Original Security Research - Vulnerabilities we found, exploits we built, patterns we keep seeing
CVEs found in
DISCLOSURES
All Research
Every vulnerability we've reported, with the reproduction steps and the patch that fixed it.
Xenbleed: The Eleven-Year-Old Shortcut
CVE-2026-102703
CVSS 9.4
Inside PHP2Shell’s Broken Request Lifecycle
CVE-2026-109618
CVE-2026-109619
CVE-2026-109432: The Validator That Had Nothing to Validate, a Camunda RCE
CVE-2026-109432
CVSS 9.3
CVE-2026-109431: The Authorization Check Four Camunda Task Endpoints Skip
CVE-2026-109431
CVSS 8.6
CVE-2026-109433: How One Disabled Permission Disabled Them All in Camunda Cockpit
CVE-2026-109433
CVSS 7.1
From Markdown to a Shell: Two RCEs in Obsidian Desktop
CVE-2026-104077, CVE-2026-104078
CVSS 8.5 & 8.4
CVE-2026-77226: How an Empty Admin Group Let Anyone Create a Camunda Administrator
CVE-2026-77226
CVSS 9.2
Incomplete Recipient Validation in Claude Code Computer Use Enabled Command Execution in an Unapproved Terminal
HackerOne #3985968
High · Triaged
How a Manus Prompt Injection Turned One Project Invite Into a Desktop Takeover
Meta Bug-bounty Finding
Manus
Stale Application Authorization in Claude Code Computer Use Enabled Cross-Application Keystroke Delivery on macOS
HackerOne #3930758
CVSS 7.7
Dissecting FOIS: Log4j2's Half-Built Deserialization Filter
Vulnerability research
Apache Log4j2
A Finder Authorization Bypass in Claude Code Computer Use on macOS
HackerOne #3885687
CVSS 7.7
How a Triage User Injects Into a Claude Code Action Write Run
HackerOne #3918594
CVSS 7.5
Claude Code macOS TOCTOU: Breaking the Workspace Boundary
HackerOne #3882177
CVSS 7.7
CVE-2026-71503: Dolibarr Reflected XSS to Admin Takeover
CVE-2026-71503
CVSS 9.3
CVE-2026-71504: Mass Assignment in Members API via pass
CVE-2026-71504
CVSS 8.3
CVE-2026-71505: Dolibarr BOLA Enables Portal Account Takeover
CVE-2026-71505
CVSS 8.1
CVE-2026-71511: Dolibarr Members API Exposes Password Hashes
CVE-2026-71511
CVSS 6.5
CVE-2026-71510: Dolibarr SQLFilters Bypass Exposes Payroll
CVE-2026-71510
CVSS 6.5
CVE-2026-71508: Dolibarr Mass Assignment to Payroll Tampering
CVE-2026-71508
CVSS 6.5
CVE-2026-71509: Dolibarr Mass Assignment Self-Approval Bug
CVE-2026-71509
CVSS 6.5
CVE-2026-71507: Dolibarr BOLA Redirects Supplier Payments
CVE-2026-71507
CVSS 6.5
CVE-2026-71506: Dolibarr Payment Deletion via Incorrect Authorization
CVE-2026-71506
CVSS 6.5
CVE-2026-31988: jszip DoS via Malformed ZIP File
CVE-2026-31988
CVSS 6.9
CVE-2026-28292: simple-git RCE via Case-Sensitivity Bypass
CVE-2026-28292
CVSS 9.8
CVE-2026-29000: pac4j-jwt Auth Bypass PoC With a Public Key
CVE-2026-29000
CVSS 10
