2026

  • bypassing pairip with manual modification

    bypassing java-side pairip checks in a modded android app by removing manifest-registered components, rebuilding, and signing again

    b b4r
    June 17, 2026
    3 min read
    android mobile modding reverse engineering

  • an event media authz bug in zoneminder

    cve-2026-54258 let low-privileged zoneminder users fetch private event media from monitors they were not allowed to access

    b b4r
    June 13, 2026
    3 min read
    vulnerability cve web exploitation authorization

  • a second-order ddns authz bug in nezha

    cve-2026-53521 let a stored future ddns profile id turn into another user ddns profile context later in nezha

    b b4r
    June 10, 2026
    3 min read
    vulnerability cve web exploitation authorization