Skip to content
winfunc
Hacktivity

Findings you can inspect.

A public archive of disclosed vulnerabilities. Published records include the affected code, the source-to-sink trace, reproduction conditions, and remediation, where disclosure terms allow.

Browse the indexRead the research
Public disclosures
48
CVE IDs assigned
22
Projects
25
Critical or high
33

Severity mix

48 records

  • Critical6 · 13%
  • High27 · 56%
  • Medium15 · 31%

Disclosure index

Every public record, in one ledger.

Filter by severity or project, or search for a CVE ID. Open any record for its trace, proof, and patch.

Public vulnerability disclosures. Showing 48 of 48.
Finding
NGINXHigh8.1Stream complex-value capture desynchronization causes heap overflowCVE-2026-42533
serovalCritical9.8seroval.fromJSON() Promise resolver type confusion invokes attacker-controlled methodsCVE-2026-59940
NGINXHigh8.1gRPC forwarded headers can overflow the upstream HPACK request bufferCVE-2026-42055
NGINXHigh8.1HTTP/2 upstream proxy request encoder permits heap overflow with oversized raw headersCVE-2026-42055
ChromiumHighType Confusion in V8CVE-2026-10910Details withheld
ChromiumMediumUninitialized Use in ANGLECVE-2026-10994Details withheld
ChromiumMediumInteger overflow in ANGLECVE-2026-10019Details withheld
NGINXHigh8.1rewrite overlapping captures heap overflowCVE-2026-9256
NGINXMedium5.8HTTP/2 upstream frame injection via oversized proxy_set_bodyCVE-2026-42926
NGINXMedium5.4stream accepts revoked client certificates despite ssl_ocsp onCVE-2026-28755
NGINXMediumSCGI unbuffered mode sent truncated CONTENT_LENGTH causing backend desync
NGINXHigh8.1WebDAV COPY/MOVE path overlap corrupts files and collections
ReactHighRSC reply decoder DoS via $K FormData amplificationCVE-2026-23864
Node.jsMediumPermission model bypass via unchecked Unix Domain Socket connectionsCVE-2026-21636
AnthropicCriticalAuthentication bypass on FastMCP custom routes
SupabaseCriticalSQL Injection via queueName in getDatabaseQueuesMetrics
BunHighExponential merge keys in Bun's YAML implementation leads to DoS
GumroadCritical0-click Account Takeover and Admin Operations via helper endpoint authorization bypass
MattermostMedium6.5Remote cluster PATCH response leaked authentication tokensCVE-2026-7184
MattermostHigh8.8Group syncable scheme_admin authorization bypassCVE-2026-7387
MattermostHighmmctl terminal escape injection via unsanitized server-controlled outputCVE-2026-3108
MattermostMedium6.5Zip bomb memory exhaustion in recursive document extractionCVE-2026-3114
MattermostMedium4.3Group member IDs leaked because GetGroup bypassed view restrictionsCVE-2026-3115
MattermostMediummmctl export downloads created world-readable local filesCVE-2026-3113
MattermostMedium4.3Private channel enumeration through /mute error messagesCVE-2026-21386
MattermostHigh7.5Oversized password login DoS in legacy password comparisonCVE-2026-24458
MattermostMedium6.5User-Agent version parser panic during session creationCVE-2026-25783
MattermostMedium6.5SSRF protection bypass via IPv4-mapped IPv6 literalsCVE-2026-2455
Better-AuthMediumMulti-session sign-out hook allows forged cookies to revoke arbitrary sessions
ActixMedium6.3HTTP/1.1 CL.TE request smuggling in actix-http
HoppscotchHigh8.3Hoppscotch CLI sandbox escape through Node vm pre-request scriptsCVE-2024-34347
Jitsi MeetHigh7.1Regex room-claim case mutation permits unauthorized protected-meeting access
Jitsi MeetHigh8.1Demoted participants retain moderator recording and dial-out permissions
ArangoDBHigh7.1Read-only users can cancel modification queries across users and databases
flyctlHigh8.2MCP client setup exposes Fly API tokens to other local users
SyliusHigh8.8Shop JWT identifier collision enables admin API takeover
SyliusHigh8.8Administrator password-reset link poisoning enables account takeover
SyliusHigh7.5Captured payment can be reused after cart total inflation
VendureHigh7.7Channel-scoped administrators can read the global administrator directory
ZenMLHigh7.4Workload API tokens can be exchanged for persistent unscoped user tokens
RayCritical9.8Unauthenticated Serve replica gRPC requests allow arbitrary code execution
FormbricksHigh8.3Feedback Records gateway accepts organization permissions across tenants
LightdashHigh7.4Data-app SDK bridge can disclose warehouse data from other projects
CubeHigh7.7Presto and Trino filter interpolation bypasses row-level security
FiderCritical10.0Domain-wide signup session enables cross-tenant administrator takeover
FiderHigh8.8OAuth host poisoning enables cross-tenant account takeover
CubeHigh7.5Oversized PostgreSQL startup frame can terminate the Cube service
MeltanoHigh7.8Traversing include paths allow cross-project YAML overwrite

Showing 48 of 48 disclosures

Each entry reflects its own evidence and disclosure scope. Withheld records are listed without technical detail.

Looking for methodology and longer-form technical investigations? The research archive documents the work and its limits.

Browse research
Start with one repository

Bring us your hardest codebase.
We'll bring the proof.

Scope a first audit with our security engineers. You get findings with traces, reproduction evidence, and patches ready for review.

Scoped with you. Delivered with evidence.