SSD Secure Disclosure

https://ssd-disclosure.com/

Added 2026-07-28 as this run's single new candidate. Coordinated-disclosure programme publishing original root-cause analyses and working proof-of-concept code for vulnerabilities it brokers (primary source for CVE-2026-61511, the vBulletin runMaths pre-auth RCE). Rated B: original vulnerability research, not a first-party vendor authority. FETCH: direct WebFetch returns a partial render; `python3 tools/fetch_source.py url <article-url>` succeeded this run via the reader fallback and returned the full advisory including the root-cause section. | 2026-08-08: rotation-priority catch-up succeeded via the jina reader — the landing page enumerated dated advisories and one article body was retrieved. A second article returned HTTP 202 direct and a robot-challenge page through the reader, so per-article retrieval remains partial. Listing extraction is no longer the blocker; per-article anti-bot is. | 2026-08-09: regression — the landing page itself now returns a Cloudflare-style robot-challenge interstitial through both the direct bridge and the reader, where on 2026-08-08 the reader enumerated the dated advisory listing successfully. Independently observed by S1 and S3. 403/anti-bot never demotes; needs a new transport, not a status change. | 2026-08-10: RECIPE FIX: per-article advisory pages fetch cleanly via `fetch_source.py url <URL>` (direct); it is the jina-reader path that returns a Cloudflare-style robot-challenge interstitial on this host. Try direct FIRST for article bodies and reserve the reader for the listing page. Recovered the Linux bridge STP UAF advisory this run after two prior runs logged it as a transport failure. | 2026-08-11: the listing page https://ssd-disclosure.com/ returned a Cloudflare-style robot-challenge (HTTP 202) to BOTH the direct transport and the reader this run, which inverts the 2026-08-10 recipe note in the other direction: direct works for a KNOWN per-article URL, but neither transport reaches the listing, so discovery has no entry point without an article URL in hand. Keep the direct transport for article bodies; for discovery, try a feed/sitemap path next run before treating the source as unreachable.