Jan 2, 2026·6 min read·43 visits
Stroom trusted the 'signer' field in AWS ALB headers without verification. Attackers can bring their own ALB signatures to log in as anyone, or inject malicious regions into the signer ARN to trigger SSRF against the AWS Metadata Service (IMDS).
A critical authentication bypass and SSRF vulnerability in GCHQ's Stroom data platform allows attackers to spoof AWS Application Load Balancer identities or reach internal AWS metadata services.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L| Product | Affected Versions | Fixed Version |
|---|---|---|
Stroom GCHQ | >= 7.2-beta.53, < 7.2.24 | 7.2.24 |
Stroom GCHQ | 7.3-beta.1 - < 7.3-beta.22 | 7.3-beta.22 |
Stroom GCHQ | 7.4-beta.1 - < 7.4.4 | 7.4.4 |
Stroom GCHQ | 7.5-beta.1 | 7.5-beta.2 |
| Attribute | Detail |
|---|---|
| CWE | CWE-290 (Auth Bypass by Spoofing) |
| CVSS | 9.4 (Critical) |
| Attack Vector | Network |
| Exploit Status | PoC Available |
| Impact | Authentication Bypass / SSRF |
| KEV Status | Not Listed |
Authentication Bypass by Spoofing
CVE-2026-55596 is a critical DOM-based Cross-Site Scripting (XSS) vulnerability in the Plate rich-text editor framework (specifically within the @platejs/media package). The issue stems from an optimization fast-path that short-circuits safety parsing if a provider or source URL is already declared on an element. Consequently, serialized documents carrying malicious javascript: URLs bypass protocol sanitization and are loaded directly into iframe elements, leading to code execution.
The npm package 'pickem' is vulnerable to a terminal escape-sequence injection (CWE-150). Unsanitized terminal outputs allow attackers to execute arbitrary shell commands via clipboard hijacking (OSC 52) or manipulate terminal displays through Control Sequence Introducers (CSI).
CVE-2026-55537 is a server-side request forgery (SSRF) and time-of-check time-of-use (TOCTOU) vulnerability in the PraisonAI multi-agent framework before version 4.6.58. The flaw exists in the job-submission component's webhook URL validation logic. When DNS resolution fails during verification, the application fails open, enabling attackers to register unresolvable URLs. When a completed job triggers the webhook, the application performs a fresh DNS resolution that attackers can manipulate to target internal resources.
Prior to version 5.0.8, django CMS fails to respect dynamically declared Vary HTTP headers in its internal page cache. This allows remote attackers to bypass authorization, leak sensitive information across user sessions, or poison the page cache by sending requests with custom headers.
A security vulnerability in the github.com/gorilla/websocket Go library allows remote attackers to predict client-to-server frame masking keys. This occurs because the library generates 32-bit mask keys using Go's non-cryptographically secure pseudo-random number generator (math/rand). Predicting these keys enables adversaries to bypass proxy-based security protections, facilitating HTTP request smuggling and cache poisoning attacks.
MHSanaei 3X-UI is a web control panel for managing Xray-core servers. In versions prior to 3.3.1, an authenticated administrator can abuse database import functions or raw template config fields to overwrite or append to arbitrary files on the host filesystem. This is achieved by altering the Xray log configuration variables to target system files, leveraging logging components to inject payloads.