First blood on P=NP.
Off-by-two loop counter overflow overwrites struct fields via unbounded scanf
CBC malleability + GF(2^64) basis to forge a ciphertext block without the key
XOR-malleable signatures: forge root's signature from a leaked user signature
A leaked p+q relation factors N via a brute-forced Fermat-style quadratic
CBC syntax-oracle recovers AES intermediate state, then injects RCE into a forked jail
Polynomial reconstruction with errors, solved via LLL lattice reduction
SROP-dispatch VM with an intractable brute force — invert the mixing chain instead
Hardcoded point array drawn with an oversized brush — reimplement the renderer with a 1px pen
Repeating-key XOR + mod-128 subtract, trivially reversible
A voxel automaton's update ruleset is itself a Fisher–Yates-encoded message
Automating 10 rounds of math to prove you’re a robot
Dead code leaked through a shipped production source map
Path traversal + validate-after-save to overwrite a DMTCP checkpoint = RCE
CL.TE request smuggling chained into CVE-2021-41773 path traversal RCE
urljoin SSRF-to-file-read chained with an upload write/delete race
PRNU fingerprinting: match camera sensor noise to identify which camera took each photo
Redacted PDF whose "redacted" image is still fully embedded underneath
Argument injection via unquoted find input + -execdir to bypass -exec block and keyword filter
Reading pickle opcodes as data instead of executing them
Hand-parsing a Terraria .wld tile format to find text painted into the map
The flag was sitting in an earlier git commit