CVE-2026-42931: DoS via Unbounded Request Body Read in Gitea’s npm Endpoint
Abstract How much memory should a small request intended to change a package's tag consume? Under normal conditions, just a few bytes.
RESEARCH AREA
Research Blog
![[EN] Build Your Nightmare - Dissecting CVE-2026-12191](/content/images/size/w720/hakaisecurity-io/wp-content/uploads/2026/07/bispocveen.png)
[EN] Build Your Nightmare - Dissecting CVE-2026-12191
Summary As the global autonomous vehicle market grows, the security of critical driver assistance systems may be hanging by a thread. Our recent research
![[PT-BR] Build Your Nightmare - Destrinchando a CVE-2026-12191](/content/images/size/w720/hakaisecurity-io/wp-content/uploads/2026/07/bispocve.png)
[PT-BR] Build Your Nightmare - Destrinchando a CVE-2026-12191
Resumo Enquanto o mercado global de veículos autônomos cresce, a segurança de sistemas críticos de assistência à direção pode estar por um fio. Nossa
Beerus Framework: v1.1 - KernelSU, gRPC Transport and Fixes
A few months after the initial release of the Beerus Framework, we are publishing version v1.1, a minor update that brings support for
Beerus Framework: v1.1 - KernelSU, gRPC Transport e Correções
Alguns meses após o lançamento inicial do Beerus Framework, estamos publicando a versão v1.1, uma atualização minor que traz suporte a novos ambientes
Discovering 0-days in HTML-to-PDF Generators (90 million monthly targets)
By Pedro "gankd" Cruz — Pentest Analyst and Vulnerability Researcher at Hakai Security. Almost every feature-rich application emits a PDF at some
Descobrindo 0-days em Geradores HTML-to-PDF (90 milhões de alvos mensais)
* Por Pedro "gankd" Cruz — Pentest Analyst & Vulnerability Researcher na Hakai Security. Quase toda aplicação com diversas funcionalidades emite PDF em algum
![[EN] CVE-2026-44706: SQL Injection in Chatwoot FilterService](/content/images/size/w720/hakaisecurity-io/wp-content/uploads/2026/06/blog_sqlinjec.png)
[EN] CVE-2026-44706: SQL Injection in Chatwoot FilterService
Summary The Hakai Security Research Team has identified a critical SQL Injection vulnerability in Chatwoot versions <= 4.11.1 that allows any authenticated
[PT-BR] CVE-2026-44706: SQL Injection in Chatwoot FilterService
Resumo A Equipe de Pesquisa da Hakai identificou uma vulnerabilidade crítica de Injeção de SQL nas versões do Chatwoot <= 4.11.1 que