Security research. Custom tooling, machine scale, hand validation.

Verifiable in GitHub's advisory database — all · critical · high

Severity as published in each advisory. February 2026 to present. Two further advisories are pending credit correction (CVE-2026-5366, CVE-2026-42048) and are not counted above.

Coinbase · Netflix · AWS · NVIDIA · Bitcoin Core · Google · Swiss Post · Binance · Fireblocks · OpenSea · Pinterest · Cosmos

CVE-2026-34976 — Dgraph, 10.0. restoreTenant was absent from the middleware config map while its neighbour restore had full coverage, so it ran with no authentication, no IP allowlist and no audit logging. Chained to database overwrite, SSRF and file read pre-auth. The proofs needed no credentials: anonymous S3 flags, file:// probing that enumerated the filesystem through error differences, and Vault parameters reaching the Kubernetes service account token. The fix was one line.

CVE-2026-41050 — Rancher Fleet, 9.9. Two Helm execution paths kept cluster-admin credentials during impersonated operations: the lookup template function, and valuesFrom secret references read through the same client. Patched across five Rancher trains.

CVE-2026-41520 — Cilium, 7.9. cilium-bugtool and sysdump archives carried the WireGuard node key out of the cluster. The key is static and never rotates, so an archived support bundle decrypts node traffic and permits node impersonation until someone rotates it by hand.

ICS23 — Cosmos. The Rust verifier skipped MaxDepth enforcement whenever min_depth was zero, which is the case for both TendermintSpec and SmtSpec, so Go and Rust disagreed on the same proof bytes. A prior professional audit had found the same class and its remediation shipped Go-only — git show 1363533 -- rust/src/verify.rs produces an empty diff. The released Rust crate still carried it.

Fireblocks MPC. Schnorr and Diffie-Hellman-Log verifiers accepted trivial zero proofs for the identity point, so a party could contribute nothing to a key and still pass proof-of-knowledge. Separately, leaked prf state allowed reversal of proactive key refresh, defeating the guarantee that compromising two cosigners in different epochs is not enough.

CVE-2026-41263 — Traefik had already shipped a fix for a BasicAuth timing side-channel. The patch looked up a bcrypt hash as if it were a username, so the constant-time fallback secret was always empty and password checks failed in microseconds instead of running bcrypt. The reported path was closed. The class was not. Measured at a 130x timing ratio against the shipped binary.

Press: GBHackers · Cybersecurity News on the Dgraph 10.0.

Severity as published in each advisory. Machine-readable: advisories.csv

kodareef5@gmail.com · @kodareef5