CVE-2026-19042: TeamViewer Linux Chat Link Command Injection (and Sibling CVE-2026-16444)
How to fix CVE-2026-19042: upgrade TeamViewer Full Client and Host for Linux to 15.81
HOL Guard
CVE-2026-45018: Chainlit MCP stdio unauthenticated RCE (and sibling CVE-2026-45019)
How to fix CVE-2026-45018: upgrade chainlit to 2.12.0, then restart so /mcp loads the new wheel
HOL Guard
BREAKING: Next.js unauthenticated RCE in image optimization and Windows servers (CVE-2026-75604)
How to fix CVE-2026-75604: upgrade next to 15.5.24 or 16.3.3
HOL Guard
CVE-2026-80104: DB-GPT Skill Upload Path Traversal (and Sibling CVE-2026-73034)
How to fix CVE-2026-80104: upgrade dbgpt-app to 0.8.1, then confirm the python upload user_id fix is in your build
HOL Guard
CVE-2026-63072: OpenSSL CMS decrypt writes eight bytes past the unwrap buffer
How to fix CVE-2026-63072: upgrade OpenSSL to 3.0.22, 3.4.7, 3.5.8, 3.6.4, or 4.0.2. CMS_decrypt writes eight bytes past the unwrap buffer. Same 25 August advisory as eight sibling CVEs. Not RCE. FIPS module not in scope.
HOL Guard
CVE-2026-53561: Apache Hive HiveServer2 SAML Bearer Impersonation
How to fix CVE-2026-53561: upgrade Apache Hive to 4.2.1. Unauthenticated SAML Bearer impersonation in HiveServer2 HTTP. Same 4.2.1 train as Metastore SQLi and Avro SerDe SSRF. Not RCE. Not the Kerberos default.
HOL Guard
CVE-2026-5006: Vault Privilege Escalation via Slash Injection in Templated Policy Paths
How to fix CVE-2026-5006: upgrade HashiCorp Vault Community Edition to 2.0.4 (Enterprise 2.0.4, 1.21.9, 1.20.14, or 1.19.20), then set deny_slash_in_templated_paths = true. Templated policy paths interpolate identity values. A slash in a controlled identity value becomes extra path segments and can grant capabilities the author did not intend. The deny-slash option defaults to false even after upgrade.
HOL Guard
CVE-2026-75899: fast-uri SSRF via Repeated Hostname Decoding
How to fix CVE-2026-75899: upgrade fast-uri to 2.4.5, 3.1.6, or 4.1.3. Nested percent-encoding in a hostname becomes localhost after normalize() or resolve(). Not RCE. Same patch train as three sibling High SSRF and host-confusion GHSAs.
HOL Guard
CVE-2026-18420: OpenSearch Dashboards TSVB Prototype Pollution RCE
How to fix CVE-2026-18420: upgrade OpenSearch Dashboards to 3.8.0. Authenticated TSVB metrics JSON prototype pollution RCE. Affects OSS and AWS Managed >=3.0.0 <3.8.0.
HOL Guard
CVE-2026-19516: Grafana MCP Server SSRF Via Caller-Controlled URL Header
CVE-2026-19516 is a server-side request forgery in the Grafana MCP Server. A caller can set the X-Grafana-URL header to any destination and use the grafana_api_request tool to reach internal services and cloud metadata endpoints. No fix available.
Michael Kantor
CVE-2026-77068: n8n Member RCE via MCP Node-Schema Path Traversal
How to fix CVE-2026-77068: upgrade n8n to 2.35.5 (floor 2.33.4 / 2.34.1). Member-level MCP schema path traversal RCE in the MAIN process. Not unauthenticated.
HOL Guard