Hadrian

https://hadrian.io/blog

ADDED as candidate by 2026-08-18 (this run's single new candidate). Offensive-security vendor whose Vulnerability Alerts blog publishes original root-cause reversing rather than re-reporting: it reconstructed the GeoServer jsonArrayContains SQL injection from a single researcher post to a working exploit and published the service-dependent exploitation analysis (WFS 1.0 reaching top-level SQL where WFS 2.0's count wrapper traps the injection, and the pgJDBC behaviour that makes preferQueryMode irrelevant) that this run's deep dive rests on, detail that appeared in no advisory. Rated B: original first-hand vulnerability research, not a first-party vendor authority for the affected product. FETCH: `python3 tools/fetch_source.py url https://hadrian.io/blog/<slug>` returned the full article body directly this run (~179 KB raw) with no reader fallback needed; the listing path has not yet been exercised. Promote to active after 3 contributing runs. | 2026-08-19: promoted candidate -> active on the counted promotion bar (three contributing runs per the state digest's promotion_due), not by eyeballing.