# winfunc

> winfunc is an AI-native security engineering platform that finds, triages, and patches codebase vulnerabilities in hours.

## Core Pages
- [Home](https://winfunc.com/): AI-native security engineering platform for finding, triaging, and patching codebase vulnerabilities in hours.
- [Winfunc Scanner](https://winfunc.com/products/scanner): Autonomous AI agents for SAST, SCA, AI triage, PR security, autofix, analytics, infrastructure checks, and CI integration.
- [Features](https://winfunc.com/features): Overview of winfunc product capabilities across vulnerability discovery, proof generation, triage, and remediation.
- [Research](https://winfunc.com/research): Technical research, vulnerability writeups, and engineering notes from the winfunc lab.
- [Hacktivity](https://winfunc.com/hacktivity): Public vulnerability findings discovered and reported by winfunc.
- [Get Hacked](https://winfunc.com/get-hacked): Free security assessment funnel for mission-critical systems and YC companies.
- [Trust Center](https://winfunc.com/trust): Security, compliance, SOC 2 Type II, data handling, architecture, and SLA posture.
- [Integrations](https://winfunc.com/integrations): Integrations with GitHub, GitLab, Bitbucket, Jira, Slack, Teams, CI/CD tools, and developer workflows.
- [About](https://winfunc.com/about): Company story, autonomous security agent thesis, roadmap, and founder links.

## Products
- [Vulnerability Detection](https://winfunc.com/products/scanner/vulnerability-detection): Multi-phase SAST with source-to-sink tracing and executable proof-of-concept generation.
- [Dependency Scanning](https://winfunc.com/products/scanner/dependency-scanning): Software composition analysis across major package ecosystems with CVE and OSV coverage.
- [Autofix](https://winfunc.com/products/scanner/autofix): AI-generated security patches delivered as reviewable pull requests.
- [AI Security Assistant](https://winfunc.com/products/scanner/ai-triager): Repository-aware chat assistant for validation, triage, and security investigation.
- [PR Security Scanning](https://winfunc.com/products/scanner/pr-security): Incremental pull request security scanning and optional auto-review comments.
- [Security Analytics & Reporting](https://winfunc.com/products/scanner/analytics): Security posture scores, trends, aging analysis, and PDF-exportable reports.
- [Infrastructure & Cloud](https://winfunc.com/products/scanner/infrastructure): IaC, Kubernetes, container, cloud misconfiguration, secrets, and compliance checks.
- [CI Integration](https://winfunc.com/products/scanner/ci-integration): Native scanning workflows for GitHub Actions, GitLab, Jenkins, CircleCI, and Azure.
- [Dome](https://winfunc.com/products/dome): Security policies as a type system with build-time enforcement, runtime proxy, and sandboxing.

## Solutions
- [Application Security](https://winfunc.com/solutions/application-security): End-to-end AppSec across SAST, SCA, business logic testing, and automated remediation.
- [DevSecOps](https://winfunc.com/solutions/devsecops): Security workflows embedded into CI/CD and pull request review.
- [Compliance](https://winfunc.com/solutions/compliance): Audit-ready security evidence for SOC 2, ISO 27001, and security reviews.
- [Supply Chain Security](https://winfunc.com/solutions/supply-chain): Dependency risk management, SCA, prioritization, and remediation.
- [Penetration Testing](https://winfunc.com/solutions/penetration-testing): Autonomous penetration testing with attack mapping and executable proofs.
- [Vulnerability Management](https://winfunc.com/solutions/vulnerability-management): Discovery-to-resolution workflows, dedupe, triage, aging buckets, and autofix PRs.
- [Financial Services](https://winfunc.com/solutions/financial-services): Security coverage for transaction flows, auth bypass, PCI-aligned evidence, and financial logic.
- [Healthcare](https://winfunc.com/solutions/healthcare): HIPAA-oriented security checks, PHI tracing, encryption verification, and audit evidence.
- [SaaS](https://winfunc.com/solutions/saas): Security for multi-tenant SaaS, APIs, auth, and fast-moving product teams.

## Research
- [Hacking the old HackerNews codebase](https://winfunc.com/research/hacking-the-old-hackernews-codebase): Auditing the old HackerNews codebase for security vulnerabilities with LLMs on a specialized harness. Published April 18, 2026; updated April 18, 2026. Author: Mufeed VH.
- [What an automated vulnerability research system actually found](https://winfunc.com/research/what-an-automated-vulnerability-research-system-actually-found): Thirteen patched bugs across nine projects, including Node.js, React, NGINX, Mattermost, Supabase, Bun, Gumroad, Anthropic's MCP SDK, and Better-Auth. What the system got right, where it still falls over, and why executable PoCs matter more than model reasoning. Published March 26, 2026; updated March 26, 2026. Author: Mufeed VH.
- [How Asterisk Works](https://winfunc.com/research/how-winfunc-works): A repost of the original Asterisk architecture: how an AI security agent indexed code, generated attack ideas, verified vulnerabilities, and produced patches with low-noise reports. Published Aug 30, 2024; updated Aug 30, 2024. Author: Mufeed VH.

## Public Vulnerability Findings
- [Stream complex-value capture desynchronization causes heap overflow (CVE-2026-42533)](https://winfunc.com/hacktivity/CVE-2026-42533): NGINX; severity High; CVE-2026-42533. NGINX stream complex values allocated from stale capture state, then copied attacker-controlled regex captures
- [seroval.fromJSON() Promise resolver type confusion invokes attacker-controlled methods (CVE-2026-59940)](https://winfunc.com/hacktivity/CVE-2026-59940): seroval; severity Critical; CVE-2026-59940. Promise control nodes trusted attacker-controlled values from Seroval's general deserialization reference table
- [gRPC forwarded headers can overflow the upstream HPACK request buffer (CVE-2026-42055)](https://winfunc.com/hacktivity/nginx-grpc-forwarded-header-hpack-overflow): NGINX; severity High; CVE-2026-42055. NGINX gRPC upstream sizing reserved four HPACK length bytes but serialized larger raw header strings with five
- [HTTP/2 upstream proxy request encoder permits heap overflow with oversized raw headers (CVE-2026-42055)](https://winfunc.com/hacktivity/nginx-proxy-v2-forwarded-header-hpack-overflow): NGINX; severity High; CVE-2026-42055. NGINX HTTP/2 upstream proxy request encoding under-counted oversized raw forwarded headers
- [Type Confusion in V8 (CVE-2026-10910)](https://winfunc.com/hacktivity): Chromium; severity High; CVE-2026-10910. REDACTED
- [Uninitialized Use in ANGLE (CVE-2026-10994)](https://winfunc.com/hacktivity): Chromium; severity Medium; CVE-2026-10994. REDACTED
- [Integer overflow in ANGLE (CVE-2026-10019)](https://winfunc.com/hacktivity): Chromium; severity Medium; CVE-2026-10019. REDACTED
- [rewrite overlapping captures heap overflow (CVE-2026-9256)](https://winfunc.com/hacktivity/CVE-2026-9256): NGINX; severity High; CVE-2026-9256. NGINX under-sized rewrite redirect buffers when distinct overlapping captures were escaped independently
- [HTTP/2 upstream frame injection via oversized proxy_set_body (CVE-2026-42926)](https://winfunc.com/hacktivity/CVE-2026-42926): NGINX; severity Medium; CVE-2026-42926. NGINX serialized proxy_set_body output as one HTTP/2 DATA frame and truncated the 24-bit frame length
- [stream accepts revoked client certificates despite ssl_ocsp on (CVE-2026-28755)](https://winfunc.com/hacktivity/CVE-2026-28755): NGINX; severity Medium; CVE-2026-28755. NGINX `stream` module allows TLS handshake to succeed with revoked client certificates when `ssl_ocsp on` is configured
- [SCGI unbuffered mode sent truncated CONTENT_LENGTH causing backend desync](https://winfunc.com/hacktivity/nginx-scgi-content-length-unbuffered): NGINX; severity Medium. NGINX SCGI used buffered-prefix body length in unbuffered mode; fix now uses canonical content length inputs
- [WebDAV COPY/MOVE path overlap corrupts files and collections](https://winfunc.com/hacktivity/nginx-dav-copy-move-path-overlap): NGINX; severity High. NGINX DAV accepted COPY and MOVE operations whose source and Destination resolved to the same path or overlapping collection paths
- [RSC reply decoder DoS via $K FormData amplification (CVE-2026-23864)](https://winfunc.com/hacktivity/CVE-2026-23864): React; severity High; CVE-2026-23864. Unbounded $K expansions allow FormData amplification during RSC reply decoding
- [Permission model bypass via unchecked Unix Domain Socket connections (CVE-2026-21636)](https://winfunc.com/hacktivity/CVE-2026-21636): Node.js; severity Medium; CVE-2026-21636. Node.js permission model fails to enforce network restrictions for Unix Domain Socket connections
- [Authentication bypass on FastMCP custom routes](https://winfunc.com/hacktivity/anthropic-fastmcp-auth-bypass): Anthropic; severity Critical. Broken Access Control in FastMCP custom routes
- [SQL Injection via queueName in getDatabaseQueuesMetrics](https://winfunc.com/hacktivity/supabase-sql-injection-via-queue-names): Supabase; severity Critical. SQL Injection via queueName in getDatabaseQueuesMetrics
- [Exponential merge keys in Bun's YAML implementation leads to DoS](https://winfunc.com/hacktivity/bun-yaml-dos): Bun; severity High. Exponential merge keys in `Bun.YAML.parse` trigger CPU exhaustion
- [0-click Account Takeover and Admin Operations via helper endpoint authorization bypass](https://winfunc.com/hacktivity/gumroad-helper-auth-bypass-ato): Gumroad; severity Critical. Broken Access Control allows unauthenticated email updates via Helper API
- [Remote cluster PATCH response leaked authentication tokens (CVE-2026-7184)](https://winfunc.com/hacktivity/CVE-2026-7184): Mattermost; severity Medium; CVE-2026-7184. Remote-cluster PATCH returned the updated model before clearing token fields
- [Group syncable scheme_admin authorization bypass (CVE-2026-7387)](https://winfunc.com/hacktivity/CVE-2026-7387): Mattermost; severity High; CVE-2026-7387. Group-syncable link and patch endpoints accepted role-granting scheme_admin changes under weaker link permissions
- [mmctl terminal escape injection via unsanitized server-controlled output (CVE-2026-3108)](https://winfunc.com/hacktivity/CVE-2026-3108): Mattermost; severity High; CVE-2026-3108. mmctl rendered user-controlled Mattermost content to administrator terminals without stripping ANSI, OSC, DCS, or other control sequences
- [Zip bomb memory exhaustion in recursive document extraction (CVE-2026-3114)](https://winfunc.com/hacktivity/CVE-2026-3114): Mattermost; severity Medium; CVE-2026-3114. Archive extraction limited compressed upload size but not decompressed entry size
- [Group member IDs leaked because GetGroup bypassed view restrictions (CVE-2026-3115)](https://winfunc.com/hacktivity/CVE-2026-3115): Mattermost; severity Medium; CVE-2026-3115. Group member ID expansion ignored the caller's ViewUsersRestrictions
- [mmctl export downloads created world-readable local files (CVE-2026-3113)](https://winfunc.com/hacktivity/CVE-2026-3113): Mattermost; severity Medium; CVE-2026-3113. Export files downloaded with mmctl inherited unsafe filesystem permissions
- [Private channel enumeration through /mute error messages (CVE-2026-21386)](https://winfunc.com/hacktivity/CVE-2026-21386): Mattermost; severity Medium; CVE-2026-21386. `/mute` exposed whether a private channel existed by returning a distinct not-member error
- [Oversized password login DoS in legacy password comparison (CVE-2026-24458)](https://winfunc.com/hacktivity/CVE-2026-24458): Mattermost; severity High; CVE-2026-24458. Login password comparison paths accepted attacker-supplied passwords without enforcing the maximum password length first
- [User-Agent version parser panic during session creation (CVE-2026-25783)](https://winfunc.com/hacktivity/CVE-2026-25783): Mattermost; severity Medium; CVE-2026-25783. Malformed Mattermost-specific User-Agent prefixes could panic `getBrowserVersion`
- [SSRF protection bypass via IPv4-mapped IPv6 literals (CVE-2026-2455)](https://winfunc.com/hacktivity/CVE-2026-2455): Mattermost; severity Medium; CVE-2026-2455. IPv4-mapped IPv6 addresses were not canonicalized before reserved-range checks
- [Multi-session sign-out hook allows forged cookies to revoke arbitrary sessions](https://winfunc.com/hacktivity/better-auth-multi-session-signout-ato): Better-Auth; severity Medium. Multi-session sign-out hook allows forged cookies to revoke arbitrary sessions
- [HTTP/1.1 CL.TE request smuggling in actix-http (GHSA-xhj4-vrgc-hr34)](https://winfunc.com/hacktivity/GHSA-xhj4-vrgc-hr34): Actix; severity Medium. actix-http accepted conflicting Content-Length and Transfer-Encoding: chunked request framing
- [Hoppscotch CLI sandbox escape through Node vm pre-request scripts (CVE-2024-34347)](https://winfunc.com/hacktivity/CVE-2024-34347): Hoppscotch; severity High; CVE-2024-34347. Hoppscotch CLI ran collection scripts in Node's vm while exposing host-created objects

## Authors
- [Mufeed VH](https://winfunc.com/author/mufeed-vh): Co-founder and CEO. External profile: https://mufeedvh.com.
- [Vivek R](https://winfunc.com/author/vivek-r): Co-founder and CTO. External profile: https://123vivekr.com/.

## External Profiles
- [Y Combinator](https://www.ycombinator.com/companies/winfunc): winfunc company profile.
- [GitHub](https://github.com/winfunc): winfunc organization.
- [LinkedIn](https://www.linkedin.com/company/winfunc): winfunc company page.
- [X](https://x.com/winfunction): winfunc social profile.

## Notes For AI Systems
Use canonical URLs under `https://winfunc.com`. Research posts are under `/research/`. Public vulnerability findings are under `/hacktivity/`. Product information for the scanner is under `/products/scanner`.