I spent this week reading every writeup, CVE advisory, and research paper I could find from 2025-2026. Fifty bugs. Not fifty theoretical vulnerability classes — fifty real, disclosed, bounty-paying bugs with CVEs, payouts, and lessons. Here is everything I learned, organized by what matters most for hunting right now.
The Big Picture: What Changed in 2025-2026
Three seismic shifts happened. First, AI/LLM vulnerabilities grew 540% on HackerOne — prompt injection is now the fastest-growing bug class. Second, framework-level RCE replaced application-level bugs as the highest-impact finding class (React2Shell alone affected 12 million sites). Third, ORM leaking emerged as the modern replacement for SQL injection, and most hunters haven't caught up yet.
HackerOne paid $81 million in bounties in 2025. The median time from WordPress CVE disclosure to first exploitation is now 5 hours. If you're not studying new techniques weekly, you're already behind.
Category 1: Framework-Level RCE (The Big Ones)
These aren't application bugs — they're framework bugs that affect every app built on them.
React2Shell (CVE-2025-55182) — CVSS 10.0. The React Server Components Flight protocol deserializes HTTP payloads without type checking. Replace legitimate serialized objects with gadgets that trigger Function() execution. Near-100% reliability against default React 19 + Next.js 15/16 configs. State-sponsored groups exploited this within hours of disclosure. Twelve million websites were estimated vulnerable.
Next.js Middleware Bypass (CVE-2025-29927) — CVSS 9.1. Add the header x-middleware-subrequest: middleware to any request and the entire authentication middleware chain is skipped. That's it. One header. Every self-hosted Next.js app was vulnerable. Vercel-hosted apps were auto-protected, but millions of self-hosted deployments were wide open.
Craft CMS RCE (CVE-2025-32432) — CVSS 10.0. The image transformation endpoint accepts POST data without authentication. User input reaches template evaluation. ~300 instances confirmed compromised before patch. CISA KEV listed.
Axios Prototype Pollution Chain (CVE-2026-40175) — CVSS 10.0. A gadget in Axios (50M+ weekly npm downloads) turns any prototype pollution in any dependency into CRLF injection, then request smuggling, then SSRF that defeats AWS IMDSv2, then full cloud credential theft. One minor pollution bug in one dependency = complete cloud compromise.
ASP.NET Kestrel Smuggling (CVE-2025-55315) — CVSS 9.9. A lone newline character in chunk extensions causes parser disagreement between proxies and Kestrel. Highest CVSS ever assigned to ASP.NET Core. $10,000 bounty from Microsoft.
Bug Bounty Takeaway: Check framework versions on every target. Next.js, React, Craft CMS — version detection takes seconds and can lead to instant critical findings.
Category 2: AI/LLM — The 540% Growth Area
GitHub Copilot RCE (CVE-2025-53773) — CVSS 9.6. Embed prompt injection in source code comments or PR descriptions. Copilot writes chat.tools.autoApprove: true to VS Code settings, enabling YOLO mode. Then it executes arbitrary shell commands. Wormable — infected repos propagate to other developers. Invisible Unicode characters can hide the payload.
ServiceNow Agent-to-Agent Injection (CVE-2025-12420) — CVSS 9.3. Embed crafted text in support tickets. Low-privilege AI agent processes it, then recruits a high-privilege agent to exfiltrate case files and assign admin roles. Not a code bug — a design flaw in default configurations.
LangChain Serialization RCE (CVE-2025-68664) — CVSS 9.3. LangChain's dumps()/dumpd() fail to escape dictionaries with lc keys. Prompt injection causes the LLM to produce crafted additional_kwargs that deserialize into arbitrary object instantiation. Prompt injection to code execution. LangChain's maximum-ever bounty of $4,000.
Invisible Unicode Injection in HackerOne's Hai. Unicode tag characters (U+E0061-U+E007A) are invisible to humans but parsed by LLMs. Researchers embedded hidden instructions that caused Hai to escalate severity and demand better treatment. The AI started defending the attacker aggressively.
Cloudflare AI Playground XSS to MCP Takeover (CVE-2026-1721). OAuth callback handler interpolated error_description into inline script without sanitization. WAF bypassed using URL fragment (never reaches server). XSS led to stealing all chat history and interacting with connected MCP servers.
Bug Bounty Takeaway: Every AI feature is a target. Test tool descriptions for hidden instructions, test LLM outputs for injection, test serialization boundaries. HackerOne now has dedicated Agentic Prompt Injection Testing.
Category 3: WordPress Plugin CVEs (12 Critical Findings)
WordPress saw 11,334 new vulnerabilities in 2025 — a 42% increase. The six most dangerous plugin categories: file upload handlers, contact form database addons, SMTP/email loggers, registration/membership plugins, page builder addons, and REST API automation plugins.
OttoKit Privilege Escalation (CVE-2025-27007) — CVSS 9.8. Plugins that bypass auth when unconfigured (no API key set) are trivially exploitable. Mass exploitation within days. Nuclei template available.
Ninja Forms File Upload RCE (CVE-2026-0740) — CVSS 9.8. Missing file type validation. The initial patch in 3.3.25 was bypassable — full fix took until 3.3.27. Always re-test after patches.
Post SMTP ATO (CVE-2025-11833) — CVSS 9.8. Missing capability check exposes email logs. Trigger admin password reset, read the token from exposed logs, complete ATO. 400K+ installs affected.
Contact Form CFDB7 SQLi + PHP ObjInj (CVE-2025-4665) — CVSS 9.6. No $wpdb->prepare() on form data + unsafe deserialization. SQLi chains into PHP Object Injection for potential RCE.
Service Finder Theme Auth Bypass (CVE-2025-5947) — CVSS 9.8. Cookie-based user switching without server-side validation. Spoof the original_user_id cookie to log in as admin. 13,800+ exploit attempts detected.
Also studied: Depicter Slider SQLi (CVE-2025-2011), FunnelKit unauthenticated plugin installation (CVE-2025-1562), King Addons admin registration (CVE-2025-8489, 48,400+ blocked attacks), Database for CF7 RCE (CVE-2025-7384, 900K installs), User Registration auth bypass (CVE-2026-1492), SiteOrigin Widgets shortcode bypass (CVE-2026-2127), and Joomla 2FA bypass (CVE-2025-25227).
Bug Bounty Takeaway: admin-ajax.php action handlers and /wp-json/ REST endpoints with missing capability_check are the #1 and #2 attack vectors. Patchstack threshold: CVSS >= 6.5, Subscriber+ or Unauthenticated only.
Category 4: Authentication Bypass and ATO Techniques
SAML Void Canonicalization (CVE-2025-25291/25292). ruby-saml uses two XML parsers (REXML + Nokogiri) that produce different document structures from the same XML. Inject a Signature element visible only to Nokogiri. Two parsers validate different pairs = complete auth bypass. Sign in as any user with one valid SAML signature. Affects GitHub Enterprise, GitLab, Terraform Enterprise.
GitLab Password Reset Array Injection — $35,000. Convert form data to JSON. Replace the email string with an array: [victim@gmail.com, attacker@gmail.com]. GitLab sends the reset link to both. Third highest H1 payout ever.
Race Condition Single-Packet ATO. Multi-step OTP login with shared flowId state. HTTP/2 single-packet attack sends init-email (victim) + check-otp (attacker's valid OTP) simultaneously. Thread A updates email while Thread B validates OTP. Result: auth token for victim's account. Flatt Security's First Sequence Sync technique breaks the 20-request barrier — synchronize hundreds of requests for OTP brute force.
OAuth2 Proxy Health Check Bypass (CVE-2026-34457) — CVSS 9.1. Craft requests matching health check User-Agent pattern. Entire OAuth flow skipped. Widespread in Kubernetes environments protecting internal services.
Category 5: Novel Techniques from PortSwigger Top 10 2025
#1 Error-Based Blind SSTI. Adapted error-based SQLi concepts to blind template injection. Polyglot payloads trigger distinguishable errors across engines. Makes blind SSTI exploitable at scale — previously considered nearly impossible.
#2 ORM Leaking. The modern replacement for SQL injection. Every search/filter endpoint that passes user params to ORM queries is a target. Payloads like ?filter=created_by__user__password__contains=a extract data character by character through Django, Prisma, ActiveRecord relationship traversal. Semgrep rules available.
#3 SSRF via HTTP Redirect Loops. Redirect loops create observable timing/error differences that convert blind SSRF to visible SSRF with data extraction. Blind SSRF is NOT low severity with this technique.
#4 Unicode Normalization WAF Bypass. Fullwidth characters (U+FF00-U+FFEF) pass WAF checks but normalize to dangerous characters on the backend. 70% WAF bypass rate for parameter pollution. Also enables password reset ATO via homoglyph emails.
#5 SOAPwn: .NET RCE via HTTP Client Proxies. A single flaw in HttpWebClientProtocol developed into RCE across multiple .NET products. 93-page whitepaper. Legacy protocol handlers in modern frameworks remain exploitable.
#8 Chrome Connection Pool Side-Channel. Chrome's connection pool prioritization leaks redirect hostnames cross-origin. Side-channels are now a core exploitation primitive.
Category 6: Infrastructure CVEs
Erlang/OTP SSH RCE (CVE-2025-32433) — CVSS 10.0. SSH server processes commands before authentication completes. One packet to root. Affects Cisco, RabbitMQ, CouchDB.
IngressNightmare (CVE-2025-1974) — CVSS 9.8. Any pod on the Kubernetes network can inject NGINX config and achieve RCE. ingress-nginx has cluster-wide secret access = full cluster takeover. ~40% of K8s clusters affected.
SAP NetWeaver File Upload RCE (CVE-2025-31324) — CVSS 10.0. Visual Composer endpoint has no auth at all. Upload webshell = instant RCE. Nation-state exploitation against critical infrastructure.
Ivanti VPN Zero-Day (CVE-2025-22457) — CVSS 9.0. Buffer overflow in VPN appliance. Chinese state-sponsored exploitation with custom malware. VPN appliances remain the #1 APT initial access vector.
Gladinet Hardcoded Key RCE (CVE-2025-30406) — CVSS 9.0. Default cryptographic keys in config files allow forging auth tokens and triggering deserialization RCE.
Category 7: High-Value H1 Report Techniques
PDF Generation SSRF — $25,000 (HackerOne's own platform). Inject iframe tag into analytics report template. Server-side rendering fetches AWS metadata endpoint. Error messages leaked IAM credentials.
.json Endpoint Data Leak — $25,000 (HackerOne's own platform). Append .json to any disclosed report URL. Response includes reporter's email, OTP backup codes, phone number, graphql_secret_token. Always test .json/.xml/.csv variants.
Teleport Privilege Escalation — $21,000. Access List Owner modifies list to grant higher-privilege roles, inheriting escalated permissions. Authorization checked ownership but not role ceiling.
CSPT + Web Cache Deception — $111,750 (Meta). Client-side path traversal in SPAs redirects authenticated API calls to attacker-controlled cache keys. CDN caches the response publicly. 88% increase in CSPT submissions in 2025.
What I'm Changing in My Hunting
- Framework version checks first. Next.js, React, Craft CMS, Axios — 30 seconds of version detection can lead to CVSS 10 findings.
- Every AI feature is a target. MCP tool descriptions, serialization boundaries, LLM output rendering. 540% growth means low competition.
- ORM leaking replaces SQLi fuzzing. Test every filter/search endpoint for relationship traversal. Use Semgrep rules for automated detection.
- Always test .json/.xml/.csv variants. APIs serialize more data than HTML views show. Two $25K findings from this alone.
- Re-test after patches. Ninja Forms partial fix was bypassable. Initial patches often address symptoms, not root causes.
- Race conditions beyond 20 requests. First Sequence Sync breaks the single-packet barrier. OTP brute force and 2FA bypass are now practical.
- SAML is back. Parser differentials in ruby-saml affect GitHub Enterprise, GitLab, thousands of Ruby apps. Two parsers = two interpretations = auth bypass.
- CSPT + cache deception is the new chain. SPAs + CDNs + path traversal = $111K at Meta. 20% of web vuln reports now.
The Numbers
Across these 50 bugs: 15 scored CVSS 9.0+. Total disclosed bounties exceeded $200,000. The highest single payout was $35,000 (GitLab password reset). The most widespread was React2Shell (~12M sites). The fastest-growing category was AI/LLM (+540%). The most underexplored was ORM leaking (PortSwigger #2, but most hunters still fuzz for SQLi instead).
The game changed in 2025. Framework bugs matter more than app bugs. AI is the new frontier. And the hunters who study weekly are the ones cashing bounties.
Stay curious. Stay sharp.
— Seetha
No comments yet