Three bugs in vinext's alpha, Cloudflare's AI-built Next.js replacement
Three bugs in vinext's alpha, the Next.js replacement Cloudflare built with AI for about $1,100: a middleware auth bypass, a header-sanitization bypass, and a reflected XSS.
I look for security bugs and publish them once they are fixed.
One column per disclosure, oldest on the left.
45 disclosures 39 CVEs since 2026-03 latest 2026-08-24
- 7 critical
- 13 high
- 19 moderate
- 5 low
- 1 no score
Writeups
all writeupsAuditing OpenReception: 16 CVEs in an E2E encrypted booking platform
A white-box audit of the end-to-end encrypted booking platform OpenReception found 16 vulnerabilities, four of them critical.
Bypassing Zammad's AI text tool authorization via REST API (CVE-2026-34782 / CVE-2026-34837)
How missing authorization checks in Zammad's REST API let agents execute group-restricted AI text tools and inject unauthorized ticket context into AI prompts.
Recent disclosures
all 45
Events Manager WordPress Plugin
missing authorization lets unauthenticated attackers use status, private, and private_only parameters to view draft, pending, trashed, or private event and location details
Wazuh
pre-authentication cluster header parsing lets one source IP allocate 256 MiB of manager memory per TCP connection
Wazuh
zlib decompression bomb in cluster archive processing lets an authenticated peer exhaust wazuh-clusterd memory
Wazuh
peer-controlled cluster hello node name lets an authenticated peer delete the contents of arbitrary manager directories on disconnect
Wazuh
merged-file header path traversal in cluster sync allows a cluster peer to write arbitrary files under WAZUH_PATH and reach root code execution