Issue no. 42 · The security zine
Security is all about context.
Practical security thinking for systems that increasingly write, deploy, and operate themselves. Fewer buzzwords. Better evidence. Occasional memes.
CVE-2024-58390 Frappe Frappe Framework★CVE-2026-100133 Adobe Adobe Commerce★CVE-2026-100202 Microsoft Windows Message Queuing★CVE-2026-100210 Microsoft Microsoft Office Excel★CVE-2026-100211 Microsoft Microsoft Office Excel★CVE-2026-100212 Microsoft Microsoft Office Excel★CVE-2026-100214 Microsoft Microsoft Dynamics NAV★CVE-2026-100218 Microsoft Remote Desktop Gateway★CVE-2026-100219 Microsoft Microsoft QUIC★CVE-2026-100220 Microsoft Windows Media Video DecoderPatch forecast · Oct 13
Known-exploited vulnerabilities are in the wild. Patch like it is raining.
Field report · sweep 03 · 116 contacts on the board
Advisory desk
Known exploitation already skipped the prioritization meeting.
Frappe Frappe Framework
Frappe before 14.81.4 and 15.x before 15.41.0 has an improper privilege management flaw in a document action that lets a Website User escalate to System Manager. CVSS 3.1 8.8.
Adobe Adobe Commerce
Adobe Commerce has a stored script injection flaw: an attacker can plant JavaScript in a form field and have it run in the browser of whoever views the page, with changed scope. Adobe rates it CVSS 3.1 9.3.
Microsoft Windows Message Queuing
Microsoft Message Queuing (MSMQ) has a use-after-free flaw an unauthenticated attacker can trigger over the network to execute code. Microsoft rates it CVSS 3.1 9.8.
Live demo · try it right here
Find leaked secrets without leaking them.
Paste code, config, or logs below. 112 detectors run entirely in your browser and return redacted findings, reasoned risk scores, and rotation guidance. Nothing uploads. Nothing phones home.
Inspect source material
No upload step exists. Files are read by your browser, scanned in memory, and discarded when the tab closes.
Findings
Ready when you are.
Add source material on the left. Results are pattern matches, not proof that a credential is active.
Latest transmissions
For the work after the scanner finishes yelling.
A field guide to agentic vulnerability management (with an actual off switch)
A practical operating model for introducing agents without confusing automation, authority, and accountability.
Finding vulnerabilities is getting cheaper. The backlog has noticed.
AI compresses the cost of discovery, but the expensive parts of vulnerability management still begin after the finding exists.
The vulnerability ticket is an interface, not a filing cabinet
A useful vulnerability record should help an owner decide and act—not merely preserve scanner output.
exhibit A: the backlog