ZéroJour — the zero-day paper

ZéroJour prints itself from a Sanity dataset of real advisories (GitHub Advisory Database, CC-BY-4.0; CISA KEV). No scraping, no keyword search — headlines are typed fields, scores are numbers, fixes are versions. The newsroom composes, a human approves.

Front page — listed in the CISA KEV catalog: treat as actively exploited

Potential XSS vulnerability in jQuery

No remedy — no published fix; upgrading cannot close these

Paramiko rsakey.py allows the SHA-1 algorithm

Highest severity — CVSS base score 8.0 and above

Paramiko not properly checking authentication before processing other requests

Prototype Pollution in minimist

Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

Paramiko Authentication Bypass vulnerability

node-fetch forwards secure headers to untrusted sites

jsonwebtoken unrestricted key type could lead to legacy keys usage

Latest dispatches — newest advisories in the dataset

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count

fastify vulnerable to schema validation bypass via root primitive coercion mismatch

undici vulnerable to CRLF Injection via blob-like body 'type' property

undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives

undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields

undici vulnerable to downstream response desynchronization via retry interceptor

undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

Next.js: Server-Side Request Forgery in Server Actions on custom servers

Next.js: Cache confusion of response bodies for requests with bodies

Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences