EN - Beerus Framework: iOS - The Swiss Army Knife for iOS
This past July, we released v1.1 of the Beerus Framework for Android. Now, in September, we take another step in the project'
RESEARCH AREA
en
![[EN] CVE-2026-40083: SQL Injection in Cacti](/content/images/size/w720/hakaisecurity-io/wp-content/uploads/2026/08/en_artigo_blog_cacti.png)
[EN] CVE-2026-40083: SQL Injection in Cacti
Summary The Yokai research team, from Hakai Security, identified a SQL Injection vulnerability in Cacti versions <= 1.2.30. The flaw allows an
CVE-2026-42931: DoS via Unbounded Request Body Read in Gitea’s npm Endpoint
Abstract How much memory should a small request intended to change a package's tag consume? Under normal conditions, just a few bytes.
![[EN] Build Your Nightmare - Dissecting CVE-2026-12191](/content/images/size/w720/hakaisecurity-io/wp-content/uploads/2026/07/bispocveen.png)
[EN] Build Your Nightmare - Dissecting CVE-2026-12191
Summary As the global autonomous vehicle market grows, the security of critical driver assistance systems may be hanging by a thread. Our recent research
Beerus Framework: v1.1 - KernelSU, gRPC Transport and Fixes
A few months after the initial release of the Beerus Framework, we are publishing version v1.1, a minor update that brings support for
Discovering 0-days in HTML-to-PDF Generators (90 million monthly targets)
By Pedro "gankd" Cruz — Pentest Analyst and Vulnerability Researcher at Hakai Security. Almost every feature-rich application emits a PDF at some
![[EN] CVE-2026-44706: SQL Injection in Chatwoot FilterService](/content/images/size/w720/hakaisecurity-io/wp-content/uploads/2026/06/blog_sqlinjec.png)
[EN] CVE-2026-44706: SQL Injection in Chatwoot FilterService
Summary The Hakai Security Research Team has identified a critical SQL Injection vulnerability in Chatwoot versions <= 4.11.1 that allows any authenticated
Reverse Engineering SmartLoader: Where Commodity Malware and Operational Tooling Diverge
Introduction SmartLoader is a commodity loader currently in active deployment, attributed to Malware-as-a-Service infrastructure that has been linked to LummaStealer delivery
![[EN] CVE-2026-4802: Command execution on Cockpit](/content/images/size/w720/hakaisecurity-io/wp-content/uploads/2026/05/artigo_blog_cockpit.png)
[EN] CVE-2026-4802: Command execution on Cockpit
A command injection vulnerability has been identified in Cockpit, discovered by Hakai's Research team. The flaw allows an authenticated user, even without