![[EN] Behind the Mirror: Investigating Vulnerabilities in MagicMirror² (CVE-2026-63642, CVE-2026-63643)](/content/images/size/w720/2026/10/ARTIGO_MAGICMIRROR_GABRIEL_EN.png)
[EN] Behind the Mirror: Investigating Vulnerabilities in MagicMirror² (CVE-2026-63642, CVE-2026-63643)
During an analysis of the source code of MagicMirror², an open-source platform used to turn a semi-transparent mirror into a smart display,
RESEARCH AREA
en
![[EN] CVE-2026-16764: Missing validation, full access](/content/images/size/w720/2026/09/ARTIGO_BLOG_Nosf_Ahnao_EN.png)
[EN] CVE-2026-16764: Missing validation, full access
OWASP DefectDojo is an open-source vulnerability management platform widely used by security teams to centralize, track, and prioritize findings from various scanning tools.
EN - Beerus Framework: iOS - The Swiss Army Knife for iOS
This past July, we released v1.1 of the Beerus Framework for Android. Now, in September, we take another step in the project'
![[EN] CVE-2026-40083: SQL Injection in Cacti](/content/images/size/w720/hakaisecurity-io/wp-content/uploads/2026/08/en_artigo_blog_cacti.png)
[EN] CVE-2026-40083: SQL Injection in Cacti
Summary The Yokai research team, from Hakai Security, identified a SQL Injection vulnerability in Cacti versions <= 1.2.30. The flaw allows an
CVE-2026-42931: DoS via Unbounded Request Body Read in Gitea’s npm Endpoint
Abstract How much memory should a small request intended to change a package's tag consume? Under normal conditions, just a few bytes.
![[EN] Build Your Nightmare - Dissecting CVE-2026-12191](/content/images/size/w720/hakaisecurity-io/wp-content/uploads/2026/07/bispocveen.png)
[EN] Build Your Nightmare - Dissecting CVE-2026-12191
Summary As the global autonomous vehicle market grows, the security of critical driver assistance systems may be hanging by a thread. Our recent research
Beerus Framework: v1.1 - KernelSU, gRPC Transport and Fixes
A few months after the initial release of the Beerus Framework, we are publishing version v1.1, a minor update that brings support for
Discovering 0-days in HTML-to-PDF Generators (90 million monthly targets)
By Pedro "gankd" Cruz — Pentest Analyst and Vulnerability Researcher at Hakai Security. Almost every feature-rich application emits a PDF at some
![[EN] CVE-2026-44706: SQL Injection in Chatwoot FilterService](/content/images/size/w720/hakaisecurity-io/wp-content/uploads/2026/06/blog_sqlinjec.png)
[EN] CVE-2026-44706: SQL Injection in Chatwoot FilterService
Summary The Hakai Security Research Team has identified a critical SQL Injection vulnerability in Chatwoot versions <= 4.11.1 that allows any authenticated