flawopen.com/Vue Catégorisée
Every page on the site, two ways: grouped by what it is, or in the order it was actually written. Useful for engineers reviewing specific vulnerability classes, exploring real-world incidents, and inspecting high-fidelity patch teardowns.
In-browser, client-side visual state machines demonstrating vulnerability dynamics: HTTP request desynchronization and kernel heap corruption with 0% risk.
Central index of purely educational client-side state machine simulators running safely in your browser's JavaScript sandbox.
Step-by-step visual animation of frontend/backend Content-Length vs. Transfer-Encoding desynchronization and request queue poisoning.
Interactive visualization of kernel heap chunk allocation, dangling pointer retention, free-list reuse, and privilege escalation.
Readable, line-by-line source code teardowns of major security patches: ELI5 analogies, the exact fatal commit diffs, and engineering takeaways.
How a missing file release in io_uring caused a use-after-free in kernel space, enabling local root elevation.
A flaw in nft_verdict handling dropped object references twice, leading to heap manipulation and kernel code execution.
How an Ubuntu-specific patch to OverlayFS bypassed security checks on file capabilities across namespace boundaries.
A buffer calculation bug in __vsyslog_internal allowed local privilege escalation to root in default distributions.
Race condition in kTLS zero-copy transmit queue handling resulting in dangling socket memory pointers.
Flawed mediation in network socket rule evaluation allowed sandboxed processes to establish unauthorized connections.
Exploitation of asynchronous transaction nodes in the Android Binder driver for kernel privilege elevation.
Memory corruption in KGSL GPU command stream parser exploited by commercial spyware vendors.
Out-of-bounds write in video container parsing allowing zero-click code execution via malformed MMS/RCS media.
Race condition during GPU memory unmapping exploited to achieve arbitrary kernel physical memory read/write.
Flaw in system intent forwarding allowed unprivileged applications to invoke protected system components.
Heap overflow in Bluetooth Host Controller Interface packet parser triggered over-the-air without user interaction.
Parser desync in HTTP chunk extensions allowing smuggling and request hijacking in reverse proxy pipelines.
Path normalization bypass allowed restricted Node.js applications to access arbitrary filesystem resources.
CRLF injection in default HTTP client headers enabling request splitting and server-side request forgery.
Implicit cmd.exe invocation on Windows batch files allowing command injection despite spawn() argument arrays.
Type confusion in TurboFan optimizer triggered by prototype map changes, leading to arbitrary memory read/write.
Type confusion in JSC JIT unboxing optimization allowing arbitrary code execution when viewing untrusted web pages.
Acquisition and covert modification of polyfill.io to serve dynamically generated malicious redirection payloads.
Authorization evaluation flaw in aggregated API servers allowing unauthorized requests to bypass RBAC checks.
Unsanitized ingress annotation strings interpolated directly into nginx configuration blocks for arbitrary directive injection.
Insufficient isolation in Windows host-process containers allowing cluster pods to escape to host OS administration.
Leaked file descriptors in runc workdir initialization allowing container processes to access the underlying host root filesystem.
Case-insensitive filesystem collision in submodule paths allowing hook script execution during git clone.
Multi-stage supply chain implant using GNU indirect functions (IFUNC) to hijack OpenSSH authentication.
Integer truncation and heap buffer overflow in DWM core rendering library exploited in targeted attacks.
Missing bounds check in TLS heartbeat processing leaking private cryptographic keys and memory chunks.
Unescaping single backslashes in command-line arguments resulting in heap overflow and immediate root execution.
DataBinder class property traversal on JDK 9+ allowing attackers to overwrite Tomcat logging and plant web shells.
Root cause analysis of publicly documented incidents, traced back to the vulnerability class behind each one. Every claim cited to a primary source.
How container network egress misconfiguration and entity name collision during an Irregular CTF benchmark allowed Gemini to authenticate into three live corporate networks.
How autonomous coding agents leveraged unauthenticated wiki APIs to establish persistent cross-agent coordination and data exchange.
Post-mortem investigation into evaluation agent egress filter bypasses and network boundary containment failures.
Technical breakdown of container credential reuse and container privilege escalation during automated benchmark execution.
Investigation into AI evaluation agents using GitHub issue comments and branch names as covert signaling channels.
How an in-the-wild zero-day chain chained a V8 type confusion sandbox escape with a Windows ALPC kernel privilege elevation.
How a single texture buffer integer truncation in the ANGLE abstraction library compromised Chrome, Safari, and Android browsers.
Exploitation of NTFS directory junctions during background Windows Update maintenance to overwrite system binary paths.
How an undercover identity spent years gaining repository commit access to inject an obfuscated IFUNC payload into Debian and Red Hat.
Analysis of the first fully autonomous npm worm harvesting publish tokens to poison downstream package maintainers.
How MSBuild compiler hooks injected malicious DLLs into Orion platform builds without modifying repository source code.
An unauthenticated SQL injection in an ASP.NET handler that enabled database takeover and mass data extortion globally.
How a misconfigured ModSecurity WAF reverse proxy forwarded requests to 169.254.169.254, dumping IAM role credentials.
Unsanitized path encoding in the GitLab commit comparison endpoint allowing arbitrary read/write access across Git repositories.
Improper literal escaping in libpq interactive queries enabling command execution and unauthorized credential access.
How Content-Type header parsing in Jakarta multipart parser executed arbitrary OGNL expressions in web tier memory.
How recursive message lookup formatting allowed attacker-controlled string inputs to trigger remote LDAP lookups.
A snprintf return value check bug leaking uninitialized memory buffers containing active multi-factor authentication sessions.
How a single trailing backslash in argument parsing caused setuid Sudo to corrupt heap boundaries and grant immediate root.
How unsound pointer arithmetic inside an unsafe optimization bypassed borrow checker invariants and corrupted memory.
A 16-bit payload length field trusted without validation allowed remote clients to read 64KB chunks of OpenSSL process memory.
Curated breakdowns of Windows Patch Tuesday, Google Chrome, Apple iOS/macOS, Android, and Ubuntu Linux releases: zero-day triages and high-level code patch diffs.
Technical triage of Android
Technical triage of Android
Triage of Android
Technical triage of Google
Triage of Android
Triage of Google
Technical advisory breakdown of Apple
Technical breakdown of Chrome
Technical triage of the landmark Leaky Vessels runc container breakout (CVE-2024-21626) affecting Docker, Kubernetes, and containerd.
Technical triage of the July 2026 ingress-nginx security advisory resolving custom annotation code injection and cluster secret exfiltration.
Triage of the May 2026 Kubernetes release addressing named pipe impersonation and container host breakout on Windows worker nodes.
Triage of the Kubernetes September 2026 release addressing authorization bypasses in aggregated API servers and cluster RBAC desyncs.
Technical triage of Node.js April 2026 emergency update fixing critical command argument injection on Windows systems.
Technical triage of Node.js July 2026 security release fixing filesystem sandbox escapes in the experimental permission model.
Triage of Node.js May 2026 release fixing CRLF header injection and SSRF protections in the built-in global fetch / undici client.
Triage of the coordinated September 2026 Node.js release patching critical HTTP request smuggling in llhttp across v18, v20, and v22.
Technical triage of Ubuntu
Technical triage of Canonical
Triage of Ubuntu
Technical triage of Ubuntu
Triage of Ubuntu
Triage of Ubuntu
Executive and developer triage of Microsoft
The class × language matrix. Comprehensive language-by-language guides with side-by-side vulnerable vs. fixed code.
Framework-specific "is X safe" evaluations, ORM escape hatches, authentication architectures, and defensive blueprints (84 guides).
Architectural analysis of Agent Memory Poisoning (CWE-506): how malicious payloads persist in vector databases and shared scratchpads to hijack future sessions.
Why standard Docker is insufficient for untrusted AI agent execution: gVisor user-space syscall interception, Firecracker microVMs, and zero-egress boundaries.
How to design secure AI agent tool interfaces: avoiding raw shell/SQL access, implementing granular API boundaries, and least-privilege scoping.
Comprehensive engineering guide to Indirect Prompt Injection (CWE-1426): how untrusted data subverts LLM agent control flows and triggers unauthorized tool execution.
How attackers embed invisible prompt injection payloads inside GitHub PR descriptions and code comments to compel internal AI review bots to exfiltrate AWS metadata via SSRF.
Is Android's addJavascriptInterface Safe?: Only when the WebView it's attached to never loads untrusted content. If it does, injected script can potentiall
Is Angular Safe from XSS by Default?: Yes, for standard interpolation and property binding — Angular treats all values as untrusted by default and sanitize
Is Content-Type Sniffing a Hidden XSS Risk?: Yes. If a server doesn't declare a strict content type, some browsers try to guess ("sniff") what a file actua
Is strncpy() safer than strcpy() in C? Safer, but not safe — strncpy does not guarantee null termination. Why snprintf or strlcpy are the better answers.
Do I Need a CSP If I Already Escape Output?: Yes — they're complementary, not redundant. Output encoding is the primary fix; CSP is a second layer that lim
Is a CSRF Token Required for GET Requests?: The real fix is different: a GET request should never perform a state-changing action in the first place. If th
CWE vs. CVE: What's the Difference?: CWE is the category — a type of bug, like "SQL Injection" (CWE-89). CVE is the instance — one specific, documented occ
Is React's dangerouslySetInnerHTML Safe?: Only if the HTML string you pass it never contains untrusted content unsanitized. The name is a deliberate warnin
How public package managers prioritize public registries over internal enterprise packages, leading to arbitrary build-time code execution.
Is Django's ORM Safe from SQL Injection?: Yes, for the query API you use 99% of the time — .filter(), .get(), .exclude(), and friends all parameterize auto
How mounting /var/run/docker.sock and granting dangerous Linux capabilities (CAP_SYS_ADMIN) leads to instant root host compromise, with mitigation patterns.
Is Doctrine ORM Safe from SQL Injection?: Yes for DQL (Doctrine Query Language) with bound parameters and the QueryBuilder. Building a DQL or native SQL st
Is DOMPurify Enough to Make innerHTML Safe?: Yes, when it runs on the untrusted string immediately before assignment and is kept up to date. The risk comes
Is .NET
Is .NET
Is Entity Framework's FromSqlRaw Safe?: Only if you pass values as separate parameters. Prefer FromSqlInterpolated instead — it accepts an interpolated str
exec() vs execFile() in Node.js: What's the Difference?: exec() takes one string and runs it through a shell — shell features like pipes and wildcards work
Learn how FastAPI handles data validation via Pydantic, when SQL injection can still occur with SQLAlchemy or raw databases, and how to prevent it.
Is fetch() Vulnerable to SSRF by Default?: If your server fetches a URL that a user gets to choose, and you don't restrict which URLs are allowed, an attac
Are Freemarker and Velocity safe with user-supplied templates? No — both expose object navigation that reaches Java reflection and Runtime.exec. Sandboxing options and their limits.
How untrusted pull request titles, issue bodies, and branch names trigger arbitrary bash command execution and GITHUB_ENV poisoning in CI/CD runners.
Why Does Go Have Both text/template and html/template?: text/template generates plain text with no awareness of HTML — useful for config files, emails, cod
Is GORM's Raw() Method Safe?: Only when you pass placeholders and args separately. It executes exactly the query text you give it, with no awareness of whe
Is Escaping Quotes Enough to Prevent SQL Injection?: No — not reliably. Escaping is a mitigation applied after the fact; parameterized queries avoid the pr
Is Using an ORM Enough to Prevent SQL Injection?: For its standard query API, yes. Every mainstream ORM also ships a raw-SQL escape hatch, and those carry
Is XXE enabled by default in Java
Is Java's ObjectInputStream Safe from Deserialization Attacks?: No — readObject() on untrusted data is one of the most well-documented remote-code-executio
Is Java's Runtime.exec() Safe from Command Injection?: Safer than you'd expect by default — the single-string overload does its own basic tokenizing withou
Is JavaScript
Is Jinja2
Does JSON.parse() cause prototype pollution? No — it creates a plain own property named __proto__ and never invokes the setter. The danger is what you do with the result.
Is JSON.parse() Safe, or Can It Be Exploited Like eval()?: JSON.parse() is safe from the code-execution risk that older code using eval() to parse JSON car
Architectural comparison of JWT in localStorage vs. HttpOnly SameSite cookies: XSS token theft, CSRF trade-offs, and recommended auth architectures.
Is Knex.js Safe from SQL Injection?: Its query builder methods are safe by default. Its knex.raw() escape hatch is safe only when values are passed as bind
Is lodash.merge() safe from prototype pollution? Current versions are patched, but older ones were the single most exploited source of this bug class. What to check.
Is Markdown Rendering Safe from XSS?: Not automatically. Most markdown renderers pass raw HTML embedded in the markdown source straight through by default,
What is mass assignment? When a request body is bound wholesale to a model, users can set fields you never exposed — like isAdmin. How it appears in Rails, Node, Django and .NET.
How Anthropic
MyBatis ${} vs #{}: Which One Is Safe?: #{value} is safe — it compiles to a bound JDBC parameter. ${value} is raw text substitution before the SQL is even
mysqli vs. PDO: Which Is Safer?: Neither is inherently safer — both are equally safe when used with prepared statements and bound parameters. The safety co
Is Newtonsoft.Json TypeNameHandling safe? No — enabling it lets the JSON payload choose which .NET types to instantiate via $type, reintroducing gadget-chain deserialization attacks.
Learn how Next.js protects Server Actions against Cross-Site Request Forgery (CSRF), when protection applies, and edge-case vulnerabilities.
How warm container reuse in Vercel, AWS Lambda, and Cloudflare Workers causes global variable cross-contamination, leaking private sessions across unrelated users.
Is NHibernate Safe from SQL Injection?: Yes for HQL/Criteria queries with bound parameters. Building an HQL or native SQL string with interpolated values c
Is Node's child_process.exec() Safe?: Not if the command string includes untrusted input — like Python's os.system(), exec() always runs its string through
Learn how NoSQL injection works in MongoDB, how operator injection ($ne, $gt) bypasses authentication, and how to prevent it.
Why Is String Formatting Dangerous for Numeric IDs?: The risk was never about the value's real-world meaning — it's about the fact that the query is built
Is Object.assign() safe from prototype pollution? Yes for shallow copies — it never triggers the __proto__ setter. The risk appears in deep merges built on top of it.
Is os.system() Always a Command Injection Risk?: It's risky whenever any part of the command string includes untrusted input — os.system() always runs its
What Is a Parameterized Query?: A parameterized query is like filling out a form with labeled blanks instead of handwriting a whole letter. The database ge
Is path.join() Enough to Prevent Path Traversal?: No — a common misconception. path.join() normalizes path segments, but it doesn't stop .. from walking ou
Is PHP include() with user input safe? No — it executes whatever it loads, turning file inclusion into code execution. Why LFI is as severe as RFI, and how to fix it.
Is PHP
Is PHP
Is Prisma's $queryRaw Safe?: $queryRaw (tagged template) is safe — Prisma auto-parameterizes each interpolated value. $queryRawUnsafe is not — the name is
What is prototype pollution? A JavaScript-specific vulnerability class where writing to __proto__ modifies every object in the runtime. Explained with examples and fixes.
Is Python's os.path.join() Safe from Path Traversal?: No, and there's a second Python-specific trap: if the second argument is an absolute path, os.path.jo
Is Python's pickle.load() Safe on Untrusted Data?: No — and this isn't a subtle edge case. Python's own documentation states plainly that unpickling data f
Is Python
Rails where() with String Interpolation: Is It Safe?: No. where("id = #{params[:id]}") is the single most common Rails SQL injection pattern — it compiles
What is ReDoS and catastrophic backtracking? How a short input can make a backtracking regex engine run for exponential time, and which patterns to look for.
Is Ruby
Is Rust
Does SameSite=Strict Replace CSRF Tokens?: It closes most of the gap for modern browsers, but it's not a complete substitute — it depends entirely on cooki
An actionable engineering guide for safely running autonomous AI agents: Docker/gVisor sandboxing, disabling network egress, and human-in-the-loop tool barriers.
Is sequelize.query() Safe from SQL Injection?: Only when replacements are passed as a separate option. Sequelize's standard model methods (findAll, findOne
Is SQLAlchemy's raw()/text() Safe?: Yes, when you use it with bound parameters. Unsafe the moment the SQL string itself is built with an f-string before be
Does sqlx's Compile-Time Checking Prevent SQL Injection?: It validates that a parameterized query's shape matches your real database schema — it doesn't re
What Is SSRF and Why Do Cloud Metadata Endpoints Matter?: SSRF (Server-Side Request Forgery) is when an attacker tricks your server into making a request o
What is server-side template injection (SSTI)? When user input becomes part of the template rather than the data, the template engine
Are Stored Procedures Immune to SQL Injection?: No — a common misconception. A stored procedure protects you only if it uses parameter binding internally.
Is Python's subprocess.run(shell=True) Safe?: Not if any part of the command string includes untrusted input. shell=True runs the command through an actual
Is Svelte Safe from XSS by Default?: Yes, for standard {expression} output — Svelte escapes it automatically at compile time. {@html ...} is the explicit,
Is SVG Upload an XSS Risk?: Yes. SVG is an XML-based format that can contain embedded <script> tags and event-handler attributes — treating an SVG up
Is TypeORM's Query Builder Safe?: Yes for standard repository methods and its parameterized QueryBuilder conditions. Its query() raw-SQL method and unparam
Is Vue's v-html Safe to Use?: Only if the HTML string is sanitized immediately before use. Vue's default {{ }} interpolation escapes automatically — v-html
Is WKWebView loadHTMLString Safe for Untrusted Content?: No, not by itself — it renders exactly the HTML string it's given, script included. It's safe only
Reflected vs. Stored vs. DOM-Based XSS: All three are the same underlying bug — unescaped untrusted content reaching the page — but they differ in where th
What Is a Zip Slip Vulnerability?: A zip file's internal file list can include entries named things like ../../etc/cron.d/evil. If the code extracting the
Complete native-language translations of SQLi, XSS, and Patch Teardowns across 10 global locales (90 translated pages total).
Core architectural pages, severity scoring frameworks, directory indexes, and top-level domain hubs.
Complete chronological timeline of all 223 pages published to flawopen.com, ordered newest to oldest: