VULNARY
Let's talk
cybersec

CVE Reconstruction

Weekly CVE deep dives. Real-world analysis. No fluff.

Jul 22, 2026 · 5 min EXPLOITABLE Sandbox Escape

CVE-2026-34430: The Regex That Thought It Understood a Shell

— The shell always parses last
Jul 17, 2026 · 6 min EXPLOITABLE Path Traversal

CVE-2026-33494: The Rule Read One Path, the Backend Served Another

— Canonicalize once, or forever suggest
Jul 15, 2026 · 5 min EXPLOITABLE Command Injection

CVE-2026-26830: The Quotes That Made It Worse

— Double quotes, double the danger
Jul 10, 2026 · 6 min EXPLOITABLE Type Juggling

CVE-2026-30849: When `0` Was a Valid Password

— The database said zero equals everything
Jul 8, 2026 · 6 min EXPLOITABLE Auth Bypass

CVE-2026-30836: The Message Type That Skipped the Bouncer

— Two lists, one door, no lock
Jul 3, 2026 · 7 min EXPLOITABLE Command Injection

CVE-2026-4163: Two Doors, One `system()` — Command Injection in Wavlink's wireless.cgi

— Two doors, one shell, zero patience
Jul 1, 2026 · 5 min EXPLOITABLE CI Pwn Request

CVE-2026-31852: The Pull Request That Checked Out Your Secrets

— Never check out what you cannot trust
Jun 26, 2026 · 6 min EXPLOITABLE Stored XSS

CVE-2026-30917: The Fallback That Forgot To Escape

— Faithful storage, unfaithful escaping
Jun 19, 2026 · 6 min EXPLOITABLE Token Disclosure

CVE-2026-24898: The Webhook That Handed Out Its Own Keys

— The diary was read aloud
Jun 18, 2026 · 6 min EXPLOITABLE Auth Bypass

CVE-2025-29927: The Header That Told the Bouncer to Take the Night Off

— The recursion guard guarded the wrong people
Jun 17, 2026 · 6 min EXPLOITABLE Missing Authentication

CVE-2026-20781: The Charger That Only Had To Say Its Own Name

— the station's name was the password
Jun 17, 2026 · 6 min EXPLOITABLE SSRF

CVE-2026-3958: The Webhook That Would Dial Anywhere

— Non-empty is not the same as allowed
Jun 16, 2026 · 5 min EXPLOITABLE Auth Bypass

CVE-2026-22207: When "No Key Configured" Meant "Everyone Is Root"

— Default deny, or default doom
Jun 15, 2026 · 6 min EXPLOITABLE Code Injection

CVE-2026-27702: When the View Builder Handed Your Filters Straight to `eval()`

— The generator was a confused deputy
Jun 12, 2026 · 6 min EXPLOITABLE SQL Injection

CVE-2026-26198: When MIN() Forgot to Ask Whether the Column Was Real

— Trust nothing that reaches text()
Jun 10, 2026 · 6 min EXPLOITABLE Command Injection

CVE-2026-2823: The NTP Field That Set the Clock and Spawned a Shell

— the clock struck root
Jun 7, 2026 · 6 min EXPLOITABLE Auth Bypass

CVE-2026-27174: The Redirect That Forgot to Be a Bouncer

— The redirect was a suggestion, not a wall
Jun 7, 2026 · 5 min EXPLOITABLE Stack Buffer Overflow

CVE-2026-2329: The 64-Byte Stack That Answered the Phone

— the phone picked up; root answered
Jun 5, 2026 · 6 min EXPLOITABLE Missing Authentication

CVE-2026-1670: The Recovery Email Nobody Was Guarding

— The advisory was honest; so am I
Jun 3, 2026 · 7 min EXPLOITABLE Use-After-Free

CVE-2026-45185: The BDAT Body That Survived Its Own TLS Session

— close_notify is a promise, not a suggestion
Jun 3, 2026 · 7 min UNKNOWN Off-by-One Overflow

CVE-2026-21870: When the Tokenizer Forgot About the Null Terminator

— One byte past the fence post
May 29, 2026 · 9 min EXPLOITABLE Unsandboxed RCE

CVE-2026-26009: When `installScript` Was Just a Polite Name for `bash -c`

— the sandbox was a strongly-worded comment
May 27, 2026 · 6 min EXPLOITABLE Code Injection

CVE-2026-1615: When "Static" Evaluation Wasn't That Static

— static-eval was never the sandbox you thought
May 25, 2026 · 7 min EXPLOITABLE Address Disclosure

CVE-2026-22778: cannot identify image file `<_io.BytesIO object at 0x7a95e299e750>`

— PIL snitched, ASLR cried, three bits remained
May 22, 2026 · 7 min EXPLOITABLE Command Injection

CVE-2026-1802: When `os.execute` Met an HTTP Form Value

— A debug flag is forever, apparently
May 20, 2026 · 6 min EXPLOITABLE Code Injection

CVE-2026-25141: When Your String Escaper Forgets It's Also a Comment Escaper

— Six characters is a complete language
May 20, 2026 · 7 min EXPLOITABLE Heap OOB Write

CVE-2026-31705: When the Padding Forgot to Ask

— The alignment ate the heap
May 19, 2026 · 8 min EXPLOITABLE Bounds-Check Inversion

CVE-2026-31635: When the Bounds Check Faced the Wrong Way

— one character, one workqueue, one panic
May 19, 2026 · 8 min EXPLOITABLE Block Device Confusion

CVE-2026-24054: The Bind-Mount That Convinced Kata to Hotplug Your Host Disk

— stat dot dev is not consent
May 16, 2026 · 30 min UNKNOWN kernel-disk-hook

Fast16: The Ghost in the Machine That Predated Stuxnet

— When mathematics lies, the real world breaks
May 16, 2026 · 13 min EXPLOITABLE trust-boundary

YellowKey and the BitLocker Zero-Days: What Just Got Disclosed

— When recovery becomes the attack vector
May 15, 2026 · 6 min EXPLOITABLE Confused Deputy

CVE-2026-22039: The Namespaced Policy That Wasn't

— the controller's token is not yours
May 15, 2026 · 6 min UNKNOWN Cross-Site Scripting

CVE-2026-42897: An Exchange XSS That Microsoft Calls "Spoofing"

— encoders are contextual, parsers are unforgiving
May 13, 2026 · 5 min EXPLOITABLE Missing Authorization

CVE-2026-20888: The Cancel Button That Forgot to Ask Who You Were

— Two doors, one lock, predictable consequences
May 6, 2026 · 5 min EXPLOITABLE SQL Injection

CVE-2026-22850: When Your Own Export File Comes Back As A Bomb

— stored data is still tainted data
Apr 29, 2026 · 6 min EXPLOITABLE Type Confusion

CVE-2026-21683: When the Tag Lied About What It Was

— Trust the vtable, not the file
Apr 25, 2026 · 6 min UNKNOWN Missing Authorization

CVE-2025-69359: The WordPress LMS That Forgot to Ask Who You Are

— Permission callbacks are not vibes
Apr 24, 2026 · 5 min EXPLOITABLE Stack Buffer Overflow

CVE-2026-0640: When sscanf Became gets() Again

— scanf is still gets, apparently
Apr 24, 2026 · 6 min EXPLOITABLE Algorithm Confusion

CVE-2026-5194: The Digest That Wasn't Big Enough

— half a check is half your security
Apr 24, 2026 · 6 min EXPLOITABLE Blind SQL Injection

CVE-2025-59379: The Login Page That Answered Questions It Shouldn't Have

— Parameterise the query, hash the password
Apr 24, 2026 · 6 min EXPLOITABLE Type Confusion

CVE-2026-21493: Type Confusion in iccDEV Curve Serializer — When a Type Tag Isn't a C++ Type

— Tag bytes aren't vtables, friend
Apr 23, 2026 · 5 min EXPLOITABLE URL Parsing (SSRF-adjacent)

CVE-2025-62718: The Trailing Dot That Leaked Your Localhost

— normalize before you compare, always