Research
Findings we can talk about publicly, the methodology behind them, and what each one means if you happen to run the software. Written by whoever did the work.
consul-k8s hands its own components Consul ACL roles by ServiceAccount name. Kubernetes only keeps those names unique inside a namespace, so anyone who could create a ServiceAccount anywhere in the cluster could log in as the connect injector.
A Firezone Client picks placeholder IPs for DNS Resources and tells the Gateway which ones it chose. The Gateway never checked them, and every address it accepted became a route.
In 2024 Authlib stopped public keys being used as HMAC secrets by looking at the first bytes of the key. The PEM loader skips whatever comes first, so one newline brought the bug back.
Pulsar checked that you could create a topic in your own namespace, then let one property on that topic attach it to another tenant's storage. Nobody asked the other tenant.
Vite 8.2 added an internal query for its new Wasm support. The dev server let anyone send it, the plugin behind it read files without asking server.fs, and the parse error did the rest.
Netatalk's Spotlight decoder had been hardened since 2023. The handlers that read its output still trusted the shape of what came back, and two of them were wrong.
NGINX Gateway Fabric verified each agent's identity, then let the agent declare which Gateway it belonged to. We used that gap to read another tenant's TLS private key.
We reported a critical authentication bypass in @fastify/middie on Tuesday and it was fixed on Thursday. One request, two layers, two different opinions about what the path was.
The honest answer is no, and it does not help you much, because the reason people ask is usually a customer contract rather than the framework.
Every vendor dodges this question. The reason is real, but you can still work out roughly what you should be paying, and spot a quote that is wrong.
In July we reported that the official fix for CVE-2026-41992 left the bug reachable. Upstream shipped a better one the same day. Here is what that says about trusting patches.
If nobody has confirmed the fix closes the path rather than the reproducer, that is worth an afternoon of somebody's time.