Advisory

Security Advisories

Original vulnerability research from the Payatu team, responsibly disclosed across mobile, web, connected devices, AI/ML products, hardware, firmware, and alot more.

100+

CVEs Disclosed

240+

Blogs & Write-ups

200+

Talks & Trainings

15+

Years of Research and Engagements
Red circular arrow icon indicating refresh or reload action on a transparent background.
Domain
Vulnerability Type
Severity
Black circular refresh icon with arrow pointing counterclockwise, symbolizing reset or reload.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Grid
List

Mozilla Firefox Same-Origin Policy Bypass via JAR URI Handling

Successful exploitation allows a network-based attacker to bypass fundamental browser security boundaries without requiring any user interaction or elevated privileges.
Browser
Spoofing
CWE-346
2026-03-17
High
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

UART port of the Wi-Fi module controller is open to access

This vulnerability allows an attacker with physical access to the device to fully extract the firmware and internal memory contents.
IoT & Hardware
Hardware / Firmware Exposure
Information Disclosure
CWE-200
2026-01-16
Medium
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

Bluetooth Classic LMP Handle Flaw Exploitation

The vulnerability affects the stability and reliability of the vehicle's infotainment system by allowing unauthenticated Bluetooth Classic traffic to interact with low-level protocol handling.
Automotive
Denial of Service
CWE-404
2025-12-15
High
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

Wireless Key Stroke Injection on vehicle Infotainment

Successful exploitation allows an attacker within Bluetooth range to inject unauthorized keystrokes into the infotainment system.
Automotive
Authentication & Access Bypass
CWE-306
2025-12-08
High
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

Wi-Fi De-Authentication of Connected Clients in Waveshare RS232/485 TO WIFI ETH (B)

Prevents legitimate Wi-Fi access and disrupts data relay between serial and Ethernet interfaces.
IoT & Hardware
Authentication & Access Bypass
CWE-284, CWE-300
2025-11-12
High
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

Cleartext Transmission of Administrator Credentials via HTTP Basic Authentication on Waveshare RS232/485 TO WIFI ETH (B)

Intercepted credentials enable remote administrative access.
IoT & Hardware
Information Disclosure
CWE-319
2025-11-12
High
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

Authentication Bypass via Blank Credentials in Waveshare RS232/485 TO WIFI ETH (B)

Unauthenticated attackers can fully control the device, alter network settings, and upload firmware.
IoT & Hardware
Authentication & Access Bypass
CWE-620
2025-11-12
Critical
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

Administrator Password Displayed in Plaintext on Waveshare RS232/485 TO WIFI ETH (B)

Exposes valid administrator credentials, enabling device compromise.
IoT & Hardware
Information Disclosure
CWE-522
2025-11-12
Medium
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

Unprotected Transport of Credentials on Murrelektronik Impact67 Pro

Murrelektronik: Unprotected Transport of Credentials The embedded web interface of the MURRELEKTRONIK IMPACT67 Pro PN DIO8 IOL8 transmits login credentials over unencrypted HTTP using a GET request.
IoT & Hardware
Information Disclosure
CWE-319
2025-11-09
High
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.
Critical

CVE-2014-8446 - Adobe Acrobat/Reader - Memory Corruption

Desktop Software
Memory Corruption
October 2, 2022
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2014-8446
2022-10-02
Medium

Hardcoded AES 256 bit key used in Kankun Smart socket and its mobile App

IoT & Hardware
Hardware / Firmware Exposure
Information Disclosure
CWE-310
CWE-310
October 2, 2022
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2015-4080
CWE-310
2022-10-02
Medium

Microsoft Internet Explorer CDOMStringDataList::InitFromString Out-Of-Bounds Indexing Information Disclosure Vulnerability

Browser
Information Disclosure
CWE-200
CWE-200
October 2, 2022
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2015-6086
CWE-200
2022-10-02
High

Adobe Reader Type Confusion - Memory Corruption Vulnerability

Desktop Software
Memory Corruption
CWE-119
CWE-119
October 2, 2022
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2017-3038
CWE-119
2022-10-02
Critical

Memory Corruption Mach-O 1

Desktop Software
Memory Corruption
CWE-787
CWE-787
October 2, 2022
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2017-8774
CWE-787
2022-10-02
Critical

OOB Write Heap Buffer dwCompressionSize MS-WIM

Desktop Software
Memory Corruption
CWE-787
CWE-787
October 2, 2022
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2017-8773
CWE-787
2022-10-02
Critical

OOB Write Stack Buffer LC_UNIXTHREAD.cmdsize Mach-O

Desktop Software
Memory Corruption
CWE-787
CWE-787
October 2, 2022
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2017-5005
CWE-787
2022-10-02
High

Insecure Library Loading

Desktop Software
Remote Code Execution
October 2, 2022
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2017-8776
2022-10-02
High

Non-ASLR & DEP Modules

Desktop Software
Other
October 2, 2022
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2017-8776
2022-10-02
See it in action

Watch the exploit

Our researchers demonstrating the vulnerabilities they found the working chain, start to finish, on the real device.
Person in a black polo shirt with Payatu logo standing against a red-orange gradient background with the SolarWinds logo and text 'SAML 2.0 Authentication Bypass' on the left.
Dhabaleshwar Das Finds Critical SolarWinds SAML Authentication Bypass | CVE-2026-28323
Dhableshwar Das
White play button icon inside a solid red circle.Man in a black polo shirt with Payatu logo stands smiling against a dark purple gradient background with a green stylized circuit board icon and text saying 'Path Traversal in Binwalk WinCE Extraction'.
The Security Tool That Became the Attack Surface
Dhableshwar Das
White play button icon inside a solid red circle.
Go deeper

The full story

An advisory tells you what broke. These write-ups tell you how we found it, why the patch held, and what it means for your own stack.
Application Security
How a Double-Encoded Null Byte Turns a ZIP File into an XSS Vector – CVE-2026-2790
April 24, 2026
10 min
Application Security
Security leaders
Researchers
For Security Leaders
Browser Security
Security Operations Center (SOC)
The Chrome Extension That Stole the CEO’s Cookies: A Confession on AI, Trust, and Supply Chain Security
May 8, 2026
10 min
Browser Security
Security Operations Center (SOC)
Researchers
Security leaders
For Security Leaders
IoT & hardware
Exploit dev & reverse engineering
Binwalk Path Traversal Vulnerability: Turning Firmware Analysis into Code Execution
June 10, 2026
8 min
IoT & hardware
Exploit dev & reverse engineering
Security leaders
Researchers
For Security Leaders
Research & disclosures
Dark scene with vertical thin orange lines resembling distant illuminated bars or streaks against a black background and a faint horizontal red glow near the bottom.

These CVEs started as someone's untested product

Get the same research depth pointed at your firmware, app or cloud before it ships.

Book an assessment
White arrow pointing diagonally upward to the right on a black square background.White arrow pointing diagonally upward to the right on a black square background.White arrow pointing diagonally upward to the right on a black square background.
Black downward arrow on a white background.Black downward arrow on a white background.
This is the default text value
White arrow pointing downward on a dark background.White arrow pointing downward on a dark background.
This is the default text value
White arrow pointing downward on a dark background.White arrow pointing downward on a dark background.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.