Vulnerability research in the software the world runs on.

Totals

Reported

78

Confirmed by maintainers

12

Published so far

1

Projects

31

Critical

1

High

33

78 reported, 12 confirmed by their maintainers, who are preparing fixes, and 1 published so far. We don't name the projects or describe the issues until each fix ships and the advisory is public.

• high 8.1 FileBrowser Quantum GHSA-c84q-q5g6-r47f Published 13 October 2026

  With per-user home folders turned on, an account whose name cleans to nothing or to another user's name gets the wrong home: every user's files, or one victim's. It can read, create and overwrite them.

  Read the advisory →

• We test our own copies.

  We build and run open-source software in our own lab. We never test a host we don't own or aren't authorized to test.

• We prove it before we report it.

  Every report is proved end to end, with a control run, before a maintainer sees it. If we can't prove it, we don't send it.

• We report privately.

  Each vulnerability goes to the maintainers through GitHub's private vulnerability reporting, usually with a proposed fix.

• We never publish first.

  Nothing about a vulnerability is made public before a fix ships and the maintainer publishes the advisory.

• We publish once they have.

  After the maintainer's advisory is out, we list it here in full.

• We are open about AI.

  We use AI in our research and say so when a maintainer's reporting form asks.

Found something in Ambit itself? See our vulnerability disclosure policy.