Blog

Analysis & field reports.

Name: CleanIssue
Price range: €€

Technical articles on web application security, exposure patterns we find, and practical guidance for SaaS product teams.

Our specialty: HR & Payroll software

CVESharePointJul 17, 2026 · 6 min

SharePoint CVE-2026-58644: a critical RCE zero-day added to the CISA KEV catalog

A deserialization flaw (CVSS 9.8) in Microsoft SharePoint Server lets an attacker authenticated as Site Owner execute arbitrary code remotely. Actively exploited as a zero-day, added to the CISA KEV catalog on July 16, 2026 with a July 19 remediation deadline.

Read article

CVE7 min

n8n CVE-2026-59208: a JWT token exchange flaw that logs you in as someone else

On n8n Enterprise instances trusting two external token issuers, the token-exchange flow matched an incoming JWT on the sub claim alone and ignored iss. A valid token from issuer A logged you in as a user under issuer B. CVSS 7.6 (4.0) / 6.8 (3.1). Fix: n8n 2.27.4 and 2.28.1.

Jul 16, 2026Read article

CVE5 min

Zoom CVE-2026-53412: a critical account takeover in the Windows desktop client

An improper input validation flaw (CVSS 9.8) in Zoom Workplace for Windows, the VDI Client, and the Meeting SDK lets an unauthenticated attacker take over accounts via network access. Affects versions before 7.0.0. Fix available.

Jul 15, 2026Read article

CVE7 min

Microsoft Patch Tuesday July 2026: a record 570 flaws and 3 zero-days

The July 14, 2026 Patch Tuesday fixes 570 vulnerabilities — a record — including 59 Critical and 3 zero-days. Two are actively exploited (AD FS, SharePoint), one is publicly disclosed (BitLocker bypass). What a SaaS team needs to retain.

Jul 14, 2026Read article

CVE6 min

Gitea CVE-2026-20896: a one-header auth bypass shipped in the official Docker image

The official Gitea Docker image shipped `REVERSE_PROXY_TRUSTED_PROXIES=*`, so with reverse-proxy auth enabled, an unauthenticated internet client became whoever it claimed to be via the X-WEBAUTH-USER header. CVSS 9.8, actively exploited. Fix: Gitea 1.26.3 / 1.26.4.

Jul 10, 2026Read article

CVE6 min

Next.js CVE-2026-44578: an SSRF via WebSocket on self-hosted instances

An SSRF flaw (CVSS 8.6) in Next.js's built-in Node.js server lets an unauthenticated attacker proxy requests to your internal services. Vercel is unaffected; self-hosting is. Fix: 15.5.16 / 16.2.5.

Jul 9, 2026Read article

CVE6 min

WordPress CVE-2026-8206: unauthenticated admin takeover via the Kirki plugin

The Kirki WordPress plugin (6.0.0 to 6.0.6) lets an unauthenticated attacker take over an administrator account via a broken password reset. CVSS 9.8, active exploitation, ~150,000 sites exposed. Fix: 6.0.7.

Jul 9, 2026Read article

IA & LLM6 min

Langflow CVE-2026-55255: an auth bypass on AI agent workflows, now in the CISA KEV

An IDOR (CVSS 9.8) in Langflow, the visual framework for building AI agents, lets an authenticated attacker access other users' flows via the /api/v1/responses endpoint with a victim's UUID. Actively exploited since June 25, 2026. CISA KEV with a one-week deadline.

Jul 8, 2026Read article

technical6 min

Secrets in Git: the API key you deleted is still there

Deleting an API key from your code doesn't remove it from Git history. How attackers scan repositories, why that .env committed in 2023 is still exploitable, and what to do — in the right order.

Jul 6, 2026Read article

159 articles · Page 1/18

Need an external review of your HR SaaS?

Share your product, stack, and client context. We will come back with the right review scope.

Discuss your audit