JOIN

JOIN

OBSERVE // QUESTION // RESEARCH

Research beyond the obvious

Technical notes, vulnerability research, reverse engineering and offensive security.

LATEST RESEARCH MEET HAKAI SECURITY

Yokai research character

PERCEPTION // BEYOND THE OBVIOUS

01

LATEST SIGNAL

VIEW ARCHIVE

[EN] Behind the Mirror: Investigating Vulnerabilities in MagicMirror² (CVE-2026-63642, CVE-2026-63643)

NEW RESEARCH 01 Oct 2026

en

[EN] Behind the Mirror: Investigating Vulnerabilities in MagicMirror² (CVE-2026-63642, CVE-2026-63643)

During an analysis of the source code of MagicMirror², an open-source platform used to turn a semi-transparent mirror into a smart display, the Yokai Research Team from Hakai Security identified two recent Server-Side Request Forgery

BY Gabriel Alves 6 MIN READ

↗

[Pt-Br] Por Trás do Espelho: Investigando Vulnerabilidades no MagicMirror² (CVE-2026-63642, CVE-2026-63643)

NEW RESEARCH 01 Oct 2026

pt-br

[Pt-Br] Por Trás do Espelho: Investigando Vulnerabilidades no MagicMirror² (CVE-2026-63642, CVE-2026-63643)

Durante uma análise do código-fonte do MagicMirror², uma plataforma open source utilizada para transformar um espelho semitransparente em um display inteligente, o time Yokai da Hakai Security identificou duas vulnerabilidades recentes de Server-Side Request Forgery (SSRF)

BY Gabriel Alves 6 MIN READ

↗

02

RESEARCH AREAS

CLASSIFICATION MATRIX

Insights Blog

19 ENTRIES

Research Blog

65 ENTRIES

White paper

1 ENTRY

03

LATEST RESEARCH

FIELD NOTES / REPORTS

[EN] Behind the Mirror: Investigating Vulnerabilities in MagicMirror² (CVE-2026-63642, CVE-2026-63643)

en 01.10.26

[EN] Behind the Mirror: Investigating Vulnerabilities in MagicMirror² (CVE-2026-63642, CVE-2026-63643)

During an analysis of the source code of MagicMirror², an open-source platform used to turn a semi-transparent mirror into a smart display,

[PT-BR] CVE-2026-16764: Uma validação faltando, acesso total

pt-br 25.09.26

[PT-BR] CVE-2026-16764: Uma validação faltando, acesso total

O OWASP DefectDojo é uma plataforma open-source de gerenciamento de vulnerabilidades amplamente utilizada por equipes de segurança para centralizar, rastrear e priorizar findings

[EN] CVE-2026-16764: Missing validation, full access

en 25.09.26

[EN] CVE-2026-16764: Missing validation, full access

OWASP DefectDojo is an open-source vulnerability management platform widely used by security teams to centralize, track, and prioritize findings from various scanning tools.

PT-BR - Beerus Framework: iOS - O canivete suíço para iOS

pt-br 18.09.26

PT-BR - Beerus Framework: iOS - O canivete suíço para iOS

Em julho deste ano, lançamos a v1.1 do Beerus Framework para Android. Agora, em setembro, damos mais um passo na evolução do projeto

EN - Beerus Framework: iOS - The Swiss Army Knife for iOS

en 18.09.26

EN - Beerus Framework: iOS - The Swiss Army Knife for iOS

This past July, we released v1.1 of the Beerus Framework for Android. Now, in September, we take another step in the project'

[PT-BR] CVE-2026-40083: SQL Injection no Cacti

Research Blog 27.08.26

[PT-BR] CVE-2026-40083: SQL Injection no Cacti

Resumo A equipe de pesquisa Yokai, da Hakai Security, identificou uma vulnerabilidade de Injeção de SQL nas versões do Cacti <= 1.2.30.

[EN] CVE-2026-40083: SQL Injection in Cacti

Research Blog 27.08.26

[EN] CVE-2026-40083: SQL Injection in Cacti

Summary The Yokai research team, from Hakai Security, identified a SQL Injection vulnerability in Cacti versions <= 1.2.30. The flaw allows an

CVE-2026-42931: DoS por leitura ilimitada do corpo da requisição no endpoint npm do Gitea

Research Blog 14.08.26

CVE-2026-42931: DoS por leitura ilimitada do corpo da requisição no endpoint npm do Gitea

Abstract Quanto de memória uma pequena requisição destinada a alterar a tag de um pacote deveria consumir? Em condições normais, apenas alguns bytes. Afinal,

RESEARCH DISPATCH

Receive new findings when they surface.

No noise. Just the latest from our research feed.