Research / Community / Competition
Notable vulnerability research
Findings disclosed through coordinated, evidence-driven research.
CVE-2026-58095
An incorrect length calculation in mp_Enddisc() could allow a malicious PPP peer to overflow a global result buffer through a received multilink endpoint discriminator option.
CVE-2026-58096
Missing minimum-length validation in LcpDecodeConfig() could allow a malicious PPP peer to trigger an out-of-bounds write with an undersized multilink endpoint discriminator option.
CVE-2026-58097
Missing length validation in mp_SetEnddisc() could allow a local user with access to the ppp(8) command interface to overflow a buffer through a user-supplied PSN endpoint value.
CVE-2026-58085
An authentication-validation flaw in the FreeBSD WireGuard driver that could allow forged or modified transport packets to be accepted under specific network conditions.
GHSA-9c9q-5rj5-mjj2
An authenticated console user could retrieve another tenant's uploaded document preview when the file identifier was known because the preview path did not enforce tenant ownership.
Record / 2019 — 2026
Challenge design, instruction, speaking, community work, and competition results.