section // research
/research

Vulnerability research

Root-cause and patch analyses of published CVEs. Each casefile states its evidence level and sources.

6 analyses6 CVEs
Research archive

Casefiles

6 author credited · 0 independent
Filter casefiles
Showing 6 casefiles
CVE-2026-125330★ Author Discovery
HarnessRouter · harnessrouterWeb · CWE-639
Root Cause AnalysisLab Reproduced · High0.31.7
CVE-2026-112950★ Author Discovery
Vitest · @vitest/mockerWindows · CWE-22
Patch AnalysisLab Reproduced · High@vitest/mocker 4.1.12, 5.0.3
CVE-2026-107716★ Author Discovery
masci · banks (PyPI)Linux · CWE-59 · CWE-22
Patch AnalysisLab Reproduced · High2.5.1
CVE-2026-102994★ Author Discovery
py-pdf · pypdf (PyPI)Linux · CWE-400 · CWE-407
Patch AnalysisLab Reproduced · High6.18.0
CVE-2026-91117★ Author Discovery
Archmonger · ServeStaticWeb · CWE-20 · CWE-248
Root Cause AnalysisLab Reproduced · High>= 4.3.4 (GHSA-q353-2cxp-ppfh)
CVE-2026-87772★ Author Discovery
Pardus · pardus-aboutLinux · CWE-863 · CWE-266
Patch AnalysisLab Reproduced · High>= 1.2.5 (debian/1.2.5, commit b439777)
Part 01 · Original Discoveries

Author-Discovered Vulnerabilities

Original security research and coordinated vulnerability disclosures credited to Sevban Dönmez.

★ Discovered by AuthorCVE-2026-125330
17 min read

CVE-2026-125330: Cross-Workspace Session Access with a HarnessRouter Workspace Key

Root-cause analysis of CVE-2026-125330: HarnessRouter narrowed the session list to an API key's workspace, but the routes that take a session or response id checked only the organization. A workspace key that knew another workspace's session id could read, overwrite, publish and delete that session. Fixed in 0.31.7.

Product
HarnessRouter · harnessrouter
Evidence
Lab Reproduced
Fixed in
0.31.7
Nov 10, 2026Open discovery casefile
★ Discovered by AuthorCVE-2026-112950
10 min read

CVE-2026-112950: Windows Backslash Traversal in @vitest/mocker

Root-cause analysis of CVE-2026-112950: on Windows, a redirect mock path containing a backslash passes the Vite allowlist check added by the first fix and then reads a file outside the project root.

Product
Vitest · @vitest/mocker
Evidence
Lab Reproduced
Fixed in
@vitest/mocker 4.1.12, 5.0.3
Oct 20, 2026Open discovery casefile
★ Discovered by AuthorCVE-2026-107716
10 min read

CVE-2026-107716: Symlink Traversal in banks Prompt Registry

Root-cause analysis of CVE-2026-107716: DirectoryPromptRegistry in banks followed symbolic links out of its prompt directory, so a link could make it read an arbitrary file through _scan() and get(), or overwrite one through set() and index.json.

Product
masci · banks (PyPI)
Evidence
Lab Reproduced
Fixed in
2.5.1
Oct 8, 2026Open discovery casefile
★ Discovered by AuthorCVE-2026-102994
11 min read

CVE-2026-102994: Unbounded Token Scanning and CPU Exhaustion in pypdf

Root-cause analysis of CVE-2026-102994: before pypdf 6.18.0, a PDF with a very long object number and no whitespace made the parser read the token to its end with no limit, which can tie up a worker for a long time.

Product
py-pdf · pypdf (PyPI)
Evidence
Lab Reproduced
Fixed in
6.18.0
Sep 30, 2026Open discovery casefile
★ Discovered by AuthorCVE-2026-91117
9 min read

CVE-2026-91117: Uncaught ValueError on a NUL Byte in ServeStatic

Why a NUL byte that survives ServeStatic's path normalization makes its containment check raise an uncaught ValueError, so the request returns a 500 and, with Django DEBUG enabled, the technical error page.

Product
Archmonger · ServeStatic
Evidence
Lab Reproduced
Fixed in
>= 4.3.4 (GHSA-q353-2cxp-ppfh)
Sep 24, 2026Open discovery casefile
★ Discovered by AuthorCVE-2026-87772
14 min read

CVE-2026-87772: Root Escalation Through the Pardus About Mount Helper

Root-cause analysis of CVE-2026-87772: Pardus About's passwordless Polkit action started a root helper that mounted attached disks with defaults,ro, so a setuid binary on a disk gave a local user root. Fixed in 1.2.5.

Product
Pardus · pardus-about
Evidence
Lab Reproduced
Fixed in
>= 1.2.5 (debian/1.2.5, commit b439777)
Sep 16, 2026Open discovery casefile
Coordinated Vulnerability Disclosures

Author Disclosure Catalog (10 CVEs)

Formal vulnerability advisories discovered and reported by Sevban Dönmez across Linux distributions, open-source web servers, and identity systems.

View All Disclosed CVEs