Weekly CVE deep dives. Real-world analysis. No fluff.
A C-style downcast inside the iccDEV ICC profile evaluator trusted attacker-controlled file contents to be the type the function expected. When they weren't, a virtual call landed somewhere it had no business being.
A medium-severity Missing Authorization flaw in WPFunnels' Creator LMS plugin (versions ≤ 1.1.12) — Patchstack's catalogue entry says "Broken Access Control," CVSS 5.3, no authentication required to reach the affected functionality. This is one of the most boring and most common shapes of WordPress plugin vulnerability, and it's worth the post precisely *because* it is boring.
A stack buffer overflow in the `/goform/PowerSaveSet` HTTP handler on Tenda's AC23 router (firmware ≤ V16.03.07.52). The root cause is a single unbounded `sscanf` call that parses an attacker-controlled POST parameter into fixed-size stack buffers — the scanf-family equivalent of calling `gets()`, repeated four times in one line.
When a TLS library will happily verify an ECDSA certificate signature using any digest size a cert happens to advertise, the "security level" printed on the box stops meaning what the box says. wolfSSL's pre-10131 signature path had a conspicuous size check — but only on the upper end.
Dwyer-Omega's Isensix Advanced Remote Monitoring System (ARMS) 1.5.7 leaks database contents through a blind SQL injection in the `user` parameter of the login form — the one door every web app is supposed to keep boring, and this one cheerfully tells the attacker about the shape of the furniture inside.
A medium-severity flaw in the reference ICC color-management library (CVE-2026-21493) turns on a tiny but classic mistake: trusting a four-byte signature inside a file to tell you what C++ class an object is. The fix is a small diff with a big lesson about the gap between runtime type tags and RTTI.
A 9.9 in axios, published April 2026 (CVE-2025-62718): `NO_PROXY=localhost` does not protect `http://localhost.:8080/`, and it does not protect `http://[::1]/` either. Axios forwards those requests through the configured HTTP proxy — a textbook SSRF pivot, delivered by the oldest bug in the book: string-compare on things that aren't strings.