BomboBombone.exe
ARCHITECTURE:x86-64

Published research posts

BACK
.DATAALL POSTS
35 posts
ADDRESS SIZE POST
0000000000430000 1389 B CVE-2026-100380: Reflected XSS in Wikibase SetLabel errors — open post
0000000000430600 1752 B CVE-2026-100381: DOM XSS in UploadWizard Flickr titles — open post
0000000000436000 1541 B CVE-2026-102971: REST compatibility exposed hidden revision authors — open post
000000000042B000 1492 B CVE-2026-102973: API email sending skipped an authorization hook — open post
000000000042B600 1645 B CVE-2026-102975: RevisionDelete API could remove suppression without the required right — open post
0000000000430D00 1253 B CVE-2026-103437: XSS through imported ReadingLists links — open post
0000000000421900 1299 B CVE-2026-103440: PageTriage exposed suppressed reviewer usernames — open post
0000000000421F00 1531 B CVE-2026-103441: Wikibase deserialization enabled file deletion and RCE — open post
0000000000422500 1530 B CVE-2026-103442: CentralAuth object injection and RCE — open post
0000000000431200 1158 B CVE-2026-103445: Stored XSS in PageForms auto-edit links — open post
000000000042BD00 1613 B CVE-2026-103446: Anonymous WikiLambda fragment execution — open post
0000000000431700 1421 B CVE-2026-103584: Unsafe license URLs in CommonsMetadata — open post
0000000000431D00 1401 B CVE-2026-103585: Stored XSS in MediaSearch QuickView — open post
0000000000428000 1888 B CVE-2026-73309: Empty OAuth2 credentials bypass — open post
0000000000428800 1679 B CVE-2026-73310: OAuth2 redirect URI mismatch — open post
0000000000428F00 1597 B CVE-2026-73311: OAuth2 authorization code replay — open post
0000000000429600 1592 B CVE-2026-73312: Refresh token replay after access-token expiry — open post
000000000042A000 1539 B CVE-2026-73313: Passkey accepted for the wrong account — open post
000000000042E000 1758 B CVE-2026-73314: PayPal signature check bypass — open post
000000000042F000 1503 B CVE-2026-73315: PayPal certificate URL SSRF — open post
000000000042E700 1562 B CVE-2026-73316: PayPal webhook replay — open post
000000000042C400 1905 B CVE-2026-73317: ACP rebuild authorization bypass — open post
000000000042CC00 1687 B CVE-2026-73318: Missing permission checks on agreement resets — open post
0000000000432300 1670 B CVE-2026-73319: JavaScript URI in dynamic redirects — open post
0000000000436700 1632 B CVE-2026-73320: Unauthenticated unfurl result disclosure — open post
0000000000437000 1690 B CVE-2026-73321: Stack overflow in BBCode parsing — open post
0000000000427000 1702 B CVE-2026-74239: Windows path traversal in style imports — open post
000000000042D300 1701 B CVE-2026-96872: WikiLambda nested Z825 bypassed the unsaved-code check — open post
0000000000432A00 1575 B CVE-2026-96873: Reflected XSS in CirrusSearch explain output — open post
0000000000433100 1539 B CVE-2026-96874: Stored XSS in Cargo Drilldown tab names — open post
0000000000433800 1535 B CVE-2026-96875: Reflected XSS in Cargo Drilldown hierarchy filters — open post
0000000000433E00 1511 B CVE-2026-96876: Anonymous reflected XSS in CargoExport errors — open post
0000000000434400 1554 B CVE-2026-96877: Reflected XSS in Cargo Drilldown full-text search — open post
0000000000434B00 1563 B CVE-2026-96878: Stored XSS through Cargo Exhibit field aliases — open post
0000000000422B00 8775 B Using AI to audit OSS, part 1: 14 CVEs — open post

Resize column

Choose a width with the slider or the narrower and wider buttons.