Writeups

CVE-2026-87902. get_page_template include. VULN only on unique PEAR banner. Detect-only.

One-file lab scanner. Profile App/Pages/middleware. Matching RCE / SSRF class. Curl + report snippet. Host stripped.

Server 302 to a custom scheme carrying the access token. Chooser hijack. Vendor stripped.

CVE-2026-85706. Workhorse miss, Puma route, File.open before auth. Classifier only.

CVE-2026-26123. Authenticator emitted ms-msa:// and did not claim it.

CVE-2026-18963. Keycloak forgot-password. Unscoped selector plus unverified email action.

CVE-2026-82329. Self-hosted Artifactory trusted a blank join key. No mint kit.

Exported ContentProvider glued selection into the query. Bind args unused.

Loader mapped a file the extract path could overwrite. No payload DEX.

addJavascriptInterface on a WebView that later loaded an extra URL.

Mainline APEX store wins. User CA is a spectator. Observer only.

Static PIN client id, empty bot gate, unlink reset, emulator posture. Vendor stripped.

Exported router starts a nested Intent. Safer Intents not armed.

paths.xml mapped /. grantUriPermissions on. No file read here.

parseUri on a document URL, then startActivity.

Merged AAR activity. Host UID. Nested Intent sink.

Exported gate, no host allowlist, private AuthFlow on the other side.

adbd can trust a LAN peer too soon. Observer only. CVE-2026-0073.

Employee JWT with Admin role left in a dated dashboard bundle.

AndroScope defense module. Software PKCS12 vs AndroidKeyStore. No public bypass kit.

RN login put the password in the URL. Error SDK copied it.

Unverified OAuth redirect plus no code_challenge.

Rootless model, static engine, radar scoring, live-session rules.