Lab_01 // Research & Disclosures

Vulnerability research and CVE disclosures.

Bugs found in software other people ship, and the writeups on how they work.

Assigned CVEs

Research Writeups

Last Published

Feb 2026

01 // Disclosures

Each one has a CVE and a vendor advisory.

IdentifierAdvisoryAffected productPublished

CVE-2026-25537Type Confusion leads to potential authorization bypassjsonwebtoken (rust)Feb 3, 2026 CVE-2025-61582Unauthenticated denial of service leading to application crash in Ts3 manager <=v2.2.1TS3 managerOct 1, 2025 CVE-2025-61583Unauthenticated reflected cross-site scripting in `Server` parameter in Ts3 manager <=v2.2.1TS3 managerOct 1, 2025 CVE-2025-54123Remote Code Execution in Hoverfly Middleware API (/api/v2/hoverfly/middleware)HoverflySep 11, 2025 CVE-2025-54376Unauthenticated Access to Admin WebSocket Log Streaming Endpoint in HoverflyHoverflySep 11, 2025

02 // Research

Longer writeups on how a bug works. Commentary and guides go on the blog.

Bug Bounty

When The Gateway Becomes The Doorway: Pre-Auth RCE in API Management

Discover how a decade-old vulnerability class leads to pre-authentication Remote Code Execution (RCE) in an enterprise API management platform. This article details the end-to-end compromise of an API Gateway, from initial subdomain reconnaissance and API fuzzing to achieving an interactive reverse shell via unsafe Java deserialization in unauthenticated cluster sync endpoints.

Jan 18, 2026

03 // Tooling

Ordeal

Adversarial test harness for Sigma detection rules, assert a rule fires, then attack it with known evasions and report what slips past.

Working with us

The same research approach is available as an engagement. If one of these bug classes applies to something you run, we can look at your environment directly.

Start a conversation See services