https://pencore.app/blog Technical write-ups on vulnerabilities reported by the PenCore team, from the root cause to the fix. en Sat, 24 Oct 2026 00:00:00 GMT https://pencore.app/blog/cve-2026-78689-njs-exclusivec14n-off-by-one https://pencore.app/blog/cve-2026-78689-njs-exclusivec14n-off-by-one Sat, 24 Oct 2026 00:00:00 GMT Vulnerability research A heap buffer overflow in xml.exclusiveC14n(). The off-by-one in namespace prefix parsing, and how nginx-saml reaches it before verifying a signature. https://pencore.app/blog/cve-2026-78222-njs-fetch-statustext-null-deref https://pencore.app/blog/cve-2026-78222-njs-fetch-statustext-null-deref Sat, 24 Oct 2026 00:00:00 GMT Vulnerability research A NULL pointer dereference in ngx.fetch(). How an empty HTTP reason phrase leaves an invalid string in Response.statusText, and why reading it crashes the NGINX worker. https://pencore.app/blog/wazuh-cluster-read-to-root-rce https://pencore.app/blog/wazuh-cluster-read-to-root-rce Sat, 11 Jul 2026 00:00:00 GMT Vulnerability research A missing secret mask and an incomplete file-sync fix in Wazuh. How a read-only API user can obtain the cluster key and, with control of the master-to-worker connection, chain the bugs into root execution on workers. Fixed in 4.14.7.