Notes & writeups
Vulnerabilities, research, and technical notes.
CVE writeups ordered by severity, then date.
CVE-2026-49950: Pre-Auth RCE in the Xinference/Xoscar Actor Transport
Unauthenticated Xoscar actor ports deserialize Python objects before dispatch, giving network peers code execution inside Xinference clusters.
CriticalCVE-2026-45631: Dokploy Pre-Auth Admin Takeover via Hardcoded Auth Secret
A hardcoded authentication secret enables unauthenticated administrator access in Dokploy.
CriticalCVE-2026-44849: Portainer Swarm Endpoint Security Bypass
Swarm service requests bypass Portainer’s endpoint security restrictions.
CriticalCVE-2026-35330: Pre-Auth Heap Overflow in strongSwan libsimaka (EAP-SIM/AKA)
An undersized EAP-SIM/AKA attribute causes an integer underflow and heap overflow before authentication.
CriticalCVE-2026-34235: Heap OOB Read in PJSIP VP9 RTP Unpacketizer
A missing payload-length check permits out-of-bounds reads in the PJSIP VP9 RTP unpacketizer.
Criticalsimple-git RCE: Bypassing the Blocklist via core.sshCommand Injection
How core.sshCommand reaches command execution through an incomplete argument blocklist.
CriticalCVE-2026-42533: NGINX Heap Overflow via Non-Cacheable Variable Re-Evaluation
A changing variable is evaluated twice during an NGINX rewrite, leaving the allocated buffer too small for the second result.
HighCVE-2026-50338: Spring Cloud Azure B2C Cross-Issuer Authentication Bypass
A trusted signing key lets tokens from another Azure AD B2C issuer pass resource-server validation.
HighCVE-2026-43994: Pre-Auth Stack Buffer Overflow in coturn OAuth Token Decoder
An unchecked authentication-tag length causes a stack buffer overflow in coturn’s OAuth token decoder.
HighCVE-2026-42590: Gotenberg ExifTool Group-Prefix Bypass
ExifTool group prefixes bypass Gotenberg’s metadata blocklist and reach file operations.
HighCVE-2026-35333: Pre-Secret Infinite Loop in strongSwan libradius DAE Handler
A zero-length RADIUS attribute prevents parser progress before the shared secret is checked.
HighLinux Kernel: Content-Length Truncation in netfilter SIP Tracker
A Content-Length truncation in the Linux SIP connection tracker and the upstream fix.
HighBluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access
Validating the L2CAP information response length before accessing its payload.
HighCVE-2026-43062: Bluetooth L2CAP Type Confusion in l2cap_ecred_reconf_rsp()
An ECRED response handler accepts incompatible Bluetooth channel types.
HighCVE-2026-73068: ToolJet Cross-Tenant TooljetDB Authorization Bypass
ToolJet trusted a URL organizationId without binding it to the authenticated workspace, exposing cross-tenant TooljetDB operations.
MediumVitess Type_RAW Bind Variable SQL Injection
How a client-supplied Type_RAW bind variable reached SQL generation without escaping in Vitess.
GTFO, Root: A Practical Sudo Audit Script for GTFOBins Escapes
A practical script for reviewing sudo rules against GTFOBins privilege-escalation primitives.
How I Stumbled Upon a Critical Webshop Vulnerability (and How It Vanished Without a Trace)
A password-reset flaw discovered during ordinary use of a webshop.
Active Directory Enumeration & Attacks -- Living off the Land
Notes on Active Directory enumeration using tools already available in the environment.
HTB Perfection Writeup
Enumeration, exploitation, and privilege escalation on Hack The Box Perfection.
HTB Napper Writeup
Enumeration, exploitation, and privilege escalation on Hack The Box Napper.
HTB Appsanity Writeup
Enumeration, exploitation, and privilege escalation on Hack The Box Appsanity.
No posts in this filter.