We secure the software the world runs on
Latest research
Recent publications.
-
-
IonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years
-
Longinus: 2 Boundaries in One Bug, Piercing Chrome’s Renderer and V8 Sandbox with a Single Vulnerability, CVE-2026-6307
-
How an Omitted Write Barrier in V8 Turns Into RCE in Chrome: CVE-2026-5865
-
From a Netfilter Bug to kernelCTF: Exploiting CVE-2026-23274 in the Linux Kernel and winning a $10500 Bounty
Found by Vega
0
Linux kernel bugs
0
Chrome zero-days
0
CVEs assigned
$0K+
in bug bounties earned
Buglist
The vulnerability list.
A continuously-updated catalog of every bug we've found and reported — 1162 entries and counting.
Recent entries
Showing 5 of 1162
- 02 Chrome Maglev: incorrect phi untagging can lead to exploitable write barrier omission CVE-2026-5865
- 03 Linux kernel `idletimer_tg_checkentry()` (revision 0 path) reuses existing timers by label without validating `timer_type`, and unconditionally calls `mod_timer(&info->timer->timer, ...)`. In `idletimer_tg_create_v1()`, when `timer_type` is `XT_IDLETIMER_ALARM`, only `alarm_init()` is done and `timer_setup()` is never called for `info->timer->timer`. This allows mixing a rev1 ALARM rule and a rev0 rule with the same label, causing rev0 code paths (`idletimer_tg_checkentry()`, `idletimer_tg_target()`, and potentially `idletimer_tg_destroy()`) to operate on an uninitialized `timer_list`, which can corrupt timer internals (memory corruption) and may be exploitable from CAP_NET_ADMIN context. CVE-2026-23274
- 04 Linux kernel `rxkad_decrypt_ticket()` never checks the return value of `crypto_skcipher_decrypt()`. `rxkad_verify_response()` only constrains `ticket_len` to 4..1024, so a non-block-aligned ticket can make decryption fail while the function continues parsing attacker-controlled bytes as if they were a plaintext ticket and session key. An attacker can then craft the RESPONSE body around that chosen session key and bypass the server secret. CVE-2026-31637
- 05 CPython Remote OOB write → potential remote code execution CVE-2026-3298