Three bugs in vinext's alpha, Cloudflare's AI-built Next.js replacement
Three bugs in vinext's alpha, the Next.js replacement Cloudflare built with AI for about $1,100: a middleware auth bypass, a header-sanitization bypass, and a reflected XSS.
I look for security bugs and publish them once they are fixed.
One column per disclosure, oldest on the left.
51 disclosures 44 CVEs since 2026-03 latest 2026-10-26
- 8 critical
- 16 high
- 20 moderate
- 6 low
- 1 no score
Writeups
all writeupsAuditing OpenReception: 16 CVEs in an E2E encrypted booking platform
A white-box audit of the end-to-end encrypted booking platform OpenReception found 16 vulnerabilities, four of them critical.
Bypassing Zammad's AI text tool authorization via REST API (CVE-2026-34782 / CVE-2026-34837)
How missing authorization checks in Zammad's REST API let agents execute group-restricted AI text tools and inject unauthorized ticket context into AI prompts.
Recent disclosures
all 51
curl
cached CA store keeps CURLOPT_CAPATH certificates bound to a CURLOPT_SSLENGINE provider context freed with an earlier easy handle, letting a malicious server trigger a use-after-free during the next certificate verification
cBioPortal
unauthenticated /api/getexternalpage.json fetches any sourceURL without scheme or host checks, allowing SSRF and file:// reads of local files such as application.properties
Microsoft Office Outlook
heap-based buffer overflow lets an unauthenticated remote attacker execute code over the network, with the Preview Pane as an attack vector
Microsoft Office Outlook
stack-based buffer overflow lets an unauthenticated remote attacker execute code when a crafted email is shown in the Reading Pane, without the recipient opening it
Microsoft MPEG-2 Video Extension
heap-based buffer overflow lets a crafted video file execute code in the context of the user who opens it