Issue no. 42 · The security zine
Security is all about context.
Practical security thinking for systems that increasingly write, deploy, and operate themselves. Fewer buzzwords. Better evidence. Occasional memes.
CVE-2024-58405 Zipline Zipline★CVE-2026-126269 NocoDB NocoDB★CVE-2026-126273 NocoDB NocoDB★CVE-2026-126286 NocoDB NocoDB★CVE-2026-126317 Frappe Frappe HRMS★CVE-2026-126414 Frappe Frappe HRMS★CVE-2026-126430 OpenEMR OpenEMR★CVE-2026-126434 OpenEMR OpenEMR★CVE-2026-126442 OpenEMR OpenEMR★CVE-2026-126454 OpenEMR OpenEMRPatch forecast · Nov 13
Known-exploited vulnerabilities are in the wild. Patch like it is raining.
Field report · sweep 03 · 88 contacts on the board
Advisory desk
Known exploitation already skipped the prioritization meeting.
Zipline Zipline
Zipline before 3.7.11 and 4.0.0 before 4.3.1 has an incorrect authorization flaw in the invite create endpoint that lets low-privilege authenticated users generate invitation codes despite allow_registrations=false. Attackers can bypass the registration restriction and create arbitrary user accounts on the server; fixed in 3.7.11 and 4.3.1.
NocoDB NocoDB
NocoDB before 0.288.2 has a stored cross-site scripting flaw that lets authenticated attackers inject arbitrary JavaScript via data cell comments. The comment feature in cell fields embeds malicious script that executes in the browser of users viewing the comment; fixed in 0.288.2.
NocoDB NocoDB
NocoDB before 0.288.2 has an improper privilege management flaw in API token generation that lets authenticated users with the Create role create tokens with Owner privileges. Attackers can generate API tokens granting full owner access to the workspace, enabling privilege escalation and full control over the NocoDB instance; fixed in 0.288.2.
Live demo · try it right here
Find leaked secrets without leaking them.
Paste code, config, or logs below. 112 detectors run entirely in your browser and return redacted findings, reasoned risk scores, and rotation guidance. Nothing uploads. Nothing phones home.
Inspect source material
No upload step exists. Files are read by your browser, scanned in memory, and discarded when the tab closes.
Findings
Ready when you are.
Add source material on the left. Results are pattern matches, not proof that a credential is active.
Latest transmissions
For the work after the scanner finishes yelling.
A field guide to agentic vulnerability management (with an actual off switch)
A practical operating model for introducing agents without confusing automation, authority, and accountability.
Finding vulnerabilities is getting cheaper. The backlog has noticed.
AI compresses the cost of discovery, but the expensive parts of vulnerability management still begin after the finding exists.
The vulnerability ticket is an interface, not a filing cabinet
A useful vulnerability record should help an owner decide and act—not merely preserve scanner output.
exhibit A: the backlog