2026

  • a neat little cve in filament

    cve-2026-48067 came from a scope mismatch in filament AttachAction and AssociateAction

    b b4r
    May 25, 2026
    3 min read
    vulnerability cve web exploitation laravel

  • cross-tenant credential disclosure in itflow

    cve-2026-47755 let a low-privileged authenticated user pull another client credentials and totp secrets in itflow

    b b4r
    May 25, 2026
    3 min read
    vulnerability cve web exploitation idor

  • six cves in one open-source e-commerce project

    how i reported six shopper cves spanning authorization bypass, privilege escalation, race conditions, idor, and xss

    b b4r
    May 22, 2026
    5 min read
    vulnerability advisory cve web exploitation laravel