Vulnerability Research

S Stefan Mitocaru · Sep 18, 2026 · 20 min

CVE-2026-74820: how an unsanitized ORDER BY clause turned ServiceNow's AI Platform into an unauthenticated database backdoor

Inside CVE-2026-74820: a CVSS 10.0 unauthenticated SQL injection in ServiceNow's AI Platform, reachable through a dynamic schema ORDER BY cl...

P Paraschivoiu Alexandru · Sep 9, 2026 · 20 min

CVE-2026-85978: how one path normalization mismatch turned Akana's admin console into unauthenticated remote code execution

Inside CVE-2026-85978: a path normalization gap between Akana Policy Manager's auth filter and its servlet dispatcher lets an unauthenticate...

S Stefan Mitocaru · Sep 1, 2026 · 19 min

CVE-2026-78174: how an unredacted session token in a diagnostic log turned a low-privileged WatchGuard Dimension admin into super admin

Inside CVE-2026-78174: WatchGuard Dimension writes Super Administrator session tokens into a diagnostic log any lower-privileged Administrat...

S Stefan Mitocaru · Aug 19, 2026 · 17 min

Qwen 3.8 27B and the year the open weights caught up: how a 17GB download started beating the frontier

Inside the Qwen 3.8 27B release: a 27B Apache 2.0 dense multimodal model that runs on one consumer GPU and claims frontier-class coding, and...

S Stefan Mitocaru · Aug 3, 2026 · 18 min

CVE-2026-65321: how one backslash in PyAthena's quote escaper turned parameterized DELETE queries into SQL injection

Inside CVE-2026-65321: PyAthena sent DELETE and CTAS statements through a Hive escaper that backslash-escapes quotes, but Athena and Trino i...

S Stefan Mitocaru · Jul 31, 2026 · 19 min

CVE-2026-63223: how a GIF header on a PHP file turned CodeIgniter's image upload check into remote code execution

CodeIgniter's is_image and mime_in upload rules trusted content-derived MIME type but never the client filename extension, letting a .php fi...

P Paraschivoiu Alexandru · Jul 29, 2026 · 18 min

CVE-2026-58155: how silently truncating a long header name turned Apache Traffic Server into a request-smuggling engine

Inside CVE-2026-58155: Apache Traffic Server silently truncated over-length HTTP header names instead of rejecting them, enabling header ali...

S Stefan Mitocaru · Jul 27, 2026 · 11 min

Pragma Binary: static analysis, live sandbox, and threat intelligence, in one place

A tour of Pragma Binary, the platform that takes any binary, assembly, or script apart. Read the code, detonate it in a safe sandbox, connec...

P Paraschivoiu Alexandru · Jul 20, 2026 · 21 min

CVE-2026-60137 + CVE-2026-63030: how a one-position array desync in WordPress's batch API turned a login-only SQL injection into unauthenticated RCE

Inside wp2shell (CVE-2026-60137 + CVE-2026-63030): a REST batch route desync in WordPress core unblocks an author__not_in SQL injection, cha...

P Paraschivoiu Alexandru · Jul 17, 2026 · 19 min

CVE-2026-58644: how one unsafe deserialize turns an on-prem SharePoint server into unauthenticated remote code execution

Inside CVE-2026-58644: a critical (CVSS 9.8) deserialization flaw in on-premises Microsoft SharePoint Server that hands unauthenticated atta...

S Stefan Mitocaru · Jul 15, 2026 · 22 min

AsyncAPI and Miasma v3: how one unmerged workflow fix let a pull request publish malware to 2.9 million weekly downloads

Inside the July 14, 2026 AsyncAPI supply chain compromise: a pull_request_target pwn-request stole an org token, and the project's own pipel...

S Stefan Mitocaru · Jul 10, 2026 · 22 min

IonStack (CVE-2026-10702 + CVE-2026-43499): how a JIT miscompilation and a 15-year-old kernel flaw turned one URL click into full Android 17 root

Inside IonStack: Nebula Security chains a Firefox IonMonkey type-confusion (CVE-2026-10702) with a 15-year-old Linux kernel stack-UAF (CVE-2...