Vulnerability research from discovery to disclosure.

Long-form dives into the vulnerabilities we've found, the tooling behind them, and the techniques we used to exploit them — alongside product and company updates.

Featured research

CVE-2026-7899Chrome

Check Your Motor Oil Before Turbocharging: CVE-2026-7899, When V8's Optimization Engine Builds Up Carbon

CVE-2026-43501Linux Kernel

Route of Root: Bring a "DoS only" bug to LPE and bypass the existing patch to win $10,500 in kernelCTF

Product and company
Beyond the Model: Benchmarking Codex Security, Claude Security, and Nebu
CVE-2026-43499Research
IonStack part III: Rooting Android 17 with GhostLock
CVE-2026-10702Firefox
IonStack Part I: Unsound IonBanana Peel in Ion Compiler, Slipping Through Firefox's SpiderMonkey JIT
CVE-2026-43499Linux Kernel
IonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years
CVE-2026-6307Chrome
Longinus: 2 Boundaries in One Bug, Piercing Chrome’s Renderer and V8 Sandbox with a Single Vulnerability, CVE-2026-6307
CVE-2026-5865Chrome
How an Omitted Write Barrier in V8 Turns Into RCE in Chrome: CVE-2026-5865
CVE-2026-23274Linux Kernel
From a Netfilter Bug to kernelCTF: Exploiting CVE-2026-23274 in the Linux Kernel and winning a $10500 Bounty

Research that
reaches production.

A continuously updated record of validated vulnerabilities discovered by NebuSec across open-source and commercial software.

1178+

validated vulnerabilities

12+

projects affected

Linux KernelCVE-2026-43499demonstrated FirefoxCVE-2026-10702fixed nginxCVE-2026-42530fixed nginxCVE-2026-9256fixed D-LinkCVE-2026-7248fixed

Backed by Y Combinator.

Talk with our team about your codebase, infrastructure, and security priorities.

Vulnerability research from discovery to disclosure.

Featured research

Research that reaches production.

Research that
reaches production.