Security issues I've researched and reported through coordinated disclosure. Advisories are published after a fix ships or the disclosure window closes.

CVE-2026-69744 high Fixed 2026-09-08
Windows/Unauthenticated DoS
Unauthenticated attackers can craft special Kerberos requests causing a fatal crash in LSASS.exe, forcing the system to reboot.
CVE-2026-91926 low Fixed 2026-09-15
gss-ntlmssp/Memory Leak DoS
A memory leak flaw in gss-ntlmssp that allows attackers to cause denial of service through crafted NTLM messages.
GHSA-963m-r92r-qm7c high Fixed 2026-10-20
Samlify/Privilege Escalation
Service-Provider assertion extraction is vulnerable to XML-comment node-splitting allowing user impersonation.
GHSA-c5vw-gpq8-wq2q critical Fixed 2026-11-09
groupoffice/Unauthenticated XSS & DoS
Unauthenticated arbitrary static-method invocation in the site module enables reflected XSS and sync-state destruction
Pending critical Disclosed 2026-10-27
REDACTED/Unauthenticated RCE chain
Unauthenticated Stored XSS allows control of admin browsers and a MIME type bypass allows code execution on affected servers.

5 advisories on record. Responsible disclosure only.