Five CVEs is the highlight reel. This is the footage that didn't make it: the finding I killed and un-killed, the dry weeks, the 870k tokens a workflow burned returning nothing, and the finding the submission gate blocked me from filing to myself.
OpenBao had just fixed a silent namespace switch on token accessors. The identical shape lived one primitive over, on lease IDs, untouched — plus the HTTP 500 I misread as an outage. CVE-2026-55774.
An SSRF guard checked private IPv6 ranges and never matched, because PHP's parse_url returns the IPv6 host with its square brackets still attached. [::1] is not ::1, so every check missed. CVE-2026-55190.
I audited arc's DuckDB sandbox, called the fix complete, and killed the target — then re-dived the next CVE and found the allowlist was scoped to the whole multi-tenant root, not the tenant. The finding I got wrong first. CVE-2026-55098.
AVideo patched a command injection by denylisting the obvious separators and forgot a lone ampersand — the shell background operator — which walked straight to sh -c. How I found CVE-2026-55173, and why denylisting a shell is a losing game.
Five recent, fully-public CVEs where the patch closed the reported proof-of-concept and left the sink wide open — grouped by the shape of the mistake, so you can grep for it.
Most CVE write-ups show the win and skip the work — the leads you throw away. Last month's ledger was 6 submitted, 6 held, 58 killed. That ratio is the method, and here's the verification discipline behind it.