# Mehmet Ince @mdisec \- Vulnerability Researcher \| Building security products \| Security Advisor \| Amateur Muay Thai fighter: a hacker at heart, a builder by practice, and a mentor by purpose\. As co\-founder of PRODAFT, I’ve spent the last two decades in vulnerability research and security product engineering\.

Generated by Yoast SEO v28.6, this is an llms.txt file, meant for consumption by LLMs.

## Pages
- [Hi I'm Mehmet Ince](https://mehmetince.net/)
- [About](https://mehmetince.net/about-me/)
- [Disclosed CVEs](https://mehmetince.net/cve/)
- [Posts](https://mehmetince.net/posts/)

## Posts
- [Part 2/6 \| Breaking the Postgres Superuser Guardrails: Attacking Security\-Hardening Extensions \|Systemic Risks in the Managed PostgreSQL Industry](https://mehmetince.net/part-2-6-breaking-the-superuser-guardrails-attacking-security-hardening-extensions-systemic-risks-in-the-managed-postgresql-industry/)
- [Part 1/6 \| Systemic Risks in the Managed PostgreSQL Industry: Extension Risks Are Real\! Exploiting PostGis Memory Corruption Bug at NeonDB, SupaBase and Many More](https://mehmetince.net/part-1-6-systemic-risks-in-the-managed-postgresql-industry-extension-risks-are-real-exploiting-postgis-memory-corruption-bug-at-neondb-supabase-and-many-more/)
- [Inside PostHog: How SSRF, a ClickHouse SQL Escaping 0day, and Default PostgreSQL Credentials Formed an RCE Chain \(ZDI\-25\-099, ZDI\-25\-097, ZDI\-25\-096\)](https://mehmetince.net/inside-posthog-how-ssrf-a-clickhouse-sql-escaping-0day-and-default-postgresql-credentials-formed-an-rce-chain-zdi-25-099-zdi-25-097-zdi-25-096/)
- [The Story of a Perfect Exploit Chain: Six Bugs That Looked Harmless Until They Became Pre\-Auth RCE in a Security Appliance](https://mehmetince.net/the-story-of-a-perfect-exploit-chain-six-bugs-that-looked-harmless-until-they-became-pre-auth-rce-in-a-security-appliance/)
- [The Chessboard of Security: Insights on Product Development and Vulnerabilities from a Hacker Perspective](https://mehmetince.net/the-chessboard-of-security-insights-on-product-development-and-vulnerabilities-from-a-hacker-perspective/)

## Disclosed Vulnerabilities
- [CVE\-2026\-14678 \- BITVECP Out of Bound Read](https://mehmetince.net/vulnerability/cve-2026-14678-cve-2026-14678-bitvecp-out-of-bound-read/)
- [CVE\-2026\-61821 \- authorization bypass to move child tables between schemas](https://mehmetince.net/vulnerability/cve-2026-61821-cve-2026-61821-authorization-bypass-to-move-child-tables-between-schemas/)
- [CVE\-2026\-11945 \- SQL injection in the rules import functions](https://mehmetince.net/vulnerability/cve-2026-11945-cve-2026-11945-sql-injection-in-the-rules-import-functions/)
- [CVE\-2026\-58139 \- Security Policy Bypass via load\_aws\_credentials Procedure](https://mehmetince.net/vulnerability/cve-2026-58139-cve-2026-58139-security-policy-bypass-via-load_aws_credentials-procedure/)
- [CVE\-2026\-70634 \- Out\-of\-Bounds Read Information Disclosure via Reverse Iterator](https://mehmetince.net/vulnerability/cve-2026-70634-cve-2026-70634-out-of-bounds-read-information-disclosure-via-reverse-iterator/)

## Categories
- [Vulnerability Research](https://mehmetince.net/category/vulnerability-research/)
- [Appsec](https://mehmetince.net/category/appsec/)
- [Uncategorized](https://mehmetince.net/category/uncategorized/)

## Tags
- [exploit](https://mehmetince.net/tag/exploit/)
- [advisory](https://mehmetince.net/tag/advisory/)
- [0day](https://mehmetince.net/tag/0day/)
- [metasploit](https://mehmetince.net/tag/metasploit/)
- [cve](https://mehmetince.net/tag/cve/)

## Optional
- [Sitemap index](https://mehmetince.net/wp-sitemap.xml)