Independent security research, vulnerability disclosures, Tor activity, and selected technical analysis. Public links point to the relevant advisory, project, or review when available.

Research & Tor

Tor Project

Creation of relays and translations.

Help people access the open Internet by running a Tor Snowflake proxy directly from this page.

Paper Review

A consideration regarding the paper Extract Me If You Can: Abusing PDF Parsers in Malware Detectors.

Security disclosures

CVE-2026-94247

Membership For WooCommerce <= 3.1.2 — Unauthenticated Membership Payment Bypass via Client-Controlled Plan Price.

Status: Pending / not ready.

CVE-2026-84319 / GHSA-5r62-gj48-897x

MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context. nginx-ui project.

Severity: 8.3 · High.

CVE-2026-19251

Ultimate Member < 2.13.0 — Unauthenticated Unapproved Comment Disclosure via Profile Activity.

Severity: 5.3 · Medium.

CVE-2026-16282

Appointment Hour Booking < 1.5.88 — Unauthenticated Booking Price Manipulation via tcost Parameter.

Severity: 5.3 · Medium.

CVE-2026-14862

Support Genix Lite < 1.4.48 — Unauthenticated Ticket Attachment Download via Missing Authorization.

Severity: 3.7 · Low.

CVE-2026-14849

Paid Member Subscriptions < 3.0.7 — Unauthenticated Sensitive Information Exposure via Residual Export Files.

Severity: 3.7 · Low.

CVE-2026-14235

WordPress Download Manager < 3.3.62 — Unauthorized Protected File Download via Reusable Download Key.

Severity: 3.7 · Low.

CVE-2026-11600

Envo's Templates & Widgets for Elementor and WooCommerce <= 1.4.26 — Missing Authorization to Authenticated (Author+) Private Content Disclosure via Envo Tabs Widget 'templates' Setting.

Severity: 4.3 · Medium.

CVE-2026-11964

User Registration & Membership < 5.2.2 — Unauthenticated PayPal Webhook Signature Verification Bypass Leading to Membership Activation.

Severity: 6.5 · Medium.

CVE-2026-10750

Royal MCP < 1.4.26 — Subscriber+ Insufficient Authorization in MCP Tools.

Severity: 8.1 · High.

CVE-2026-10083

APCu Manager < 4.5.0 — Unauthenticated Stored XSS via Cache Key Pollution.

Severity: 7.5 · High.

GHSA-5vwr-qchf-q4pf

Maven project scanning may allow shell command injection through repository-controlled module paths. Cdxgen project.

Related security contributions