Security Research
An unauthenticated collection endpoint fetches any URL and returns the body, reaching the internal Kubernetes network behind ESA's Euclid Data Space Portal.
The overview link route took a URL from an anonymous caller, fetched it server side with no egress restriction, and handed the full response back.
An unchecked size determinant in ESA asn1scc ACN decoders writes past the end of a fixed-size array. GHSA-g49g-f3f6-g578
The compiler generated a memcpy whose length came from the wire, not from the schema, and the guard that should have stopped it was never emitted.
CodeSigningHelper follows an Info.plist symlink and returns any root-readable file. CVE-2026-84508
A root helper in Security.framework never checks its caller, follows a symlink its own header forbids, and compares the caller's hash against the wrong slot.
A search parameter reflected without encoding chains to one-click account takeover.
The search results page encoded user input at five reflection points and missed the sixth, and the password-change form behind it required no current password.
A caller-supplied bit skips ScopedBookmarkAgent's entitlement check. CVE-2026-84559
The agent asks three times whether a caller may create an app-scoped bookmark, and a bit the caller sets in its own request jumps over all three.
ScopedBookmarkAgent mints a whole volume read extension and downgrades a read-only descriptor. CVE-2026-43785
Two defects in the agent that turns security scoped bookmarks into sandbox extensions, from the profile rule it stands in for to the branch that skips the write check.
WebGPU importExternalTexture bypasses cross-origin video pixel protection. CVE-2026-43735
Tracing a missing origin-clean validation in WebKit from the existing Canvas2D guard to an addressed WebGPU security issue.