Advisory

Security Advisories

Original vulnerability research from the Payatu team, responsibly disclosed across mobile, web, connected devices, AI/ML products, hardware, firmware, and alot more.

100+

CVEs Disclosed

240+

Blogs & Write-ups

200+

Talks & Trainings

15+

Years of Research and Engagements
Red circular arrow icon indicating refresh or reload action on a transparent background.
Domain
Vulnerability Type
Severity
Black circular refresh icon with arrow pointing counterclockwise, symbolizing reset or reload.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Grid
List

Adobe Acrobat Reader Heap Overflow Remote Code Execution Vulnerability

Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Acrobat…
Desktop Software
Memory Corruption
CWE-787
2022-10-01
Critical
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

Foxit Reader - CPDF_Parser::m_pCryptoHandler - Use After Free - RCE

Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code This vulnerability allows remote attackers to execute arbitrary code on vulnerable…
Desktop Software
Memory Corruption
CWE-416
2022-10-01
Critical
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

Opera Mini Location Permission Spoof

Opera Mini Location Permission Spoof Vulnerability A location permission spoof vulnerability was discovered in opera mini 47.1.2249.129326 for Android which allows an attacker to spoof location…
Browser
Spoofing
2022-10-01
Medium
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

Adobe Reader Out-Of-Bounds Read Information Disclosure Vulnerability

Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Adobe…
Desktop Software
Memory Corruption
CWE-125
2022-10-01
Medium
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.

jscript.dll - ActiveXObject BSTR - Use After Free

Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.
Browser
Memory Corruption
CWE-787
2022-09-27
High
IoT text with radio waves icon, symbolizing Internet of Things technology.
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
Black triangular area covering the bottom left corner extending diagonally to the top right edge on a white background.
Medium

FluentSMTP <= 2.2.2 Stored XSS via Email Logs

Web / CMS
Cross-Site Scripting (XSS)
CWE-79
CWE-79
June 19, 2023
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2023-0545
CWE-79
2023-06-19
High

WP ALL Export Pro < 1.7.9 - Authenticated SQLi

Web / CMS
SQL / NoSQL Injection
CWE-89
CWE-89
January 18, 2023
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2022-3395
CWE-89
2023-01-18
High

Import all XML, CSV & TXT into WordPress < 6.5.8 - Admin+ SQLi

Web / CMS
SQL / NoSQL Injection
CWE-89
CWE-89
January 18, 2023
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2022-3243
CWE-89
2023-01-18
Medium

CloudSchool v3.0.1 is vulnerable to Cross Site Scripting (XSS)

Web / CMS
Cross-Site Scripting (XSS)
CWE-79
CWE-79
January 16, 2023
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2022-46087
CWE-79
2023-01-16
Medium

Flatpress v1.2.1 reflected XSS via page parameter at /flatpress/admin.php

Web / CMS
Cross-Site Scripting (XSS)
CWE-79
CWE-79
January 16, 2023
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2022-40047
CWE-79
2023-01-16
High

Remote code execution (RCE) via Upload File bypass in Flatpress 1.2.1

Web / CMS
Remote Code Execution
CWE-434
CWE-434
January 16, 2023
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2022-40048
CWE-434
2023-01-16
Medium

Drag and Drop Multiple File Upload < 1.3.6.5 - File Upload Size Limit Bypass

Web / CMS
Authentication & Access Bypass
CWE-639
CWE-639
January 6, 2023
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2022-3282
CWE-639
2023-01-06
High

Command Injection in GitHub repository Nuitka/Nuitka prior to 0.9

Developer Tools & Libraries
Remote Code Execution
CWE-94
CWE-94
October 5, 2022
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2022-2054
CWE-94
2022-10-05
High

Privilege Escalation in Konga v0.14.9

Developer Tools & Libraries
Authentication & Access Bypass
CWE-863
CWE-863
October 5, 2022
Dark gray arrow pointing to the right on a transparent background.Dark gray arrow pointing to the right on a transparent background.
CVE-2021-42192
CWE-863
2022-10-05
See it in action

Watch the exploit

Our researchers demonstrating the vulnerabilities they found the working chain, start to finish, on the real device.
Person in a black polo shirt with Payatu logo standing against a red-orange gradient background with the SolarWinds logo and text 'SAML 2.0 Authentication Bypass' on the left.
Dhabaleshwar Das Finds Critical SolarWinds SAML Authentication Bypass | CVE-2026-28323
Dhableshwar Das
White play button icon inside a solid red circle.Man in a black polo shirt with Payatu logo stands smiling against a dark purple gradient background with a green stylized circuit board icon and text saying 'Path Traversal in Binwalk WinCE Extraction'.
The Security Tool That Became the Attack Surface
Dhableshwar Das
White play button icon inside a solid red circle.
Go deeper

The full story

An advisory tells you what broke. These write-ups tell you how we found it, why the patch held, and what it means for your own stack.
Web & API
Mobile
Safari Address Bar Spoof (CVE-2020-3833)
January 29, 2020
2 mins
Web & API
Mobile
Engineers
Researchers
Research & disclosures
Application Security
How a Double-Encoded Null Byte Turns a ZIP File into an XSS Vector – CVE-2026-2790
April 24, 2026
10 min
Application Security
Security leaders
Researchers
For Security Leaders
Browser Security
Security Operations Center (SOC)
The Chrome Extension That Stole the CEO’s Cookies: A Confession on AI, Trust, and Supply Chain Security
May 8, 2026
10 min
Browser Security
Security Operations Center (SOC)
Researchers
Security leaders
For Security Leaders
Dark scene with vertical thin orange lines resembling distant illuminated bars or streaks against a black background and a faint horizontal red glow near the bottom.

These CVEs started as someone's untested product

Get the same research depth pointed at your firmware, app or cloud before it ships.

Book an assessment
White arrow pointing diagonally upward to the right on a black square background.White arrow pointing diagonally upward to the right on a black square background.White arrow pointing diagonally upward to the right on a black square background.
Black downward arrow on a white background.Black downward arrow on a white background.
This is the default text value
White arrow pointing downward on a dark background.White arrow pointing downward on a dark background.
This is the default text value
White arrow pointing downward on a dark background.White arrow pointing downward on a dark background.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.