Three bugs in vinext's alpha, Cloudflare's AI-built Next.js replacement
Three bugs in vinext's alpha, the Next.js replacement Cloudflare built with AI for about $1,100: a middleware auth bypass, a header-sanitization bypass, and a reflected XSS.
I look for security bugs and publish them once they are fixed.
One column per disclosure, oldest on the left.
50 disclosures 43 CVEs since 2026-03 latest 2026-10-22
- 8 critical
- 16 high
- 19 moderate
- 6 low
- 1 no score
Writeups
all writeupsAuditing OpenReception: 16 CVEs in an E2E encrypted booking platform
A white-box audit of the end-to-end encrypted booking platform OpenReception found 16 vulnerabilities, four of them critical.
Bypassing Zammad's AI text tool authorization via REST API (CVE-2026-34782 / CVE-2026-34837)
How missing authorization checks in Zammad's REST API let agents execute group-restricted AI text tools and inject unauthorized ticket context into AI prompts.
Recent disclosures
all 50
cBioPortal
unauthenticated /api/getexternalpage.json fetches any sourceURL without scheme or host checks, allowing SSRF and file:// reads of local files such as application.properties
Microsoft Office Outlook
heap-based buffer overflow lets an unauthenticated remote attacker execute code over the network, with the Preview Pane as an attack vector
Microsoft Office Outlook
stack-based buffer overflow lets an unauthenticated remote attacker execute code when a crafted email is shown in the Reading Pane, without the recipient opening it
Microsoft MPEG-2 Video Extension
heap-based buffer overflow lets a crafted video file execute code in the context of the user who opens it
OpenSSL
QUIC stack enforces the stream-level but not the connection-level flow control limit, letting a remote peer make one connection allocate about 100 MB of heap instead of the 768 KiB window