caverav

TL;DR There’s a growing narrative floating around that Capture The Flag (CTF) competitions are “dead” because of modern LLMs.

TL;DR DOMPurify 3.1.3 through 3.3.1 contained an mXSS edge case that became exploitable when sanitized output was reparsed inside special wrappers such as xmp, iframe, noembed, noframes, noscript, and script.

TL;DR Svelte 5.46.0 through 5.46.3 shipped an SSR XSS in the async hydration pipeline.

TL;DR Jenkins’ plain CLI endpoint (/cli?

TL;DR While testing OpenSearch 3.2.0, I found an asymmetric Denial of Service (DoS) condition in how the engine handles query_string queries.

TL;DR This blog post is dense and time-consuming to read in full.

Executive Summary I discovered an XML Injection vulnerability in xmltodict version 0.14.2, a popular Python library with over 1.5 million weekly downloads on PyPI.

TL;DR Markdown-it 14.1.0 contains an XSS vulnerability (CVE-2025-7969) that enables arbitrary JavaScript execution through a fence rendering bypass.

TL;DR Linkify.js 4.3.1 contains a prototype pollution vulnerability (CVE-2025-8101) that enables remote code execution through XSS.