Argus Systems / ByteRay Ltd. Platform First public signal Jun 5, 2026

Argus / ByteRay

An AI vulnerability-research platform publishing proof-oriented disclosures across OP-TEE, OpenBSD, curl, Zabbix, and embedded systems.

Indexed entries

CVE IDs tracked

Critical/high entries

82%

Evidence index

Argus Proof of Possession: 18 public disclosures. Checked August 19, 2026. Bugflation excludes 159 embargoed reports and entries marked Won't Fix. Open tracker.

What it is

Argus and ByteRay publish AI-attributed vulnerability research through a proof-of-possession tracker. The public side exposes technical descriptions, disclosure state, affected projects, and CVE identifiers where assigned.

What is verified

The initial ledger entry covers three OP-TEE CVEs and one OpenBSD CVE. Separate no-CVE entries cover a disclosed Zabbix authorization flaw and a disclosed curl SSH connection-reuse flaw. Reserved and embargoed reports are not counted, and two Zabbix reports explicitly marked Won’t Fix remain excluded.

The platform attribution comes from Argus, while public CVE records and project material corroborate the CVE-backed subset. Entries are therefore labeled self-reported.

Sources

Attributed findings

Catalogued entries credited to Argus / ByteRay.

ID Title System Disclosed Severity

CVE-2026-71967 + 3 more Argus discloses four OP-TEE and OpenBSD CVEs Heap underwrite, use-after-free, secure-world denial of service, and wireless countermeasure logic failure - self-reported Argus / ByteRay (self-reported) Aug 6, 2026 high argus-zabbix-report-test-idor Argus finds cross-user dashboard disclosure in Zabbix report.test Insecure direct object reference and broken authorization - self-reported Argus (self-reported) Jun 10, 2026 high argus-curl-ssh-connection-reuse Argus finds SSH identity confusion in libcurl connection reuse Authentication-context confusion in connection pooling - self-reported Argus (self-reported) Jun 8, 2026 high