Three bugs in vinext's alpha, Cloudflare's AI-built Next.js replacement
Three bugs in vinext's alpha, the Next.js replacement Cloudflare built with AI for about $1,100: a middleware auth bypass, a header-sanitization bypass, and a reflected XSS.
I break software before someone worse does.
Security research and bug bounty, done the boring way: reported to the vendor, fixed, then written up here.
Latest writeups / 3
all writeups →Auditing OpenReception: 16 CVEs in an E2E encrypted booking platform
A white-box audit of the end-to-end encrypted booking platform OpenReception found 16 vulnerabilities, four of them critical.
Bypassing Zammad's AI text tool authorization via REST API (CVE-2026-34782 / CVE-2026-34837)
How missing authorization checks in Zammad's REST API let agents execute group-restricted AI text tools and inject unauthorized ticket context into AI prompts.
From the ledger / 5 of 45
full ledger →
Events Manager WordPress Plugin
missing authorization lets unauthenticated attackers use status, private, and private_only parameters to view draft, pending, trashed, or private event and location details
Wazuh
pre-authentication cluster header parsing lets one source IP allocate 256 MiB of manager memory per TCP connection
Wazuh
zlib decompression bomb in cluster archive processing lets an authenticated peer exhaust wazuh-clusterd memory
Wazuh
peer-controlled cluster hello node name lets an authenticated peer delete the contents of arbitrary manager directories on disconnect
Wazuh
merged-file header path traversal in cluster sync allows a cluster peer to write arbitrary files under WAZUH_PATH and reach root code execution