el8

Security research,
responsibly disclosed.

10 resolved reports. 10 findings with public fixes.
Platform records cover November 2025 through August 2026; vendor entries cite the published fix.

Confirmed record

Platform counts are reports marked resolved. Vendor counts are distinct findings with public fixes; the two sets may overlap. Unpublished and unpatched work stays off this page.

HackerOne

07 resolved

Seven reports stored as resolved by HackerOne.

Bugcrowd

02 resolved

Two reports stored as resolved by Bugcrowd.

YesWeHack

01 resolved

One report stored as resolved by YesWeHack.

fasthttp

01 merged fix

A raw Content-Length/body mismatch enabled request smuggling and cross-caller response theft on a shared PipelineClient. Merged PR #2470 fixes the framing and credits this research.

Keycloak

01 fixed finding

SAML brokering did not enforce SubjectConfirmationData.NotOnOrAfter. CVE-2026-1190 credits this research; Keycloak 26.5.4 includes the fix.

OpenBSD

07 findings

ldapd. An authentication result could complete another connection's Bind. 7.9 errata 021, CVE-2026-103547.
isakmpd. A short IKEv1 HASH could overflow the heap. 7.9 errata 031, CVS rev 1.117.
isakmpd. Privileged monitor file handling accepted paths outside its intended scope. CVS rev 1.85.
isakmpd. Peer-derived policy paths could traverse directories. CVS rev 1.107.
npppd. A worker could request file opens without sufficient path validation. CVS HEAD rev 1.31.
npppd. An oversized IPCP request could expose stack bytes in a ConfRej reply. CVS HEAD rev 1.7.
npppd. PPPoE TLV length handling could access memory out of bounds. CVS HEAD rev 1.27.

NetBSD

01 HEAD fix

IPV6_IPSEC_POLICY could overrun an mbuf. kern/60669 records the HEAD fix; release pullups remain pending.

Private research stays private.