https://exploit-intel.com/blog/tags/responsible-disclosure/EIP research articles tagged responsible-disclosure.en-usFri, 13 Mar 2026 22:00:00 -0400https://exploit-intel.com/blog/posts/cve-2026-4105-systemd-machined-privilege-escalation/https://exploit-intel.com/blog/posts/cve-2026-4105-systemd-machined-privilege-escalation/CVE-2026-4105 dropped this morning - local privilege escalation to root on desktop Linux via systemd-machined. Two D-Bus calls, no authentication. We fed it to CVEForge before the advisory was an hour old. Seventy-two minutes later: confirmed exploit, Docker labs for vulnerable and patched builds, and a bypass proving the vendor's fix is incomplete. The analysis agent said the fix was thorough. The bypass agent proved it wrong.Fri, 13 Mar 2026 22:00:00 -0400https://exploit-intel.com/blog/posts/cve-2026-28391-openclaw-command-injection-the-day-i-hacked-myself/https://exploit-intel.com/blog/posts/cve-2026-28391-openclaw-command-injection-the-day-i-hacked-myself/CVE-2026-28391 is a CVSS 9.8 command injection in OpenClaw < 2026.2.2, caused by a POSIX vs cmd.exe shell-parsing mismatch. Our own suggestion algorithm ranked it as the most interesting CVEForge target. 8/8 bypass vectors confirmed, code execution verified. This is the story of the day our orchestration layer dispatched a full vulnerability assessment against itself.Mon, 09 Mar 2026 12:00:00 -0400https://exploit-intel.com/blog/posts/72-hours-24-cves-the-cveforge-stress-test/https://exploit-intel.com/blog/posts/72-hours-24-cves-the-cveforge-stress-test/We left CVEForge running for three days. Twenty-four CVEs went in. All twenty-four produced working PoCs. Ten incomplete fixes triggered eight responsible disclosure submissions - six GitHub issues, one MITRE report, one HackerOne 0-day. Here's the full accounting.Sat, 28 Feb 2026 18:00:00 -0400