Redis replication state changes invalidated an active interpreter
Wiz confirms a USD 30,000 individual competition award for Yoni Sherez’s Redis entry, identified as CVE-2026-23631.
USD 30,000competition awardRead
MEVulnerability family
Memory safety and parser contracts.
Safe length, lifetime, encoding, and component-boundary assumptions. 10 disclosures · 2 related references · 1 diagrams.
Connected collection
Disclosures
Redis deserialization cleanup violated object-ownership invariants
Wiz confirms USD 30,000 for Emil Lerner’s Redis competition entry. Two related disclosed defects remain one awarded entry.
USD 30,000competition awardRead
PostgreSQL cryptographic parsing omitted a buffer-capacity check
The organizer awarded Team Xint Code USD 30,000 for this individually identified ZeroDay.cloud 2025 competition entry.
USD 30,000competition awardRead
PostgreSQL text-encoding invariant failure caused memory corruption
A PostgreSQL encoding-validation failure earned Team Bugz Bunnies a $30,000 individual-entry award at ZeroDay.cloud. The vendor subsequently issued CVE-2026-2006.
USD 30,000competition awardRead
MariaDB JSON normalization exceeded allocated buffer capacity
The organizer awarded Team Xint Code USD 30,000 for this individually identified ZeroDay.cloud 2025 competition entry.
USD 30,000competition awardRead
V8 optimized object handling retained invalid type assumptions
One V8 type-consistency report earned a USD 50,000 award.
USD 50,000reported awardRead
PostgreSQL extension estimator trusted an unchecked input type
Wiz confirms a USD 30,000 competition award for Daniel Firer’s PostgreSQL entry, uniquely mapped by the organizer to CVE-2026-2004.
USD 30,000competition awardRead
V8 control-flow analysis omitted required initialization checks
A distinct V8 initialization-check report received a vendor-confirmed USD 50,000 award.
USD 50,000reported awardRead
Redis Lua object lifetime failure crossed the scripting boundary
ZDI awarded Wiz researchers USD 40,000 for this single Pwn2Own Berlin 2025 entry.
USD 40,000competition awardRead
macOS SMBFS error handling left inconsistent kernel parser state
A rejected network response left inconsistent filesystem state. The researcher reports a $20,000 award and subsequent payment.
USD 20,000reported awardRead
Connected collection
Related learning
Document Isolation Policy: process separation and residual authority
Explains per-document cross-origin isolation as a response to process-level information exposure that logical origin checks alone cannot prevent. Document Isolation Policy allows independently isolated frames while…
Reviewed 2026-10-03Read
Chromium Rule of Two: input trust, memory safety and privilege
An architecture policy for avoiding the combination of untrusted input, memory-unsafe implementation and high privilege. It explains safer parsing, privilege separation and careful review of unsafe code behind safe…
Reviewed 2026-10-02Read
Connected collection
Visual models
Parsing safety and action authority
Editorial conceptual model derived from the linked cases and official guidance; not a vendor architecture diagram or an exploitation sequence.
Reviewed 2026-10-02Read
Related learning follows the topic crosswalk or an explicit diagram relationship. It does not classify a resource as a finding. Topics overlap, so their counts should not be added together.
GitHub snapshot 2026-10-04
53796974ace8 · JSON exports & schemas · CC BY 4.0 content / MIT software