Technical write-ups on vulnerabilities reported by our team. How they work, what they affect, and how they were fixed.
CVE-2026-78689
10 min read
A heap buffer overflow in xml.exclusiveC14n(). The off-by-one in namespace prefix parsing, and how nginx-saml reaches it before verifying a signature.
Read article
CVE-2026-78222
9 min read
A NULL pointer dereference in ngx.fetch(). How an empty HTTP reason phrase leaves an invalid string in Response.statusText, and why reading it crashes the NGINX worker.
Read article
CVE-2026-61802 + CVE-2026-61800
11 min read
A missing secret mask and an incomplete file-sync fix in Wazuh. How a read-only API user can obtain the cluster key and, with control of the master-to-worker connection, chain the bugs into root execution on workers. Fixed in 4.14.7.
Read article