ruflo: room log path traversal
A room id containing .. steered the room log path outside its directory. The fix rejects traversal in the id.
✓ Merged, ruvnet/ruflo
CVEs published on WPScan10Security For WooCommerce, 2026-11-09, listed below
PRs merged, all projects52Sprint to 100: pnpm, Payload, Home Assistant, GitLab CLI
Security fix PRs merged6ruflo, KiroCrew, twitter-scraper-mcp, circl, pollinations
Fix PRs open, under review56A selection is indexed below
Advisories filed, in disclosure21In triage with the maintainers
Coordinated disclosures in progress26Appear as counts only until they close
Linux kernel patch1staging/media, atomisp, first version returned by maintainers 2026-11-10, corrected full rename patch prepared
Findings, fixes, and receipts.
I audit public source code, mostly AI products and open source, prove each finding locally, and ship a fix with the report wherever the project allows it. Serious findings go through the project’s own private disclosure process first. Nothing here lists an undisclosed vulnerability: what is still in coordinated disclosure appears as counts only.
Counts updated 2026-11-10.
Published vulnerabilities. WPScan, 2026-11-09.
10 vulnerabilities I found and reported, all in one WordPress plugin: Security For WooCommerce (Ultimate Security For WooCommerce), versions <= 1.0.16. All 10 are unauthenticated, WPScan credits me as the researcher on every entry, and no fix is available. The plugin is closed on wordpress.org.
- CVE-2026-123696 - Unauthenticated Two-Factor Authentication Reset (CVSS 7.5)
- CVE-2026-123697 - Unauthenticated Two-Factor Code and Secret Disclosure (CVSS 7.5)
- CVE-2026-123698 - Unauthenticated Plugin Settings Disclosure via REST API (CVSS 5.3)
- CVE-2026-123699 - Unauthenticated Forced Plugin, Theme and Core Updates (CVSS 4.8)
- CVE-2026-123700 - Unauthenticated Mass Comment Deletion (CVSS 7.5)
- CVE-2026-123701 - Unauthenticated Plugin Settings Reset (CVSS 5.3)
- CVE-2026-123702 - Unauthenticated wp-config Keys and Salts Reset and Denial of Service (CVSS 6.5)
- CVE-2026-123703 - Unauthenticated Arbitrary User Logout (CVSS 5.3)
- CVE-2026-123704 - Unauthenticated Administrator Email Address Disclosure (CVSS 5.3)
- CVE-2026-123705 - Unauthenticated Server Configuration Information Disclosure (CVSS 5.3)
Full write-up: how the batch was found - the two root causes, the method, and the fix pattern.
Fixes that landed.
ruflo: guessable MCP session ids
Session ids were predictable, so a session could be addressed by anyone who could guess the pattern. Replaced with crypto randomUUID.
✓ Merged, ruvnet/ruflo
KiroCrew: snapshot tar filter
Snapshot restore extracted special files (FIFOs, device nodes) the filter claimed to reject. Extraction now drops them, matching the documented behavior.
✓ Merged, kirodotdev/KiroCrew
twitter-scraper-mcp: environment leak
The worker child process inherited the server’s whole environment, credentials included. It now receives an allowlist.
✓ Merged, takiAA/twitter-scraper-mcp
circl: blind RSA salt source
The blind RSA salt is read from the supplied randomness source.
✓ Merged, cloudflare/circl
pollinations: quest reward parsing
Quest reward parsing is bounded.
✓ Merged, pollinations/pollinations
56 fixes open. A selection.
- supabase/postgres-meta #1171 - enum allowlists closing SQL injection in trigger and policy creation
- supabase/auth #2885 - timeout and size cap on the SAML metadata fetch
- vxcontrol/pentagi #468 and #469 - privilege checks on REST token endpoints; caps on terminal directory reads
- deepseek-ai/Janus #243, #244, #245 - remote-code loading removed, demo sharing defaults fixed, checkpoint loads pinned to weights_only
- localhost8083/marscli #1 to #4 - credential storage and updater hardening for an OpenCode fork
- CodebuffAI/freebuff #1545 and #1546 - sponsored-mode refusal walk fails closed; read_url keeps DNS pinning under a proxy
- Logflare/logflare #4200 and #4201 - atom exhaustion via flash keys; PII redaction and cache fixes
- Comfy-Org/Comfy-Desktop #1786 - http(s) allowlist on the window-open handler
Published by maintainers, not by me.
21 security advisories are filed through GitHub private vulnerability reporting and sit in triage with the maintainers; the filed ones are indexed on the home page. Advisories are published by the project, with a CVE where one is assigned, at the end of coordinated disclosure. The WPScan entries above are the first published set.
- Audit the public source code locally. No live service is probed.
- Prove the finding on local ground only, with synthetic data, and state the proof level honestly.
- Fix it minimally, with a regression test that fails before and passes after.
- Disclose through the project’s own process. Private report first for anything serious.
- Credit: ask for a published advisory, a CVE, and Finder credit as Benjamin Kincses.
Benjamin Kincses, Security research, Hungary