- 7-Zip — HKCU DLL hijack to persistent code execution, MotW bypass across five archive formats, and 27 other things from a full source audit
- MyBB 1.8.39 — IPv6 SSRF via remote avatar, stored XSS in buddy selector, mail header injection, ACP language-properties RCE, and a chain from regular user to code execution
- vencord — 5 critical RCE paths, sandbox disabled, CSP gutted, 39 findings across the Discord client mod that mass-roots its users by design
- windows 11 — SYSTEM-context scheduled task writable by any user, world-writable named pipes with SID spoofing, and what the local privilege escalation surface looks like after a thorough sweep
- gang beasts — pre-auth network RCE in a wobbly-arms party game
- lunar client — 1-click RCE from any website (and 30 other things, plus the infrastructure)
- omoggle — 29 vulns in a Supabase social app, including IDOR on a writable view that owns 405k profiles
- overcooked! 2 — RCE via -overrideMonoSearchPath, plus DLL hijacking on a writable install dir, on a Unity LTS that will never get fixed