Security vulnerability research by Charles Vosburgh / the-vibe-dev.
This repository is the public-facing archive for my CVE and GitHub Security Advisory research. It is intentionally limited to vulnerability disclosures and write-ups. My upstream Linux kernel contribution work is maintained separately in the-vibe-dev/Linux-Kernel.
Publication status: The repository is currently private for final inspection. The present tree is designed to be safe to publish. Findings that are not yet cleared for detailed publication contain non-technical placeholders only; their embargoed mechanics have not been committed to this recreated repository.
| Metric | Count |
|---|---|
| Unique vulnerability findings | 16 |
| CVE records | 10 |
| GitHub Security Advisories | 10 |
| Full public researcher write-ups | 13 |
| Assigned CVEs awaiting detailed publication | 3 |
A finding with both a CVE and a GHSA is counted once under unique findings and once in each applicable identifier count.
| # | Identifier(s) | Project | Finding / status | Severity | Publication | Write-up |
|---|---|---|---|---|---|---|
| 01 | CVE-2026-73343 |
WP Compress | Detailed technical write-up withheld pending public-release clearance | Critical in public record | Placeholder | Open |
| 02 | CVE-2026-15054 |
Bit Form | Unauthenticated inactive-form submission | Low | Full | Read |
| 03 | CVE-2026-16534 |
Import and export users and customers | CSV authorization failure crossing WordPress user-management boundaries | High | Full | Read |
| 04 | CVE-2026-64606 |
Apache Fory | Class-registration bypass through an auto-admitted SerializedLambda capture interface |
Important (Apache CNA) / Critical (CISA ADP) | Full | Read |
| 05 | CVE-2026-75796 |
AI Engine | Assigned CVE; detailed write-up held until September 19, 2026 and advisory re-check | High | Placeholder | Open |
| 06 | CVE-2026-77789 |
Stripe Payment Forms by WP Full Pay | Assigned CVE; detailed write-up held until September 7, 2026 and advisory re-check | Medium | Placeholder | Open |
| 07 | CVE-2026-77356 · GHSA-976x-prgx-qv35 |
TypeBox | Generated validation-code injection through schema-controlled strings | High | Full | Read |
| 08 | CVE-2026-77355 · GHSA-6fxm-h49m-4fg3 |
isomorphic-git | NTFS .git::$INDEX_ALLOCATION alias bypass writes into the active gitdir |
High | Full | Read |
| 09 | CVE-2026-47698 · GHSA-cfcw-xp6x-25gj |
vm2 | Sandbox breakout using dangerous host prototype mutators | Critical | Full | Read |
| 10 | CVE-2026-73569 · GHSA-8r6m-32jq-jx6q |
fast-xml-parser | Repeated DOCTYPE declarations reset entity-expansion limits |
High | Full | Read |
| 11 | GHSA-5jx8-p6q2-455g |
DynamicExpresso | LateBindObject bypasses reflection restrictions and enables host command execution |
High | Full | Read |
| 12 | GHSA-hphq-wq62-4mj3 |
OpenEXR | HTJ2K planar decode signedness bug causes denial of service | Moderate | Full | Read |
| 13 | GHSA-v3qq-3xvg-m77g |
python-statemachine | Restricted write-side dunder traversal corrupts shared model state | Critical | Full | Read |
| 14 | GHSA-fj3w-533r-fvf6 |
python-statemachine | External SCXML source file disclosure | High | Full | Read |
| 15 | GHSA-g3jj-5cmm-3hxx |
fast-jwt | Raw public JWK JSON accepted as an HMAC secret | High | Full | Read |
| 16 | GHSA-qhwx-74w5-xhxq |
vm2 | NodeVM builtin allowlist bypass through node:test.run() / execArgv |
Critical | Full | Read |
The three placeholder folders intentionally contain no vulnerable source locations, handler names, request structures, attack sequences, payloads, unpublished PoCs, or private validation details.
| CVE | Project | Detailed publication status |
|---|---|---|
CVE-2026-73343 |
WP Compress | Add only after public researcher-writeup clearance. |
CVE-2026-77789 |
WP Full Pay | Add no earlier than September 7, 2026 |
CVE-2026-75796 |
AI Engine | Add no earlier than September 19, 2026 |
This repository is intentionally writeup-only:
CVE-GHSA/
├── README.md
└── findings/
├── <cleared-finding>/
│ └── README.md # full public researcher write-up
└── <not-yet-cleared-finding>/
└── README.md # non-technical placeholder only
There are no raw research archives, evidence directories, private request/response captures, disclosure correspondence, credentials, unpublished exploit harnesses, or separate private PoC payload files here.
Where a PoC is already public, the corresponding write-up can explain the public proof, validation controls, and public source without duplicating private research material.
The write-ups separate:
- publisher-stated affected ranges from independently sampled releases;
- source review from runtime reproduction;
- the direct vulnerability primitive from downstream impact;
- vulnerable, negative, and fixed controls;
- discovery/reporting credit from patch authorship;
- public PoC material from intentionally withheld research material.
The goal is not simply to restate advisory summaries. Each write-up focuses on the failed security invariant, why the existing protection was insufficient, how the fix changes the boundary, and what maintainers should test to prevent regression.
Charles Vosburgh — the-vibe-dev
Independent security researcher focused on authorization boundaries, sandbox escapes, parser and deserialization behavior, generated-code injection, WordPress attack surfaces, protocol security, and controlled vulnerability reproduction.
The technical material in this repository is intended for defensive analysis, remediation, regression testing, patch verification, and systems the reader owns or is explicitly authorized to assess.