Independent vulnerability research focused on application security, SSRF, parser inconsistencies, cloud impact, access control, command injection, and supply-chain security.
This repository tracks selected public findings disclosed through responsible disclosure and coordinated publication. Older CVE writeups are preserved in their original paths because some of them are referenced directly by public CVE records.
- SSRF and URL/IP parser bypasses
- Cloud metadata and cloud impact
- Access control and privilege escalation
- Command injection and file read primitives
- Authentication and security control bypasses
- Supply-chain and dependency risk
| Project | Vulnerability | Public Reference | Severity | Area |
|---|---|---|---|---|
| LibreChat | SSRF via IPv4-mapped IPv6 | CVE-2026-31943 | High | SSRF, parser bypass |
| Twenty | SSRF via IPv4-mapped IPv6 | CVE-2026-33975 | Medium | SSRF, parser bypass |
| Stirling PDF | SSRF via missing RFC 6598 validation | GHSA-hg2c-wm3r-f7xx | High | SSRF, private range validation |
| new-api | SSRF via unresolved hostname | CVE-2026-33655 | High | SSRF, DNS validation |
| Flowise | SSRF via OAuth2 callback parameter | GHSA-r745-8hwv-h473 | High | SSRF, OAuth callback validation |
| Authentik | Privilege escalation via user PATCH | CVE-2026-40172 | High | Access control |
| Coolify | RCE via LocalFileVolume fs_path |
CVE-2026-34153 | High | RCE, unsafe path handling |
| Coolify | Command injection via newline | CVE-2026-34152 | High | Command injection |
| Traefik | Host restriction bypass | CVE-2026-32695 | Medium | Host validation bypass |
| dssrf | IPv6 category bypass in is_url_safe |
CVE-2026-44232 | Critical | SSRF protection bypass |
| nuxt-og-image | SSRF via IPv6 and redirect | CVE-2026-44589 | Low | SSRF, redirect handling |
| Portainer | Arbitrary file read via Git symlink injection | CVE-2026-44881 | High | File read, symlink handling |
| Keycloak | Execute-actions token replay allows unauthorized WebAuthn credential enrollment | CVE-2026-37982 | Medium | Authentication control bypass |
| Budibase | CSRF bypass via query string injection in Budibase Worker | CVE-2026-48147 | Medium | CSRF bypass |
These writeups are kept in their original paths to avoid breaking public references from CVE records.
| CVE | Topic |
|---|---|
| CVE-2024-27703 | Stored XSS in Leantime |
| CVE-2024-27705 | Stored XSS via file upload in Leantime |
| CVE-2024-27706 | Stored XSS via file upload in Huly Platform |
| CVE-2024-27707 | SSRF via file upload in Huly Platform |
| CVE-2024-28434 | Stored XSS in Twenty |
| CVE-2024-28435 | SSRF in Twenty |
| CVE-2024-29318 | Stored XSS in Volmarg Personal Management System |
| CVE-2024-29319 | SSRF in Volmarg Personal Management System |
| CVE-2024-48448 | Stored XSS via file upload in Huly Platform |
| CVE-2024-48450 | SSRF in Huly Platform |
All vulnerabilities listed here were reported through responsible disclosure and documented only after public advisory publication or vendor/project coordination.