Security Disclosures

Coordinated-disclosure advisories for vulnerabilities I've found and reported to vendors. Each entry tracks a single issue from triage through public disclosure, with the technical write-up published once the embargo lifts and the advisory is finalised.

Findings still under embargo are listed but not published — the advisory body goes up after the vendor has shipped a fix or the 90-day window expires. Only entries marked published link through to a full write-up.