Vulnerability-research

Poweradmin is the PHP web panel a large share of PowerDNS operators use to manage zones, and it is often run multi-tenant. We pointed KLUE, our security agent, at it and found seven separate ways its security controls fail. One lets a tenant with a normal Zone Manager role run code as root on the DNS server through a LUA record. Four more hand out full Administrator through SSO or the user-creation path. The last two let a restricted editor rewrite a zone apex and let an attacker toggle DNSSEC over a forged GET. Four were assigned CVEs, all rated High (CVE-2026-115458, CVE-2026-115459, CVE-2026-115460, CVE-2026-115461), and three, including the Critical code execution, are fixed with CVEs still pending. The fixes shipped across the 3.9.12, 4.2.6, 4.3.5, and 4.4.1 releases, each finding in the releases on the branches it affects.

follow-redirects is the redirect-following layer under axios and a large part of the Node HTTP ecosystem. We found two separate ways its cross-origin credential-header stripping control fails silently, one through a type assumption that the header container is always a plain object, and one through an incomplete regular-expression escaper. Both break the protection introduced to fix prior CVEs. Both were reported, accepted, assigned CVEs (CVE-2026-111756 and CVE-2026-111755), and fixed in 1.16.1.

Hydra is the configuration framework a large part of the Python machine-learning world uses to wire up experiments and apps. We pointed KLUE, our AI security agent, at it, and it found two ways to run code on a machine that loads an untrusted Hydra config. Both get around the blocklist Hydra had already added to stop exactly this. One slips through gaps in that blocklist; the other goes through the logging system, a door the blocklist never guarded. Both were reported, accepted, assigned CVEs (CVE-2026-106441 and CVE-2026-106442), rated High, and fixed.

axios is the HTTP client most JavaScript and Node apps use to make requests. While reading through it, our security agent KLUE found a bug in how axios chooses the request method. On the default axios object, if another flaw in your app has polluted Object.prototype, a call you wrote as a safe GET can quietly go out as a DELETE, POST, PUT, or PATCH. Here is how KLUE found it, why only some ways of calling axios are affected, and how it was fixed.

We asked KLUE, our AI security agent, to review kin-openapi, a library that a large share of Go web APIs use to read and check incoming requests. It found three separate bugs that each let anyone crash the service with a single request. The pattern behind all three is the same: the library already had the right safety check, it was just missing on one of the paths that needed it. All three were reported, accepted, assigned CVEs (CVE-2026-100352, CVE-2026-100353, CVE-2026-100354), rated High, and fixed by the maintainers.