Advisory

Security Advisories

Original vulnerability research from the Payatu team, responsibly disclosed across mobile, web, connected devices, AI/ML products, hardware, firmware, and alot more.

100+

CVEs Disclosed

240+

Blogs & Write-ups

200+

Talks & Trainings

15+

Years of Research and Engagements
Red circular arrow icon indicating refresh or reload action on a transparent background.
Domain
Vulnerability Type
Severity
Black circular refresh icon with arrow pointing counterclockwise, symbolizing reset or reload.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Grid
List

CVE-2014-8446 - Adobe Acrobat/Reader - Memory Corruption

Memory corruption vulnerability that could lead to code execution.
Desktop Software
Memory Corruption
2022-10-02
Critical
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

Hardcoded AES 256 bit key used in Kankun Smart socket and its mobile App

Hardcoded AES 256 bit key used in Kankun Smart socket and its mobile App.
IoT & Hardware
Hardware / Firmware Exposure
Information Disclosure
CWE-310
2022-10-02
Medium
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

Microsoft Internet Explorer CDOMStringDataList::InitFromString Out-Of-Bounds Indexing Information Disclosure Vulnerability

Microsoft Internet Explorer CDOMStringDataList::InitFromString Out-Of-Bounds Indexing Information Disclosure Vulnerability This vulnerability allows remote attackers to disclose sensitive information…
Browser
Information Disclosure
CWE-200
2022-10-02
Medium
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

Adobe Reader Type Confusion - Memory Corruption Vulnerability

Adobe Reader Type Confusion – Memory Corruption Vulnerability This vulnerability allows remote attackers to execute code on vulnerable installations of Adobe Reader.
Desktop Software
Memory Corruption
CWE-119
2022-10-02
High
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

Memory Corruption Mach-O 1

Quick Heal Internet Security Memory Corruption Vulnerability We found that the Quick Heal Internet Security is vulnerable to Memory Corruption while parsing malformed Mach-O file.
Desktop Software
Memory Corruption
CWE-787
2022-10-02
Critical
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

OOB Write Heap Buffer dwCompressionSize MS-WIM

Quick Heal Internet Security Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability We found that the Quick Heal Internet Security is vulnerable to Out of Bound Write…
Desktop Software
Memory Corruption
CWE-787
2022-10-02
Critical
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

OOB Write Stack Buffer LC_UNIXTHREAD.cmdsize Mach-O

Quick Heal Internet Security Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability We found that the Quick Heal Internet Security is vulnerable to Out of Bound Write…
Desktop Software
Memory Corruption
CWE-787
2022-10-02
Critical
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

Insecure Library Loading

Quick Heal Internet Security Uncontrolled Search Path Element Vulnerability We found that the Quick Heal Installer Downloader (QuickHealInternetSecurity.EXE) and Quick Heal Installer (QHISFT32.EXE)…
Desktop Software
Remote Code Execution
2022-10-02
High
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

Non-ASLR & DEP Modules

Quick Heal AntiVirus Protection Mechanism Failure Vulnerability We found that approximately 165 PE files in Quick Heal AntiVirus default installation that does not use ASLR/DEP protection mechanism…
Desktop Software
Other
2022-10-02
High
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.
Critical

SAML 2.0 Authentication Bypass in SolarWinds Web Help Desk

Enterprise & Mobile
Authentication & Access Bypass
CWE-287
CWE-287
July 30, 2026
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2026-28323
CWE-287
2026-07-30
Medium

Extplorer Component up to 2.1.15 on Joomla cross site scripting

Web / CMS
Cross-Site Scripting (XSS)
CWE-79
CWE-79
July 7, 2026
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2023-40628
CWE-79
2026-07-07
Medium

Extension - advcomsys.com - XSS in oneVote component for Joomla <= 1.7.0

Web / CMS
Cross-Site Scripting (XSS)
CWE-79
CWE-79
July 8, 2026
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2023-23756
CWE-79
2026-07-08
High

CVE-2026-8971: Mozilla Firefox Same-Origin Policy Bypass via JAR URI Null Byte Handling

Browser
Spoofing
CWE-158, CWE-346
CWE-158, CWE-346
June 17, 2026
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2026-8971, CVE-2025-1936, CVE-2026-2790
CWE-158, CWE-346
2026-06-17
Medium

Code Injection Vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java)

Enterprise & Mobile
Remote Code Execution
CWE-94
CWE-94
June 3, 2026
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2026-27674
CWE-94
2026-06-03
Medium

Path Traversal in Binwalk WinCE Extraction Leading to Arbitrary File Write and Code Execution

Developer Tools & Libraries
Remote Code Execution
CWE-22
CWE-22
May 27, 2026
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2026-7179
CWE-22
2026-05-27
Critical

Static GPS spoofing on Infotainment System

Automotive
Spoofing
CWE-941
CWE-941
April 22, 2026
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2025-69515
CWE-941
2026-04-22
Medium

Exposure of Stored Credentials via Open UART Logs and Firmware Dump

IoT & Hardware
Hardware / Firmware Exposure
Information Disclosure
CWE-200
CWE-200
April 22, 2026
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2026-30613
CWE-200
2026-04-22
Medium

Insecure Deserialization Leading to Arbitrary Code Execution in datrie.Trie

Developer Tools & Libraries
Remote Code Execution
CWE-502, CWE-20
CWE-502, CWE-20
April 8, 2026
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2026-5659
CWE-502, CWE-20
2026-04-08
See it in action

Watch the exploit

Our researchers demonstrating the vulnerabilities they found the working chain, start to finish, on the real device.
Person in a black polo shirt with Payatu logo standing against a red-orange gradient background with the SolarWinds logo and text 'SAML 2.0 Authentication Bypass' on the left.
Dhabaleshwar Das Finds Critical SolarWinds SAML Authentication Bypass | CVE-2026-28323
Dhableshwar Das
White play button icon inside a solid red circle.Man in a black polo shirt with Payatu logo stands smiling against a dark purple gradient background with a green stylized circuit board icon and text saying 'Path Traversal in Binwalk WinCE Extraction'.
The Security Tool That Became the Attack Surface
Dhableshwar Das
White play button icon inside a solid red circle.
Go deeper

The full story

An advisory tells you what broke. These write-ups tell you how we found it, why the patch held, and what it means for your own stack.
IoT & hardware
Exploit dev & reverse engineering
Binwalk Path Traversal Vulnerability: Turning Firmware Analysis into Code Execution
June 10, 2026
8 min
IoT & hardware
Exploit dev & reverse engineering
Security leaders
Researchers
For Security Leaders
Research & disclosures
Dark scene with vertical thin orange lines resembling distant illuminated bars or streaks against a black background and a faint horizontal red glow near the bottom.

These CVEs started as someone's untested product

Get the same research depth pointed at your firmware, app or cloud before it ships.

Book an assessment
White arrow pointing diagonally upward to the right on a black square background.White arrow pointing diagonally upward to the right on a black square background.White arrow pointing diagonally upward to the right on a black square background.
Black downward arrow on a white background.Black downward arrow on a white background.
This is the default text value
White arrow pointing downward on a dark background.White arrow pointing downward on a dark background.
This is the default text value
White arrow pointing downward on a dark background.White arrow pointing downward on a dark background.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.