CyberKareemLinkedIn Contact
Menu

Security research

Vulnerabilities explained with public proof.

Read selected case studies or search the complete advisory ledger. Public claims link to vendor, CNA, CVE Program, or project sources. Unpublished technical details remain private.

Read selected case studies

Complete research ledger

Find a CVE, product, or weakness.

Includes 49 assigned CVEs and 4 additional Finder credits. Each public entry links to its supporting record.

53 records in the public ledger · 8 additional records shown
  1. CVECVE-2026-84754

    WPFunnels

    The WPFunnels WordPress plugin through 3.12.13 exposed a privileged action without a proper capability or nonce check, so an unauthenticated request could invoke functionality the plugin intended to keep behind an authorization boundary. Version 3.13.0 adds the missing authorization check.

    Authorization & tenant isolation
    Medium · 6.5Fixed in 3.13.0
    Read case study
    CVE-2026-84754: Facts and sources
    Published
    3 Sep 2026
    Status
    Patchstack verified; CVE Program published
    Scoring
    CVSS 3.1
    Credit
    Finder
    Remediation
    Fixed in 3.13.0
    Open the Patchstack record and Finder credit opens in a new tabOpen the central CVE record opens in a new tab
  2. CVECVE-2026-82186

    WPLP Cookie Consent

    The WPLP Cookie Consent WordPress plugin before 4.4.2 did not validate the offset pagination parameter before using it in a SQL query, so an administrator could inject SQL through that parameter. Version 4.4.2 validates the parameter.

    Injection & untrusted execution
    Medium · 4.1Fixed in 4.4.2
    Read case study
    CVE-2026-82186: Facts and sources
    Published
    2 Sep 2026
    Status
    WPScan verified; CVE Program record published
    Scoring
    CVSS 3.1
    Credit
    Finder
    Remediation
    Fixed in 4.4.2
    Open the WPScan record and Finder credit opens in a new tabOpen the central CVE record opens in a new tab
  3. CVECVE-2026-78865

    django-crm

    The user-transfer view in django-crm is gated only by login_required, so any authenticated low-privilege CRM operator can add their own account to a privileged role group and gain application-admin authority across departments. No fixed version was available at disclosure; the maintainer closed the private report without remediation.

    Authorization & tenant isolation
    High · 8.1No fixed version at disclosure
    Read case study
    CVE-2026-78865: Facts and sources
    Published
    4 Sep 2026
    Status
    CVE assigned by MITRE; record publication pending; unpatched at disclosure
    Scoring
    CVSS 3.1
    Credit
    Finder
    Remediation
    No fixed version at disclosure
    Open the central CVE record opens in a new tabOpen the vulnerable source opens in a new tab
  4. CVECVE-2026-78866

    django-crm

    django-crm resolves emails in its view-original-email and download-original-email views by a client-supplied integer id with no owner or department check, so any authenticated low-privilege staff user can enumerate ids and read other departments' confidential email bodies, headers, and attachments. No fixed version was available at disclosure; the maintainer closed the private report without remediation.

    Authorization & tenant isolation
    High · 7.1No fixed version at disclosure
    Read case study
    CVE-2026-78866: Facts and sources
    Published
    4 Sep 2026
    Status
    CVE assigned by MITRE; record publication pending; unpatched at disclosure
    Scoring
    CVSS 3.1
    Credit
    Finder
    Remediation
    No fixed version at disclosure
    Open the central CVE record opens in a new tabOpen the vulnerable source opens in a new tab
  5. CVECVE-2026-78867

    django-crm

    django-crm through commit 508e4dfe stores chat message content without sanitization, so an authenticated low-privilege CRM operator can send a message containing JavaScript that runs in the recipient's Django admin session when they open the chat. No fixed version was available at disclosure; the maintainer closed the private report without remediation.

    Injection & untrusted execution
    Critical · 9.0No fixed version at disclosure
    Read case study
    CVE-2026-78867: Facts and sources
    Published
    4 Sep 2026
    Status
    CVE assigned by MITRE; record publication pending; unpatched at disclosure
    Scoring
    CVSS 3.1
    Credit
    Finder
    Remediation
    No fixed version at disclosure
    Open the central CVE record opens in a new tabOpen the vulnerable source opens in a new tab
  6. CVECVE-2026-78868

    django-crm

    A remote, unauthenticated attacker can send an email whose Subject header carries HTML that django-crm imports over IMAP, stores with mark_safe, and later renders unescaped in the Django-admin message list, running attacker JavaScript in a staff or superuser session. No fixed version was available at disclosure; the maintainer closed the private report without remediation.

    Injection & untrusted execution
    Critical · 9.6No fixed version at disclosure
    Read case study
    CVE-2026-78868: Facts and sources
    Published
    4 Sep 2026
    Status
    CVE assigned by MITRE; record publication pending; unpatched at disclosure
    Scoring
    CVSS 3.1
    Credit
    Finder
    Remediation
    No fixed version at disclosure
    Open the central CVE record opens in a new tabOpen the vulnerable source opens in a new tab
  7. CVECVE-2026-78869

    Shinobi CCTV

    Shinobi 2.0.0 and earlier fails to bind a session to its own group, so any authenticated group admin can present a valid session token together with another group's group key in the URL path and act inside that second group. No fixed version was available at disclosure; the issue was reported to the maintainer through a confidential GitLab issue and remains unpatched.

    Authorization & tenant isolationAuthentication & session integrity
    High · 8.5No fixed version at disclosure
    Read case study
    CVE-2026-78869: Facts and sources
    Published
    4 Sep 2026
    Status
    CVE assigned by MITRE; record publication pending; unpatched at disclosure
    Scoring
    CVSS 3.1
    Credit
    Finder
    Remediation
    No fixed version at disclosure
    Open the central CVE record opens in a new tabOpen the vulnerable source opens in a new tab
  8. CVECVE-2026-78871

    Shinobi CCTV

    Shinobi 2.0.0 and earlier is missing an authorization check on its PTZ camera-control route, so any authenticated user, including a restricted sub-account or an API key marked control_monitors_disallowed, can pan, tilt, or zoom any camera in their group. No fixed version was available at disclosure.

    Authorization & tenant isolation
    Medium · 5.4No fixed version at disclosure
    Read case study
    CVE-2026-78871: Facts and sources
    Published
    4 Sep 2026
    Status
    CVE assigned by MITRE; record publication pending; unpatched at disclosure
    Scoring
    CVSS 3.1
    Credit
    Finder
    Remediation
    No fixed version at disclosure
    Open the central CVE record opens in a new tabOpen the vulnerable source opens in a new tab

52 records have public primary sources. One record may cover more than one vulnerability class. Reviewed 9 Aug 2026; 1 record is awaiting coordinated publication.

Responsible disclosure

Report a security issue privately.

Start with a channel request. Do not send unpatched technical details through a public service.

Request a private channel