Security Research
Vulnerabilities I've found and disclosed, and other security-focused projects.
Write-ups
- Security Research: LibreChat — August 2024
Two CVEs discovered in LibreChat, an open-source AI chat platform: a conversation hijacking flaw and a path traversal vulnerability, both reported through REA Group's coordinated disclosure program.
- Security Research: Dinkleberry — April 2024
A Python tool that patches D-Link NAS devices vulnerable to CVE-2024-3272 by using the exploit itself to overwrite the vulnerable code in place.
CVEs
- CVE-2026-116839 — Ubiquiti airMAX M: Cross-site request forgery (CSRF) allowing denial of service (CVSS 7.1 (High)) · advisory
- CVE-2026-116836 — Ubiquiti airMAX M: Stored cross-site scripting (XSS) allowing privilege escalation (CVSS 8.8 (High)) · advisory
- CVE-2026-77532 — Ubiquiti EdgeMAX EdgeSwitch: DHCPv6 heap buffer overflow allowing remote code execution (CVSS 8.8 (High)) · advisory
- CVE-2024-41703 — LibreChat: Conversation hijacking (CVSS 5.4 (Medium)) · advisory · write-up
- CVE-2024-41704 — LibreChat: Path traversal in image access control (CVSS 3.1 (Low)) · advisory · write-up