Three bugs in vinext's alpha, Cloudflare's AI-built Next.js replacement
Three bugs in vinext's alpha, the Next.js replacement Cloudflare built with AI for about $1,100: a middleware auth bypass, a header-sanitization bypass, and a reflected XSS.
I look for security bugs and publish them once they are fixed.
One column per disclosure, oldest on the left.
48 disclosures 42 CVEs since 2026-03 latest 2026-10-13
- 8 critical
- 14 high
- 19 moderate
- 6 low
- 1 no score
Writeups
all writeupsAuditing OpenReception: 16 CVEs in an E2E encrypted booking platform
A white-box audit of the end-to-end encrypted booking platform OpenReception found 16 vulnerabilities, four of them critical.
Bypassing Zammad's AI text tool authorization via REST API (CVE-2026-34782 / CVE-2026-34837)
How missing authorization checks in Zammad's REST API let agents execute group-restricted AI text tools and inject unauthorized ticket context into AI prompts.
Recent disclosures
all 48
Microsoft Office Outlook
stack-based buffer overflow lets an unauthenticated remote attacker execute code when a crafted email is shown in the Reading Pane, without the recipient opening it
Microsoft MPEG-2 Video Extension
heap-based buffer overflow lets a crafted video file execute code in the context of the user who opens it
OpenSSL
QUIC stack enforces the stream-level but not the connection-level flow control limit, letting a remote peer make one connection allocate about 100 MB of heap instead of the 768 KiB window
Events Manager WordPress Plugin
missing authorization lets unauthenticated attackers use status, private, and private_only parameters to view draft, pending, trashed, or private event and location details
Wazuh
pre-authentication cluster header parsing lets one source IP allocate 256 MiB of manager memory per TCP connection