Wow, rank 10. Thanks Intigriti for the swag voucher and to your whole team for providing such an encouraging and supportive environment to smash bugs!

Authorization Bypass in Next.js Middleware - CVE-2025-29927 research paper soon!

Temporary AWS WAF rule as a workaround for CVE-2025-29927: gist.github.com/fourcube/db12e…

Took Nicolas Grégoire's Mastering Burp Suite Pro course last week, which was fantastic. Since the Next.js middleware bypass CVE dropped over the weekend, I decided put the new knowledge to good use. Here's a BCheck script to test for the vulnerability: gist.github.com/fourcube/45a78…

Repository with a demo of Next.js CVE-2025-29927 from zhero; github.com/fourcube/nextj…

I discovered two XSS flaws in mermaid (JS diagram library) last month. The advisories got published today. CVE-2025-54880 (github.com/mermaid-js/mer…) CVE-2025-54881 (github.com/mermaid-js/mer…) #xss #bugbounty