Where we can help

Start with what you need.

  1. Test your systems.

    Foxhound

    Automated assessment steps inside a scope you approve, with a tester signing off findings before delivery.

    Explore pentesting

  2. Know your extensions.

    RiskyPlugins

    Risk profiles for 550K+ browser and IDE extensions across nine marketplaces.

    Explore extension intelligence

  3. Control what gets installed.

    PrivateStoresPrivate preview

    Your developers install from a catalogue you approved, with risk thresholds and release holds enforced as policy.

    Explore PrivateStores

Vulnerability research

Research you can inspect.

Our findings, fix verification, and related advisories. Each card identifies who did the work.

  • GHSA-fwqx-cc24-3j43 CVSS 8.8

    Leantime: owner account takeover through onboarding

    Target
    Leantime 3.9.0–3.9.8
    Class
    CWE-269, CWE-862

    A low-privilege account can change an owner’s password and role through the JSON-RPC onboarding API, then activate the account and take control.

    Reported by Hamid Babaee. Foxhound is credited as a tool. Leantime lists 3.10.0 as patched; we have not independently retested that release. Read the advisory
  • CVE-2026-85990 CVSS 8.8

    Related advisory

    Leantime: authenticated user gains admin privileges

    Target
    Leantime ≤ 3.9.5
    Class
    CWE-269, CWE-862

    An earlier privilege-escalation advisory cited in our Leantime account-takeover analysis. It covers a separate route through the same JSON-RPC authorization problem.

    Reported by tinyb0y. Included as related research; this is not a Fenko discovery. Read the advisory
  • CVE-2026-65819 CVSS 7.5

    Eleven layer decoders panic on crafted packets

    Target
    gopacket < 1.7.0
    Class
    Out-of-bounds read

    Decoders across TLS, DHCPv4, sFlow, Diameter, GTPv1-U, RadioTap and more slice packet data using attacker-controlled length and offset fields before checking them against the buffer. A malformed packet panics the decoding goroutine.

    Credited to Fenko. Published 27 July 2026 as GHSA-8mcr-459q-5mx2, fixed in 1.7.1. Read the advisory
  • CVE-2026-54345 7 Jun 2026

    Diameter AVP decoder: uint32 underflow on vendor header size

    Target
    gopacket <= 1.6.0
    Class
    CWE-191, CWE-770

    An integer underflow on the vendor header size lets a single crafted message drive an unbounded allocation of roughly 4 GiB, exhausting memory without authentication.

    Reported by tonghuaroot. Fenko is credited as remediation verifier: we confirmed the fix, we did not find the bug. Published 7 June 2026, fixed in 1.6.1. Read the advisory
  • CVE-2026-54332 7 Jun 2026

    sFlow decoder: unbounded allocation from a 104-byte datagram

    Target
    gopacket <= 1.6.0
    Class
    CWE-770

    A 104-byte UDP datagram reaches an attacker-controlled make in the ExtendedGatewayFlow decoder and can request up to 16 GiB, exhausting memory without authentication.

    Reported by tonghuaroot. Fenko is credited as remediation verifier: we confirmed the fix, we did not find the bug. Published 7 June 2026, fixed in 1.6.1. Read the advisory
  • CVE-2026-12606 7 Jun 2026

    HTTP request smuggling via header-name parsing

    Target
    Eclipse Grizzly 2.1.11 to 5.0.1
    Class
    CWE-444

    The parser ends a header name at the first colon without checking for CR, LF or space, so a Content-Length tucked into a header name never gets treated as framing.

    Same defect and same fix as CVE-2026-12606, which Eclipse assigned from a separate trailer-section report. Our analysis reached security@eclipse.org on 7 June 2026 and reproduces back to 2.1.11, wider than the 4.0.0 to 5.0.1 range published against that ID. Read the research

Further advisories are in coordinated disclosure and will be listed here once they are published.