Issue no. 42 · The security zine
Security is all about context.
Practical security thinking for systems that increasingly write, deploy, and operate themselves. Fewer buzzwords. Better evidence. Occasional memes.
CVE-2026-114635 Traefik Traefik★CVE-2026-114636 Traefik Traefik★CVE-2026-114637 Traefik Traefik★CVE-2026-114638 Traefik Traefik★CVE-2026-114639 Traefik Traefik★CVE-2026-114640 Traefik Traefik★CVE-2026-114642 Traefik Traefik★CVE-2026-115324 mem0ai mem0★CVE-2026-115353 Lepture Mistune★CVE-2026-115355 Lepture MistunePatch forecast · Oct 22
Known-exploited vulnerabilities are in the wild. Patch like it is raining.
Field report · sweep 03 · 97 contacts on the board
Advisory desk
Known exploitation already skipped the prioritization meeting.
Traefik Traefik
Traefik before 2.11.58 and 3.7.14 skips its SNI check when request TLS state is nil, which happens for HTTP/2 requests with the http scheme pseudo-header on Go 1.27 builds, so unauthenticated clients can reach routers requiring client certificates without presenting one. Official builds use Go 1.26 and are not exposed, per the Traefik advisory. CVSS 3.1 8.7.
Traefik Traefik
Traefik 3.7.13, fixed in 3.7.14, builds an extra HTTP router for ssl-passthrough Ingresses in the Kubernetes Ingress NGINX provider without applying the Ingress auth and allow-list annotations, so unauthenticated clients on the HTTP entry point can reach protected backends with nothing logged. CVSS 3.1 8.7.
Traefik Traefik
Traefik from 3.2.0 before 3.7.14, when experimental FastProxy is enabled, pools plain HTTP backend connections without pinning NTLM or Negotiate authenticated connections to their frontend connection, so an unauthenticated client can be served as a victim on a reused backend connection. CVSS 3.1 8.7.
Live demo · try it right here
Find leaked secrets without leaking them.
Paste code, config, or logs below. 112 detectors run entirely in your browser and return redacted findings, reasoned risk scores, and rotation guidance. Nothing uploads. Nothing phones home.
Inspect source material
No upload step exists. Files are read by your browser, scanned in memory, and discarded when the tab closes.
Findings
Ready when you are.
Add source material on the left. Results are pattern matches, not proof that a credential is active.
Latest transmissions
For the work after the scanner finishes yelling.
A field guide to agentic vulnerability management (with an actual off switch)
A practical operating model for introducing agents without confusing automation, authority, and accountability.
Finding vulnerabilities is getting cheaper. The backlog has noticed.
AI compresses the cost of discovery, but the expensive parts of vulnerability management still begin after the finding exists.
The vulnerability ticket is an interface, not a filing cabinet
A useful vulnerability record should help an owner decide and act—not merely preserve scanner output.
exhibit A: the backlog