![[EN] Drawing the Vulnerability: XSS in Draw.io (CVE-2026-58504)](/content/images/size/w720/2026/10/drawio_capa_en.png)
[EN] Drawing the Vulnerability: XSS in Draw.io (CVE-2026-58504)
During an analysis of the source code of draw.io (also known as diagrams.net), an open source tool widely used for creating diagrams
RESEARCH AREA
en
![[EN] CVE-2026-114509: Authentication Bypass in Laravel TokenGuard](/content/images/size/w720/2026/10/8886655df8ac5577cd767c9565dcd60bad2e96b2612b9870c37fcea1f2f5d954.png)
[EN] CVE-2026-114509: Authentication Bypass in Laravel TokenGuard
Abstract The Yokai Research team developed an in-depth analysis and proof-of-concept exploit for a critical authentication bypass in the Laravel framework,
Client-Side Path Traversal in the Wild: From Stored XSS to Account Deletion
Two CSPT chains discovered in production bug bounty targets and the thought process behind turning a frontend URL quirk into real impact. Table of
![[EN] Behind the Mirror: Investigating Vulnerabilities in MagicMirror² (CVE-2026-63642, CVE-2026-63643)](/content/images/size/w720/2026/10/ARTIGO_MAGICMIRROR_GABRIEL_EN.png)
[EN] Behind the Mirror: Investigating Vulnerabilities in MagicMirror² (CVE-2026-63642, CVE-2026-63643)
During an analysis of the source code of MagicMirror², an open-source platform used to turn a semi-transparent mirror into a smart display,
![[EN] CVE-2026-16764: Missing validation, full access](/content/images/size/w720/2026/09/ARTIGO_BLOG_Nosf_Ahnao_EN.png)
[EN] CVE-2026-16764: Missing validation, full access
OWASP DefectDojo is an open-source vulnerability management platform widely used by security teams to centralize, track, and prioritize findings from various scanning tools.
EN - Beerus Framework: iOS - The Swiss Army Knife for iOS
This past July, we released v1.1 of the Beerus Framework for Android. Now, in September, we take another step in the project'
![[EN] CVE-2026-40083: SQL Injection in Cacti](/content/images/size/w720/hakaisecurity-io/wp-content/uploads/2026/08/en_artigo_blog_cacti.png)
[EN] CVE-2026-40083: SQL Injection in Cacti
Summary The Yokai research team, from Hakai Security, identified a SQL Injection vulnerability in Cacti versions <= 1.2.30. The flaw allows an
CVE-2026-42931: DoS via Unbounded Request Body Read in Gitea’s npm Endpoint
Abstract How much memory should a small request intended to change a package's tag consume? Under normal conditions, just a few bytes.
![[EN] Build Your Nightmare - Dissecting CVE-2026-12191](/content/images/size/w720/hakaisecurity-io/wp-content/uploads/2026/07/bispocveen.png)
[EN] Build Your Nightmare - Dissecting CVE-2026-12191
Summary As the global autonomous vehicle market grows, the security of critical driver assistance systems may be hanging by a thread. Our recent research