0xStrawHat security research

CVEs & advisories.

Interesting bugs. Public findings.

好奇心に、終わりはない。Curiosity has no end.

DISCLOSURE LOGpublic records 4 projects

The disclosure files

Discovered & responsibly disclosed

libyang25 Aug 2026
GHSA-9rpj-3789-2645
Heap use-after-free caused by stale extension-instance state in the schema compiler.
CVSS 3.1 score 8.6, High HighCVSS 3.1
Read advisory
libyang25 Aug 2026
GHSA-rrc3-9rpp-qrh5
Malformed augment or deviation paths can underflow the path counter and trigger an out-of-bounds read.
Moderate, no published numeric CVSS score ModerateNo published numeric score
Read advisory
uuid24 Apr 2026
CVE-2026-41907
Missing buffer bounds checks in v3, v5, and v6 allow silent partial writes.
CVSS 4.0 score 6.3, Moderate ModerateCVSS 4.0
Read advisory
CVE record
Multer15 Jun 2026
CVE-2026-5038
Aborted uploads leave partial files behind, allowing disk exhaustion.
CVSS 3.1 score 5.3, Moderate ModerateCVSS 3.1
Read advisory
CVE record
Zen Browser11 May 2026
CVE-2026-44658
RSS live-folder item URLs reach trusted tab creation without scheme restrictions.
CVSS 3.1 score 2.4, Low LowCVSS 3.1
Read advisory
CVE record