Issue no. 42 · The security zine
Security is all about context.
Practical security thinking for systems that increasingly write, deploy, and operate themselves. Fewer buzzwords. Better evidence. Occasional memes.
CVE-2026-109795 SAP S4CRM★CVE-2026-109798 SAP BusinessObjects Business Intelligence Platform★CVE-2026-109803 SAP NetWeaver Knowledge Management★CVE-2026-120008 SAP NetWeaver (Internet Graphics Service)★CVE-2026-120017 SAP NetWeaver AS ABAP (SAML2 Service Provider)★CVE-2026-120513 WPEverest Everest Forms★CVE-2026-125391 Webmin Webmin★CVE-2026-125396 Artifex Ghostscript★CVE-2026-125400 Ettercap Ettercap★CVE-2026-125401 Ettercap EttercapPatch forecast · Nov 10
Known-exploited vulnerabilities are in the wild. Patch like it is raining.
Field report · sweep 03 · 75 contacts on the board
Advisory desk
Known exploitation already skipped the prioritization meeting.
SAP S4CRM
SAP NetWeaver S4CRM does not perform authorization checks or sufficient input validation in remote-enabled functionality, letting a low-privileged attacker inject and execute arbitrary code. SAP rates it CVSS 3.1 9.9.
SAP BusinessObjects Business Intelligence Platform
SAP BusinessObjects Business Intelligence Platform (Web Intelligence) does not restrict external entity resolution in OLAP connection requests, letting an authenticated attacker read sensitive server files and reach internal systems. SAP rates it CVSS 3.1 9.1.
SAP NetWeaver Knowledge Management
SAP NetWeaver Knowledge Management (XML Forms) does not sufficiently restrict which XSL transformations are processed, letting an authenticated user trigger an unauthorized transformation and potentially execute arbitrary code. SAP rates it CVSS 3.1 9.9.
Live demo · try it right here
Find leaked secrets without leaking them.
Paste code, config, or logs below. 112 detectors run entirely in your browser and return redacted findings, reasoned risk scores, and rotation guidance. Nothing uploads. Nothing phones home.
Inspect source material
No upload step exists. Files are read by your browser, scanned in memory, and discarded when the tab closes.
Findings
Ready when you are.
Add source material on the left. Results are pattern matches, not proof that a credential is active.
Latest transmissions
For the work after the scanner finishes yelling.
A field guide to agentic vulnerability management (with an actual off switch)
A practical operating model for introducing agents without confusing automation, authority, and accountability.
Finding vulnerabilities is getting cheaper. The backlog has noticed.
AI compresses the cost of discovery, but the expensive parts of vulnerability management still begin after the finding exists.
The vulnerability ticket is an interface, not a filing cabinet
A useful vulnerability record should help an owner decide and act—not merely preserve scanner output.
exhibit A: the backlog