2026.09.30Clean SweepECOVACS DEEBOT T9 firmware 1.4.9 — `reqDo`'s JSON command dispatcher builds a string with `sprintf` and hands it to `popen()`176ptboot2root2026.09.30Dot MatrixParse the I2C capture → map registers to LEDs → rebuild frames → fix the row order → recover the true scroll period146ptMisc2026.09.30DownhillHidden-parallelepiped attack on a 2003 signature scheme — recover `f` with covariance plus FFT-augmented 4th-moment gradient descent155ptCrypto2026.09.30dont-worryCSP bypass via path traversal in the Prism autoloader's `data-dependencies`, chained with `No-Vary-Search` cache-key confusion to replay the bot's authenticated response129ptWeb2026.09.30AgilePaste 3Differential handling of duplicate Erlang ETF map keys — a term that never passed validation reaches the client's JSON encoderWeb2026.09.30Count on me!`vb.htm?checkupdate=<url>` reflects the server-side fetch body verbatim — response-reflected SSRF (the SSID injection and `update.cgi` crash were dead ends)boot2root2026.09.30dyslexic`vboxsf` is a client filesystem — the guest trusts the host's SHFL RPC responses without validating them127ptMisc2026.09.30Embedded encryptorLocate the encryption in the power trace, align per-block, recover the key with CPA (last two bytes handled separately)133ptMisc2026.09.30Flag Pointer RegisterPE32+ — the decoder always runs, the result pointer just never reaches RDX. Replay the 8-byte-key XOR instead97ptReversing2026.09.30bloatware.jsNext.js resume-data-cache blobs are base64 → inflate → JSON.parse with no integrity check, and the client Flight decoder's synchronous reference walk has no guards at all.299ptWeb2026.09.301up clank broLadybird LibJS inline-cache type confusion after a GC sweep → unchecked heap OOB R/W → native function table hijack for RCE253ptPwn2026.09.30File MonsterUploads are written verbatim to `/tmp/<name>` on the shared MongoDB container → CVE-2026-13078 / SERVER-128832Web2026.09.30Ein milljón bjóra`Exif.ReadLocation()` returns a raw `JsonElement`, giving a zero-byte write; steer the classifier to inflate the approved countWeb2026.09.30Min Beste Venn1,135 HTTP HEAD requests, all 404 — the information is in the shape of the **request paths**, not the responses68ptForensics2026.09.30happy`--frozen-intrinsics` freezes only the ECMAScript intrinsics — Node core prototypes such as `EventEmitter.prototype` are left alone131ptMisc2026.09.30No Strings AttachedRecover the 56 bytes of `secret` (0x404040) XORed against a glibc-style LCG keystream95ptReversing2026.09.30Omniscient`SetApConfig` base64-wraps every input except the `ts` field added in the X5 → command injection into `popen()`boot2root2026.09.30Open SecretStatic ELF using raw syscalls only, so there are no libc calls for ltrace to catch99ptReversing2026.09.30Patch TuesdayRuntime opcode patch (`jz` → `jnz`)113ptReversing2026.09.30jailnetThe Janet compiler runs outside the sandbox it is compiling for, and nothing verifies the bytecode it emits.Pwn2026.09.30perchanceMissing trailing slash in a `startsWith` check (userinfo bypass), then a hardcoded extension UUID and an origin-less postMessage handler to steal `activateOn`131ptWeb2026.09.30PurgatoryErlang hot code loading — the worker's local calls stay pinned to old.beam, but the fully-qualified `Mod:Fun` call is late-bound and lands in new.beam122ptReversing2026.09.30Raymarine NavigationLightHouse 4.11.133 (0day) — command injection in a CGI binaryboot2root2026.09.30Scratch SpaceDecoded into an mmap'd scratch page and then wiped — reconstruct the pre-wipe state105ptReversing2026.09.30silentpyjail — reach `object` without `__class__`, then build an arbitrary-getattr primitive without spelling a single name122ptMisc2026.09.30The BuilderThe page tag is `sha256(content)[:12]`, so it is predictable, and the registry accepts anonymous pushes → smuggle in `ONBUILD COPY --from=theme /flag.txt`99ptdevsecops2026.09.30The TempleTempleOS — print to the terminal after `MountIDEAuto`, and decode the 8x8 glyphs from the noVNC canvas pixels instead of reading them by eye155ptMisc2026.09.30Time LockLie to `time()` with `LD_PRELOAD` to pass the time gate116ptReversing2026.09.30Self-serviceAbuse LDAP attribute-driven group "provisioning" → reset `ops`'s password → pivot103ptdevsecops2026.09.30Triangle PlatformStart from tenant-a's `console` ServiceAccount and escape through Kyverno's YAML handlingdevsecops2026.09.25small-guyAll 256 rounds of the checker live in .eh_frame; the C++ unwinder is the VM, and it consumes its key one frame late.Reversing2026.09.24Sleepy CPUThe length of each sleep interval is the flag byte - a power side-channel you can read with a threshold.91ptMisc2026.09.23NNS International LoungeA hardcoded HMAC key plus one unvalidated field, compounded by a one-time bonus escape hatch.195ptMisc2026.09.22littlefsDriving a discontinued Saleae app headlessly through its socket API to open an undocumented capture format.108ptMisc2026.09.21KeyboardDecoding USB Low-Speed off the raw wire, then replaying every keystroke - including the edits that build the real flag.Misc2026.09.20Hardware accelerated flag checker 2Extracting a netlist back out of a fabricatable SKY130 layout with no PDK installed.105ptMisc2026.09.19Hardware accelerated flag checker 1Writing a gate-level simulator for an anonymous Yosys netlist and walking its KMP-style automaton.95ptMisc2026.09.17CheeseReproducing a lockdown browser's integrity headers from its config file alone, without ever installing it.235ptMisc2026.09.16Light-Weight EncryptionPublishing the whole LWE relation lets any kernel vector cancel the secret, reducing the break to a scalar trapdoor.94ptCrypto2026.09.15ImpossibleLeaked ceremony toxic waste turns Groth16 into a rubber stamp for any public statement at all.121ptCrypto2026.09.14From NothingRecovering a withheld Mumford v-polynomial, then the Jacobian's order via complex multiplication instead of point counting.102ptCrypto2026.09.13Crypto Party 2A UUID4 used as an ECDSA nonce has ~106 unpredictable bits, recovered with a 168-dimension lattice.135ptCrypto2026.09.12RLP GolfHand-written Yul assembling canonical RLP with mstore8 headers and calldatacopy bodies, scored purely on gas.235ptBlockchain2026.09.11VoidAn off-by-one in Cairo's circuit failure-guarantee lets a STARK prove that an invertible element has no inverse.220ptBlockchain2026.09.10ForkA Move VM module cache that lives outside Block-STM's tracked read-set, raced into a permanent chain fork.176ptBlockchain2026.09.09CERNTwo Aztec functions share a 4-byte selector, so redirecting a callback to the contract itself mints its private notes to me.161ptBlockchain2026.09.08Block RehearsalCrashing a Mina validator through a zip_exn that fires before any proof is ever verified.195ptBlockchain2026.09.07Bank of NNSA permutation-cycle bug in kimchi's connect_64bit leaves a range-check limb entirely unconstrained.313ptBlockchain2026.09.06Reverse Grand PrixZero-cost AST nodes defeat solc's inliner size heuristic, compressing a 157-second compile bomb into 637 bytes.195ptBlockchain2026.09.05Glomma River TradingA perp market that reads its mark price straight off the thin AMM pool you are free to trade against.207ptBlockchain2026.09.04eu261A textbook checks-effects-interactions violation, reentered 16 times to drain a compensation fund to exactly zero.158ptBlockchain