dxleryt
Security Researcher @ RaptX & CTF Player
12 CVE · BC 5 · HoF 2 · HTB #1 Jordan · FlagYard #1 Jordan
CVE-2026-26213: thingino-firmware Unauthenticated Command Injection in Captive Portal
CVE-2026-32709: PX4 Autopilot MAVLink FTP Unauthenticated Path Traversal
CVE-2026-32713: PX4 Autopilot MAVLink FTP Session Validation Logic Error
CVE-2026-28495: GetSimpleCMS-CE CSRF to Remote Code Execution
CVE-2026-26022: Gogs Stored XSS via data: URI in HTML Sanitizer
CVE-2026-2811: Ajaxify Comments Unauthenticated HTTP Header Injection
CVE-2026-28423: Statamic CMS Server-Side Request Forgery via Glide
CVE-2026-27796: Homarr Unauthenticated Integration Metadata Leak
CVE-2026-27824: Calibre IP Ban Bypass via X-Forwarded-For Spoofing
CVE-2026-27728: OneUptime Command Injection
CVE-2026-26331: yt-dlp Arbitrary Command Injection via --netrc-cmd
CVE-2026-25731: Calibre Templite SSTI to Arbitrary Code Execution
CVE-2026-26213: thingino-firmware Unauthenticated Command Injection in Captive Portal
Unauthenticated OS command injection in the WiFi captive portal API endpoint (api.cgi) of thingino-firmware allows any device on the camera's AP to execute arbitrary commands as root, achieving full device compromise.
CVE-2026-32709: PX4 Autopilot MAVLink FTP Unauthenticated Path Traversal
An unauthenticated path traversal vulnerability in the PX4 Autopilot MAVLink FTP implementation allows reading, writing, and deleting arbitrary files on the flight controller.
CVE-2026-32713: PX4 Autopilot MAVLink FTP Session Validation Logic Error
A logic error in the session validation of PX4's MAVLink FTP implementation allows operations on invalid file descriptors and session isolation bypass.
Cosmic Components Co. - UniVsThreats26 Quals Web
Stacking alternating coupons, abusing negative quantities and session-persistent discounts lets us buy every product for pennies, farm loyalty rewards, hit Elite tier, and grab the flag.
Starlink - UniVsThreats26 Quals Pwn
Chaining a 7-byte format string leak with a strcpy heap overflow to redirect atoi@GOT to system and pop /bin/sh on a non-PIE, partial RELRO Starlink node manager.
Stellar Gateway - UniVsThreats26 Quals Web
Abusing a JWT kid path lookup to /dev/null lets us sign our own admin token with an empty key, unlock the USS Threads Command Center, and capture the flag.