https://decentsecurity.io/Recent content on Marcel KarlssonHugoen-usWed, 23 Sep 2026 02:41:28 +0000https://decentsecurity.io/posts/stealing-financial-data-on-logout-dom-xss/Wed, 23 Sep 2026 02:41:28 +0000https://decentsecurity.io/posts/stealing-financial-data-on-logout-dom-xss/A logout redirect validated the hostname and ignored the scheme. One encoded newline turned it into same-origin DOM XSS that waited for login and read loan and bank data.https://decentsecurity.io/posts/escaping-vs-code-webviews-the-return-of-the-path-traversal/Wed, 23 Sep 2026 02:20:37 +0000https://decentsecurity.io/posts/escaping-vs-code-webviews-the-return-of-the-path-traversal/How an encoded slash bypassed VS Code&rsquo;s Webview resource allowlist and turned a sandboxed view into an arbitrary file reader.https://decentsecurity.io/posts/how-to-freeze-a-blockchain-with-320-valid-blocks/Wed, 23 Sep 2026 02:13:01 +0000https://decentsecurity.io/posts/how-to-freeze-a-blockchain-with-320-valid-blocks/How misplaced rate limits let one validator freeze a blockchain with 320 valid blocks and no transaction fees.https://decentsecurity.io/posts/image-upload-to-account-takeover/Fri, 10 Jul 2026 00:00:00 +0000https://decentsecurity.io/posts/image-upload-to-account-takeover/I tried to hide code in a picture. A few dead-ends later, one ordinary HTTPS link ran my JavaScript inside any user&rsquo;s logged-in app. No password, one tap.https://decentsecurity.io/cves/Mon, 01 Jan 0001 00:00:00 +0000https://decentsecurity.io/cves/<ul> <li><a href="https://www.cve.org/CVERecord?id=CVE-2026-47284">Microsoft: CVE-2026-47284</a></li> <li><a href="https://www.cve.org/CVERecord?id=CVE-2026-81383">Microsoft: CVE-2026-81383</a></li> <li><a href="https://aws.amazon.com/security/security-bulletins/2026-099-aws/">Amazon AWS: CVE-2026-85781</a></li> </ul>