2026

  • two wallos cves from the same trust mistake

    cve-2026-50198 and cve-2026-50199 in wallos both came from cross-user references being accepted first and trusted later

    b b4r
    June 5, 2026
    4 min read
    vulnerability cve web exploitation

  • a neat little cve in filament

    cve-2026-48067 came from a scope mismatch in filament AttachAction and AssociateAction

    b b4r
    May 25, 2026
    2 min read
    vulnerability cve web exploitation laravel

  • cross-tenant credential disclosure in itflow

    cve-2026-47755 let a low-privileged authenticated user pull another client credentials and totp secrets in itflow

    b b4r
    May 25, 2026
    2 min read
    vulnerability cve web exploitation idor