New investigations, twice a week

Every famous bug
has a shape.

CVE Atlas turns real vulnerabilities into interactive stories. Follow the input. Find the sink. See the missing guard.

Explore the atlas How it works
untrusted input
01source
02sink
missing guard
✦
01read the story
02trace the path
03share what you found
The library

Pick a bug to chase.

View all CVEs
CRITICAL4 min trace
CVE-2026-DEMO

The missing check that turns a file field into a heap overflow

A parser trusts a 32-bit length from an untrusted file and passes it to a memory copy without proving the destination is large enough.

atlas-image-parser↗
More traces are coming.

New investigations land every week. Follow along as the atlas grows.

Why this exists

Security research, made legible.

Vulnerability writeups usually ask you to already understand the code. CVE Atlas starts with the human story, then lets you zoom into the evidence. Every trace is built to leave you with one clear idea: this is where the bug lives.