https://maajix.github.io/news/Disclosure log: CVEs, bug bounty reports and payouts, CTF results and other things as they happen.Hugo -- gohugo.ioenmax.randhahn@yahoo.de (Max)Sun, 12 Jul 2026 00:00:00 +0000https://github.com/zoriya/Kyoo/security/advisories/GHSA-xhg6-v78p-xf44Sun, 12 Jul 2026 00:00:00 +0000cvehttps://maajix.github.io/news/#2026-07-12-cve-2026-77386The OIDC login flow accepted an attacker-supplied redirect target, handing the issued token to a URL outside the application.https://github.com/zoriya/Kyoo/security/advisories/GHSA-fc8v-vr3q-hc46Sun, 12 Jul 2026 00:00:00 +0000cvehttps://maajix.github.io/news/#2026-07-12-cve-2026-77385The transcoder streamed any file under the media directory, including files never added to the library.https://maajix.github.io/posts/yekcity/Wed, 24 Jun 2026 00:00:00 +0000projecthttps://maajix.github.io/news/#2026-06-24-yekcityA physical OT security demonstrator that makes cyberattacks visible when the city goes dark.https://maajix.github.io/ctfs/securinets/Sun, 05 Oct 2025 00:00:00 +0000ctfhttps://maajix.github.io/news/#2025-10-05-securinets-ctf-2025Chaining a username SQL injection, an SSRF and a broken collaboration-request check into admin access, plus the MD7 misc challenge.https://maajix.github.io/ctfs/crewctf-2025/Fri, 19 Sep 2025 00:00:00 +0000ctfhttps://maajix.github.io/news/#2025-09-19-crewctf-2025Getting XSS past a strict Content Security Policy and exfiltrating the result to a Burp Collaborator callback.https://maajix.github.io/ctfs/fortid/Sun, 14 Sep 2025 00:00:00 +0000ctfhttps://maajix.github.io/news/#2025-09-14-fortid-ctf-2025Abusing the target_user parameter on the admin upload endpoint to plant files as another user, plus reversing and misc.https://maajix.github.io/ctfs/nullcon-2025/Sat, 06 Sep 2025 00:00:00 +0000ctfhttps://maajix.github.io/news/#2025-09-06-nullcon-ctf-2025Brute forcing grandmas_notes character by character through a password oracle, and pwgen leaking its source via ?source=1.https://maajix.github.io/ctfs/tfcctf-2025/Sun, 31 Aug 2025 00:00:00 +0000ctfhttps://maajix.github.io/news/#2025-08-31-tfcctf-2025SLIPPY abuses a ZIP symlink for arbitrary file read, DOM NOTIFY uses DOM clobbering against a Puppeteer admin bot.https://maajix.github.io/ctfs/cyber-apocalypse/Thu, 20 Mar 2025 00:00:00 +0000ctfhttps://maajix.github.io/news/#2025-03-20-htb-cyber-apocalypse-2025The Trial by Fire and Whispers of the Moonbeam web challenges, SealedRune reversing and Echoes in Stone OSINT.https://maajix.github.io/ctfs/acectf/Thu, 27 Feb 2025 00:00:00 +0000ctfhttps://maajix.github.io/news/#2025-02-27-acectf-2025WebCrypto, JWT forgery in Token of Trust, an S3 bucket misconfiguration, plus reversing and XOR keystream reuse crypto.https://maajix.github.io/posts/demonstrator/v1/Fri, 21 Feb 2025 00:00:00 +0000projecthttps://maajix.github.io/news/#2025-02-21-car-hacking-demonstratorEmulating real CAN bus communication to train automotive attack and defense hands-on.https://maajix.github.io/ctfs/1337up-2024/Sat, 16 Nov 2024 00:00:00 +0000ctfhttps://maajix.github.io/news/#2024-11-16-1337up-ctf-2024Solving Cold Storage by unwinding the XOR and RSA layers protecting the key, plus the OSINT challenges.https://maajix.github.io/ctfs/glacier-2024/Wed, 23 Oct 2024 00:00:00 +0000ctfhttps://maajix.github.io/news/#2024-10-23-glacier-ctf-2024Using peepdf to inspect PDF object streams and recover a PNG image embedded inside the document.