I'm Charles Vosburgh / the-vibe-dev, an independent security researcher and builder. I investigate authorization failures, sandbox escapes, parser behavior, and the trust boundaries that connect applications, libraries, and infrastructure.
This is my public collection of CVE and GitHub Security Advisory research: root-cause analysis, affected versions, remediation, and coordinated disclosures. My upstream kernel work is in Linux-Kernel.
| My public research | Count |
|---|---|
| Distinct public CVE/GHSA-identified cases, including Linux | 59 |
| Public CVEs, including Linux | 54 |
| Published repository GHSAs | 18 |
| Accepted Linux mainline fixes | 4 |
Updated November 11, 2026. The identifier-backed index contains 56 non-kernel cases, 51 CVEs, and 18 repository GHSAs. Thirteen cases carry both identifiers: 51 + 18 − 13 = 56. My Linux portfolio adds three kernel CVE cases, for 59 identified cases and 54 public CVEs overall. The kernel's SCTP GHSA is tracked separately from the 18 repository advisories. My additional libucl finding has no verified CVE/GHSA and is listed separately below.
| # | Identifier(s) | Project | Public finding | Public severity | Write-up state | Write-up |
|---|---|---|---|---|---|---|
| 01 | CVE-2026-73343 |
WP Compress | Unauthenticated remote code execution | Critical, 10.0 | Summary-only | Read |
| 02 | CVE-2026-15054 |
Bit Form | Inactive or unpublished forms remained reachable through public submission handlers | Low, 3.7 | Full | Read |
| 03 | CVE-2026-16534 |
Import and export users and customers | CSV import authorization failure | High, 7.2 | Full | Read |
| 04 | CVE-2026-64606 |
Apache Fory | Java lambda class-registration bypass | Important (Apache) / Critical, 9.8 (CISA ADP) | Full | Read |
| 05 | CVE-2026-75796 |
AI Engine | Multisite account-target authorization failure | High, 7.2 | Full | Read |
| 06 | CVE-2026-77789 |
Stripe Payment Forms by WP Full Pay | Cross-customer subscription modification | Medium, 4.3 | Full | Read |
| 07 | CVE-2026-77356 · GHSA-976x-prgx-qv35 |
TypeBox | Generated validation-code injection | High, 7.8 | Full | Read |
| 08 | CVE-2026-77355 · GHSA-6fxm-h49m-4fg3 |
isomorphic-git | NTFS alias bypass writing into the active gitdir | High, 8.8 | Full | Read |
| 09 | CVE-2026-47698 · GHSA-cfcw-xp6x-25gj |
vm2 | Sandbox breakout through dangerous host prototype mutators | Critical, 9.8 | Full | Read |
| 10 | CVE-2026-73569 · GHSA-8r6m-32jq-jx6q |
fast-xml-parser | Repeated DOCTYPE declarations reset entity-expansion limits |
High, 8.7 | Full | Read |
| 11 | GHSA-5jx8-p6q2-455g |
DynamicExpresso | LateBindObject reflection-restriction bypass |
High, 8.8 | Full | Read |
| 12 | GHSA-hphq-wq62-4mj3 |
OpenEXR | HTJ2K planar decode row-endpoint wrap causing denial of service | Moderate, 5.5 | Full | Read |
| 13 | CVE-2026-100415 · GHSA-v3qq-3xvg-m77g |
python-statemachine | Restricted-evaluator write-side dunder traversal | Critical, 9.1 | Full | Read |
| 14 | CVE-2026-100414 · GHSA-fj3w-533r-fvf6 |
python-statemachine | Untrusted SCXML external-source local-file disclosure | High, 7.1 | Full | Read |
| 15 | CVE-2026-107724 · GHSA-g3jj-5cmm-3hxx |
fast-jwt | Raw public JWK JSON accepted as an HMAC secret | High, 7.4 | Full | Read |
| 16 | CVE-2026-92948 · GHSA-qhwx-74w5-xhxq |
vm2 | NodeVM builtin allowlist bypass through node:test.run() |
Critical, 9.9 | Full | Read |
| 17 | CVE-2026-81766 |
Really Simple Security | Multisite subsite Administrator plugin installation | Medium, 6.6 | Full | Read |
| 18 | CVE-2026-17563 |
WP User Frontend | Unauthenticated post creation through a subscription-gated form | Not displayed by WPScan | Full | Read |
| 19 | CVE-2026-77793 |
RegistrationMagic | Paid-registration bypass through an omitted price field | Not displayed by WPScan | Full | Read |
| 20 | GHSA-9v3x-mhg4-wwv2 |
Exiv2 | Out-of-bounds stack access in built-in HTTP request construction | Low | Full | Read |
| 21 | CVE-2026-84451 · GHSA-hh47-fhqr-cj2r |
libheif | Incomplete range-check fix allowed integer wrap and out-of-bounds read | Moderate, 6.5 | Full | Read |
| 22 | CVE-2026-86815 |
BackWPup | Missing granular authorization on backup-management operations | Medium, 5.5 | Full | Read |
| 23 | CVE-2026-88764 |
Simple Membership | Payment not bound to authorized membership level | Medium, 5.4 | Full | Read |
| 24 | CVE-2026-89080 |
Really Simple Security | Email two-factor authentication bypass | High, 7.5 | Full | Read |
| 25 | CVE-2026-102273 · GHSA-w2cx-738m-mc7w |
PyJWT | Public JWK containers accepted as HMAC verification secrets | High, 7.4 | Full | Read |
| 26 | GHSA-r2q2-xmpm-7fvh |
SimpleEval | Restricted-expression callable denylist bypass | Low | Full | Read |
| 27 | CVE-2026-92403 |
Secure Custom Fields | Unauthenticated post modification via front-end form ID substitution | Low, 3.7 | Full | Read |
| 28 | CVE-2026-92400 |
Payment Gateway for PayPal on WooCommerce | Unauthenticated payment bypass via sandbox IPN environment confusion | Not displayed by WPScan | Full | Read |
| 29 | CVE-2026-81810 |
All-in-One WP Migration and Backup | Configured export-only user privilege escalation to administrator | High, 7.2 | Full | Read |
| 30 | CVE-2026-90922 |
Paid Member Subscriptions | PayPal amount and currency mismatch accepted for paid membership | Medium, 5.3 | Full | Read |
| 31 | CVE-2026-85569 |
Tutor LMS | Read-only API key privilege escalation via REST request misclassification | High, 7.2 | Full | Read |
| 32 | CVE-2026-87978 |
Paymob for WooCommerce | Missing payment-notification authentication | Public advisory | Full | Read |
| 33 | CVE-2026-74991 |
WPForms Lite | Cross-application payment-object authorization failure | Medium, 6.8 | Full | Read |
| 34 | CVE-2026-78397 |
Link Library | Configuration-dependent reciprocal-link SSRF | Medium, 4.0 | Full | Read |
| 35 | CVE-2026-96896 |
Malcure Malware Shield | Multisite authorization gap permitting file changes | High, 7.2 | Full | Read |
| 36 | CVE-2026-77524 · GHSA-637c-6jxx-4rwm |
KEDA | Namespace-to-cluster credential boundary failure | Critical, 9.9 | Full | Read |
| 37 | CVE-2026-102827 · GHSA-858h-whjf-mvg5 |
simple-git | Unsafe-operation option interpretation mismatch | High, 8.1 | Full; fix discrepancy noted | Read |
| 38 | CVE-2026-104118 |
Razorpay for WooCommerce | Unauthenticated shipping-information modification | Medium, 5.3 | Full | Read |
| 39 | GHSA-wqq5-5w4p-m569 |
Yamcs | Privileged templated-instance YAML reconfiguration injection | High, 7.2 | Full | Read |
| 40 | CVE-2026-59797 |
Apache HTTP Server mod_ssl | SSLRequire file-expression restriction bypass | Low (Apache) | Full | Read |
| 41 | CVE-2026-63045 |
Apache HTTP Server mod_proxy_ftp | Untrusted PASV address controls proxy data connection | Low (Apache) | Full | Read |
| 42 | CVE-2026-112943 · GHSA-698v-4r3x-3vcv |
launch-editor | Windows command expansion bypasses filename escaping | Medium, 6.3 (CVSS 4.0) | Full | Read |
| 43 | CVE-2026-106597 |
User Registration & Membership | Missing authorization | Medium, 5.3 | Public summary | Read |
| 44 | CVE-2026-109898 |
Eventin / WP Event Solution | Missing authorization | Medium, 5.3 | Public summary | Read |
| 45 | CVE-2026-110523 |
WP User Manager | Paid-registration role restriction failure | High, 8.1 | Summary-only | Read |
| 46 | CVE-2026-115251 |
Duplicator | Multisite one-click upgrade privilege boundary failure | High, 7.2 | Public summary | Read |
| 47 | CVE-2026-111577 |
GoSMTP | Plugin-activation authority permits SMTP settings changes | High, 7.2 | Public summary | Read |
| 48 | CVE-2026-111404 |
Photo Reviews for WooCommerce | Unauthenticated race condition | Low, 3.7 | Public summary | Read |
| 49 | CVE-2026-119273 |
BulletProof Security | Configuration-dependent sensitive security-log disclosure | Medium, 5.9 | Public summary; no known fix | Read |
| 50 | CVE-2026-91049 |
EWWW Image Optimizer | Author+ stored XSS through lazyload script handling | Medium, 6.4 | Public summary | Read |
| 51 | CVE-2026-112244 |
Duplicator / Duplicator Pro | Unauthenticated full path disclosure | Medium, 5.3 | Public summary | Read |
| 52 | CVE-2026-71901 |
Apache OFBiz | Authenticated internal service dispatch through SFA vCard import | Moderate (Apache) | Full | Read |
| 53 | CVE-2026-109163 |
Apache HTTP Server mod_vhost_alias | One-byte stack buffer overwrite at an expansion boundary | Low (Apache) | Full | Read |
| 54 | CVE-2026-111579 |
Forminator Forms | Payment-gated registration bypass when the configured gateway is unavailable | High, 8.1 | Public summary | Read |
| 55 | CVE-2026-123657 |
ProfilePress | Unauthenticated enrollment into inactive membership plans | Medium, 5.3 | Public summary | Read |
| 56 | CVE-2026-125912 |
WP Ultimate CSV Importer | Multisite subsite Administrator PHP execution through media import | High, 7.2 | Public summary | Read |
| Project | Accepted upstream work | Credit | Write-up |
|---|---|---|---|
| libucl | Embedded-NUL string-copy out-of-bounds read; issue #385, fix PR #401 | I reported the issue; afonsojanu authored the fix | Read |
This additional finding is not included in the CVE/GHSA-identified totals.
This collection includes 43 technical write-ups and thirteen disclosure summaries for identified non-kernel cases, plus a separate technical write-up for libucl's unassigned upstream finding. I publish technical details in coordination with maintainers and disclosure programs. Each report identifies its evidence, source-review scope, and testing basis.
| Summary | Detailed disclosure status |
|---|---|
WP Compress / CVE-2026-73343 |
Public advisory available; technical report pending. |
User Registration / CVE-2026-106597 |
Public advisory and finder credit; specific technical mechanism not established from the published entry. |
Eventin / CVE-2026-109898 |
Public advisory and finder credit; specific technical mechanism not established from the published entry. |
WP User Manager / CVE-2026-110523 |
Public advisory; WPScan withholds the PoC until November 19, 2026. |
Duplicator multisite upgrade / CVE-2026-115251 |
Public advisory; WPScan withholds the PoC until November 23, 2026. |
GoSMTP / CVE-2026-111577 |
Public advisory; WPScan withholds the PoC until November 26, 2026. |
Photo Reviews / CVE-2026-111404 |
Public advisory and finder credit; specific technical mechanism not established from the published entry. |
BulletProof Security / CVE-2026-119273 |
Public advisory; no known fix; WPScan withholds the PoC until November 21, 2026. |
EWWW Image Optimizer / CVE-2026-91049 |
Public advisory; WPScan withholds the PoC until November 16, 2026. |
Duplicator path disclosure / CVE-2026-112244 |
Public advisory; WPScan withholds the PoC until November 16, 2026. |
Forminator Forms / CVE-2026-111579 |
Public advisory; WPScan withholds the PoC until December 9, 2026. |
ProfilePress / CVE-2026-123657 |
Public advisory; WPScan withholds the PoC until November 23, 2026. |
WP Ultimate CSV Importer / CVE-2026-125912 |
Public advisory; WPScan withholds the PoC until December 11, 2026. |
The November 11 update adds technical reports for Apache OFBiz and HTTPD mod_vhost_alias, plus public disclosure summaries for Forminator, ProfilePress, and WP Ultimate CSV Importer. KEDA's report documents the fix identified in the official 2.21.0 release notes and its migration requirements; simple-git's report retains its separate source/fix discrepancy. My Linux portfolio documents three kernel CVEs and eighteen verified stable backports across four accepted mainline fixes.
Browse findings/ for individual reports and links to public advisories, releases, and upstream fixes.
I focus on the boundary that failed, the impact supported by the evidence, and the change needed to restore the intended behavior. My reports separate source analysis from runtime observations and preserve shared researcher and maintainer credit.
Charles Vosburgh — the-vibe-dev
My research spans authorization, sandboxing, parsing and deserialization, generated-code injection, WordPress integrations, and protocol security.
I also build SecHive.ai, an operator-driven security research workbench, and GuardianNode, a local-first family safety project currently in alpha.
Technical material in this repository is intended for defensive analysis, remediation, regression testing, patch verification, and systems the reader owns or is explicitly authorized to assess.