Security Research

Disclosures

Independent security research across widely used open-source and AI systems, validated through CVEs, vendor advisories, bounties, and upstream fixes.

7 CVEs9 organizations8 case studies1 bounty

Only public or vendor-approved details are shown. CVEs retain vendor-assigned severity; other reports foreground validation, credit, and outcome.

CVEs

Published vulnerabilities with assigned CVE identifiers.

DateVendorFindingSeverityOutcome

Jul 2026Home AssistantStored XSS in Shelly media playerLowFixedCVE-2026-64823

Credited reports, bounties, public issues, and upstream fixes.

DateVendorFindingValidation / outcome

Jul 2026OpenAIAzure API key forwarded across redirectsPublic reportAwaiting triageissue #3516

Jul 2026OpenAILocal user could hijack Codex IPCPublic reportAwaiting triageissue #521

Jul 2026TailscaleHandshake race could crash the DERP relayPublic reportFixed upstreamissue #20352

Jun 2026AnthropicCredential disclosureBounty awardedFix pendingfix pending

May 2026HashiCorp VaultACME race issued duplicate certificatesPatch submittedClosed, not mergedPR #32004

May 2026Apache AirflowHive stats operator interpolated SQL valuesFix requested after security reviewPR openPR #66751

May 2026OpenAIGitHub Actions RCEBugcrowd validatedTriaged P3—

Newest first→ opens a case study↗ opens external evidence