I'm Charles Vosburgh / the-vibe-dev, an independent security researcher and builder. I investigate authorization failures, sandbox escapes, parser behavior, and the trust boundaries that connect applications, libraries, and infrastructure.
This is my public collection of CVE and GitHub Security Advisory research: root-cause analysis, affected versions, remediation, and coordinated disclosures. My upstream kernel work is in Linux-Kernel.
| My public research | Count |
|---|---|
| Distinct public vulnerability cases, including Linux | 41 |
| Public CVEs, including Linux | 34 |
| Published repository GHSAs | 17 |
| Accepted Linux mainline fixes | 4 |
Updated October 2, 2026. The index below contains 39 non-kernel cases, 32 CVEs, and 17 repository GHSAs. My Linux portfolio adds two kernel CVE cases. Ten entries in this collection carry both a CVE and a GHSA.
| # | Identifier(s) | Project | Public finding | Public severity | Write-up state | Write-up |
|---|---|---|---|---|---|---|
| 01 | CVE-2026-73343 |
WP Compress | Unauthenticated remote code execution | Critical, 10.0 | Summary-only | Read |
| 02 | CVE-2026-15054 |
Bit Form | Inactive or unpublished forms remained reachable through public submission handlers | Low, 3.7 | Full | Read |
| 03 | CVE-2026-16534 |
Import and export users and customers | CSV import authorization failure | High, 7.2 | Full | Read |
| 04 | CVE-2026-64606 |
Apache Fory | Java lambda class-registration bypass | Important (Apache) / Critical, 9.8 (CISA ADP) | Full | Read |
| 05 | CVE-2026-75796 |
AI Engine | Multisite account-target authorization failure | High, 7.2 | Full | Read |
| 06 | CVE-2026-77789 |
Stripe Payment Forms by WP Full Pay | Cross-customer subscription modification | Medium, 4.3 | Full | Read |
| 07 | CVE-2026-77356 · GHSA-976x-prgx-qv35 |
TypeBox | Generated validation-code injection | High, 7.8 | Full | Read |
| 08 | CVE-2026-77355 · GHSA-6fxm-h49m-4fg3 |
isomorphic-git | NTFS alias bypass writing into the active gitdir | High, 8.8 | Full | Read |
| 09 | CVE-2026-47698 · GHSA-cfcw-xp6x-25gj |
vm2 | Sandbox breakout through dangerous host prototype mutators | Critical, 9.8 | Full | Read |
| 10 | CVE-2026-73569 · GHSA-8r6m-32jq-jx6q |
fast-xml-parser | Repeated DOCTYPE declarations reset entity-expansion limits |
High, 8.7 | Full | Read |
| 11 | GHSA-5jx8-p6q2-455g |
DynamicExpresso | LateBindObject reflection-restriction bypass |
High, 8.8 | Full | Read |
| 12 | GHSA-hphq-wq62-4mj3 |
OpenEXR | HTJ2K planar decode row-endpoint wrap causing denial of service | Moderate, 5.5 | Full | Read |
| 13 | CVE-2026-100415 · GHSA-v3qq-3xvg-m77g |
python-statemachine | Restricted-evaluator write-side dunder traversal | Critical, 9.1 | Full | Read |
| 14 | GHSA-fj3w-533r-fvf6 |
python-statemachine | Untrusted SCXML external-source local-file disclosure | High, 7.1 | Full | Read |
| 15 | GHSA-g3jj-5cmm-3hxx |
fast-jwt | Raw public JWK JSON accepted as an HMAC secret | High, 7.4 | Full | Read |
| 16 | CVE-2026-92948 · GHSA-qhwx-74w5-xhxq |
vm2 | NodeVM builtin allowlist bypass through node:test.run() |
Critical, 9.9 | Full | Read |
| 17 | CVE-2026-81766 |
Really Simple Security | Multisite subsite Administrator plugin installation | Medium, 6.6 | Full | Read |
| 18 | CVE-2026-17563 |
WP User Frontend | Unauthenticated post creation through a subscription-gated form | Not displayed by WPScan | Full | Read |
| 19 | CVE-2026-77793 |
RegistrationMagic | Paid-registration bypass through an omitted price field | Not displayed by WPScan | Full | Read |
| 20 | GHSA-9v3x-mhg4-wwv2 |
Exiv2 | Out-of-bounds stack access in built-in HTTP request construction | Low | Full | Read |
| 21 | CVE-2026-84451 · GHSA-hh47-fhqr-cj2r |
libheif | Incomplete range-check fix allowed integer wrap and out-of-bounds read | Moderate, 6.5 | Full | Read |
| 22 | CVE-2026-86815 |
BackWPup | Missing granular authorization on backup-management operations | Medium, 5.5 | Full | Read |
| 23 | CVE-2026-88764 |
Simple Membership | Payment not bound to authorized membership level | Medium, 5.4 | Full | Read |
| 24 | CVE-2026-89080 |
Really Simple Security | Email two-factor authentication bypass | High, 7.5 | Summary-only | Read |
| 25 | CVE-2026-102273 · GHSA-w2cx-738m-mc7w |
PyJWT | Public JWK containers accepted as HMAC verification secrets | High, 7.4 | Full | Read |
| 26 | GHSA-r2q2-xmpm-7fvh |
SimpleEval | Restricted-expression callable denylist bypass | Low | Full | Read |
| 27 | CVE-2026-92403 |
Secure Custom Fields | Unauthenticated post modification via front-end form ID substitution | Low, 3.7 | Full | Read |
| 28 | CVE-2026-92400 |
Payment Gateway for PayPal on WooCommerce | Unauthenticated payment bypass via sandbox IPN environment confusion | Not displayed by WPScan | Full | Read |
| 29 | CVE-2026-81810 |
All-in-One WP Migration and Backup | Configured export-only user privilege escalation to administrator | High, 7.2 | Summary-only | Read |
| 30 | CVE-2026-90922 |
Paid Member Subscriptions | PayPal amount and currency mismatch accepted for paid membership | Medium, 5.3 | Full | Read |
| 31 | CVE-2026-85569 |
Tutor LMS | Read-only API key privilege escalation via REST request misclassification | High, 7.2 | Summary-only | Read |
| 32 | CVE-2026-87978 |
Paymob for WooCommerce | Missing payment-notification authentication | Public advisory | Summary-only | Read |
| 33 | CVE-2026-74991 |
WPForms Lite | Cross-application payment-object authorization failure | Medium, 6.8 | Summary-only | Read |
| 34 | CVE-2026-78397 |
Link Library | Configuration-dependent reciprocal-link SSRF | Medium, 4.0 | Summary-only | Read |
| 35 | CVE-2026-96896 |
Malcure Malware Shield | Multisite authorization gap permitting file changes | High, 7.2 | Summary-only | Read |
| 36 | CVE-2026-77524 · GHSA-637c-6jxx-4rwm |
KEDA | Namespace-to-cluster credential boundary failure | Critical, 9.9 | Full | Read |
| 37 | CVE-2026-102827 · GHSA-858h-whjf-mvg5 |
simple-git | Unsafe-operation option interpretation mismatch | High, 8.1 | Full; fix discrepancy noted | Read |
| 38 | CVE-2026-104118 |
Razorpay for WooCommerce | Unauthenticated shipping-information modification | Medium, 5.3 | Summary-only | Read |
| 39 | GHSA-wqq5-5w4p-m569 |
Yamcs | Privileged templated-instance YAML reconfiguration injection | High, 7.2 | Full | Read |
This collection includes 30 technical write-ups and nine disclosure summaries. I publish technical details in coordination with maintainers and disclosure programs. Each report identifies its evidence, source-review scope, and testing basis.
| Summary | Detailed disclosure status |
|---|---|
WP Compress / CVE-2026-73343 |
Public advisory available; technical report pending. |
Really Simple Security email 2FA / CVE-2026-89080 |
WPScan scheduled: October 11, 2026. |
All-in-One WP Migration and Backup / CVE-2026-81810 |
WPScan scheduled: October 16, 2026. |
Tutor LMS / CVE-2026-85569 |
WPScan scheduled: October 14, 2026. |
Paymob / CVE-2026-87978 |
WPScan schedules PoC publication for October 5, 2026. |
WPForms Lite / CVE-2026-74991 |
WPScan schedules PoC publication for October 6, 2026. |
Link Library / CVE-2026-78397 |
WPScan schedules PoC publication for October 7, 2026. |
Malcure / CVE-2026-96896 |
WPScan schedules PoC publication for October 25, 2026. |
Razorpay / CVE-2026-104118 |
WPScan schedules PoC publication for October 16, 2026. |
Recent additions include Razorpay and Yamcs, expanded reports for BackWPup, Simple Membership, Secure Custom Fields, WooCommerce PayPal Gateway, and Paid Member Subscriptions, and CVE assignments for my PyJWT and python-statemachine reports. KEDA and simple-git's write-ups include their current remediation limitations.
Browse findings/ for individual reports and links to public advisories, releases, and upstream fixes.
I focus on the boundary that failed, the impact supported by the evidence, and the change needed to restore the intended behavior. My reports separate source analysis from runtime observations and preserve shared researcher and maintainer credit.
Charles Vosburgh — the-vibe-dev
My research spans authorization, sandboxing, parsing and deserialization, generated-code injection, WordPress integrations, and protocol security.
I also build SecHive.ai, an operator-driven security research workbench, and GuardianNode, a local-first family safety project currently in alpha.
Technical material in this repository is intended for defensive analysis, remediation, regression testing, patch verification, and systems the reader owns or is explicitly authorized to assess.