Every advisory below was filed, accepted, and published. The PoC that proved it is one cat away.
ataberk@arsenal:~$ ls poc/
accepted
cve-2026-73864.mdinstall-artifact-from-github — install-time RCE, no integrity checkHIGH 7.5
accepted
ghsa-ppr3-83x7-g97w.mdKata Containers — Dragonball guest-to-host escape via virtio OOB writeMEDIUM 6.4
accepted
cve-2026-71429.mdstream-json — O(depth²) path filters block the event loopMEDIUM 6.2
accepted
cve-2026-71430.mdnode-re2 — process abort in ReplaceMEDIUM 6.2
accepted
cve-2026-68499.mdnode-re2 — global match infinite loop, unbounded memoryMEDIUM 6.2
accepted
cve-2026-67550.mdnode-re2 — OOB heap read via lastIndex on non-ASCII subjectMEDIUM 5.7
accepted
cve-2026-84567.mdApple macOS — cd9660 Rock Ridge NM-handler underflow, kernel panicMEDIUM 5.5
accepted
cve-2019-19493.mdKentico CMS — stored XSS via avatar uploadMEDIUM 5.4
ataberk@arsenal:~$ cat poc/cve-2026-73864.md
---
target: install-artifact-from-github ≤ 1.6.0
advisory: CVE-2026-73864 · CWE-494
severity: HIGH 7.5
impact: network-downloaded native .node has no integrity check → install-time RCE
status: FIXED — 1.7.0
poc: → gist.github.com/ataberk-xyz/e28f6d2…
---
target: install-artifact-from-github ≤ 1.6.0
advisory: CVE-2026-73864 · CWE-494
severity: HIGH 7.5
impact: network-downloaded native .node has no integrity check → install-time RCE
status: FIXED — 1.7.0
poc: → gist.github.com/ataberk-xyz/e28f6d2…
---
ataberk@arsenal:~$