Security research, vulnerability writeups, and technical notes.https://johannes-moeller.dev/https://johannes-moeller.dev/blog/cve-2026-49950-xinference-xoscar-actor-rce/https://johannes-moeller.dev/blog/cve-2026-49950-xinference-xoscar-actor-rce/Unauthenticated Xoscar actor ports deserialize Python objects before dispatch, giving network peers code execution inside Xinference clusters.Fri, 16 Oct 2026 00:00:00 GMThttps://johannes-moeller.dev/blog/vitess-type-raw-bind-variable-sql-injection/https://johannes-moeller.dev/blog/vitess-type-raw-bind-variable-sql-injection/How a client-supplied Type_RAW bind variable reached SQL generation without escaping in Vitess.Mon, 28 Sep 2026 00:00:00 GMThttps://johannes-moeller.dev/blog/tooljet-cross-tenant-tooljetdb-authorization-bypass/https://johannes-moeller.dev/blog/tooljet-cross-tenant-tooljetdb-authorization-bypass/ToolJet trusted a URL organizationId without binding it to the authenticated workspace, exposing cross-tenant TooljetDB operations.Sat, 08 Aug 2026 00:00:00 GMThttps://johannes-moeller.dev/blog/cve-2026-42533-nginx-rewrite-nocacheable-overflow/https://johannes-moeller.dev/blog/cve-2026-42533-nginx-rewrite-nocacheable-overflow/A changing variable is evaluated twice during an NGINX rewrite, leaving the allocated buffer too small for the second result.Wed, 15 Jul 2026 00:00:00 GMThttps://johannes-moeller.dev/blog/cve-2026-50338-spring-cloud-azure-b2c-cross-issuer/https://johannes-moeller.dev/blog/cve-2026-50338-spring-cloud-azure-b2c-cross-issuer/A trusted signing key lets tokens from another Azure AD B2C issuer pass resource-server validation.Tue, 14 Jul 2026 00:00:00 GMThttps://johannes-moeller.dev/blog/cve-2026-43994-coturn-oauth-overflow/https://johannes-moeller.dev/blog/cve-2026-43994-coturn-oauth-overflow/An unchecked authentication-tag length causes a stack buffer overflow in coturn’s OAuth token decoder.Sun, 24 May 2026 00:00:00 GMThttps://johannes-moeller.dev/blog/cve-2026-45631-dokploy-hardcoded-auth-secret/https://johannes-moeller.dev/blog/cve-2026-45631-dokploy-hardcoded-auth-secret/A hardcoded authentication secret enables unauthenticated administrator access in Dokploy.Mon, 11 May 2026 00:00:00 GMThttps://johannes-moeller.dev/blog/cve-2026-44849-portainer-swarm-security-bypass/https://johannes-moeller.dev/blog/cve-2026-44849-portainer-swarm-security-bypass/Swarm service requests bypass Portainer’s endpoint security restrictions.Sun, 10 May 2026 00:00:00 GMThttps://johannes-moeller.dev/blog/cve-2026-42590-gotenberg-exiftool/https://johannes-moeller.dev/blog/cve-2026-42590-gotenberg-exiftool/ExifTool group prefixes bypass Gotenberg’s metadata blocklist and reach file operations.Thu, 30 Apr 2026 00:00:00 GMThttps://johannes-moeller.dev/blog/cve-2026-35330-strongswan-libsimaka/https://johannes-moeller.dev/blog/cve-2026-35330-strongswan-libsimaka/An undersized EAP-SIM/AKA attribute causes an integer underflow and heap overflow before authentication.Fri, 24 Apr 2026 00:00:00 GMThttps://johannes-moeller.dev/blog/cve-2026-35333-strongswan-libradius/https://johannes-moeller.dev/blog/cve-2026-35333-strongswan-libradius/A zero-length RADIUS attribute prevents parser progress before the shared secret is checked.Fri, 24 Apr 2026 00:00:00 GMThttps://johannes-moeller.dev/blog/netfilter-sip-truncation-fix/https://johannes-moeller.dev/blog/netfilter-sip-truncation-fix/A Content-Length truncation in the Linux SIP connection tracker and the upstream fix.Fri, 03 Apr 2026 00:00:00 GMThttps://johannes-moeller.dev/blog/pjsip-vpx-packetizer-oob/https://johannes-moeller.dev/blog/pjsip-vpx-packetizer-oob/A missing payload-length check permits out-of-bounds reads in the PJSIP VP9 RTP unpacketizer.Mon, 30 Mar 2026 00:00:00 GMThttps://johannes-moeller.dev/blog/simple-git-sshcommand-rce/https://johannes-moeller.dev/blog/simple-git-sshcommand-rce/How core.sshCommand reaches command execution through an incomplete argument blocklist.Sun, 15 Mar 2026 00:00:00 GMThttps://johannes-moeller.dev/blog/bluetooth-l2cap-oob-read/https://johannes-moeller.dev/blog/bluetooth-l2cap-oob-read/Validating the L2CAP information response length before accessing its payload.Wed, 11 Mar 2026 00:00:00 GMThttps://johannes-moeller.dev/blog/bluetooth-l2cap-type-confusion/https://johannes-moeller.dev/blog/bluetooth-l2cap-type-confusion/An ECRED response handler accepts incompatible Bluetooth channel types.Wed, 11 Mar 2026 00:00:00 GMThttps://johannes-moeller.dev/blog/gtfo-root-sudo-audit/https://johannes-moeller.dev/blog/gtfo-root-sudo-audit/A practical script for reviewing sudo rules against GTFOBins privilege-escalation primitives.Sat, 21 Jun 2025 00:00:00 GMThttps://johannes-moeller.dev/blog/webshop-password-reset-vulnerability/https://johannes-moeller.dev/blog/webshop-password-reset-vulnerability/A password-reset flaw discovered during ordinary use of a webshop.Fri, 30 May 2025 00:00:00 GMThttps://johannes-moeller.dev/blog/ad-enumeration-living-off-the-land/https://johannes-moeller.dev/blog/ad-enumeration-living-off-the-land/Notes on Active Directory enumeration using tools already available in the environment.Sun, 14 Jul 2024 00:00:00 GMThttps://johannes-moeller.dev/blog/htb-perfection/https://johannes-moeller.dev/blog/htb-perfection/Enumeration, exploitation, and privilege escalation on Hack The Box Perfection.Thu, 07 Mar 2024 00:00:00 GMThttps://johannes-moeller.dev/blog/htb-napper/https://johannes-moeller.dev/blog/htb-napper/Enumeration, exploitation, and privilege escalation on Hack The Box Napper.Sun, 25 Feb 2024 00:00:00 GMThttps://johannes-moeller.dev/blog/htb-appsanity/https://johannes-moeller.dev/blog/htb-appsanity/Enumeration, exploitation, and privilege escalation on Hack The Box Appsanity.Sat, 24 Feb 2024 00:00:00 GMT