security-research

security-research Personal CVE PoC repository — exploit scrip...

exploitarium

https://discord.gg/WytKH65ZR join up for research, help, documen...

PYSEC-2026-1581 Local Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download Service

Summary The download service downloadservice.py makes HTTP requests using raw requests.get without utilizing the application's SSRF protection saferequests.py. This can allow attackers to access internal services and attempt to reach cloud provider metadata endpoints AWS/GCP/Azure, as well as...

Malicious code in apple-mycelium-internal-research (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7208 Malicious code in apple-mycelium-internal-research (npm)

--- -= Per source details. Do not edit below this line.=-...

Server-Side Request Forgery in langchain-community.retrievers.web_research.WebResearchRetriever

A Server-Side Request Forgery SSRF vulnerability exists in the Web Research Retriever component in langchain-community langchain-community.retrievers.webresearch.WebResearchRetriever. The vulnerability arises because the Web Research Retriever does not restrict requests to remote internet...

PYSEC-2026-1516 Server-Side Request Forgery in langchain-community.retrievers.web_research.WebResearchRetriever

A Server-Side Request Forgery SSRF vulnerability exists in the Web Research Retriever component in langchain-community langchain-community.retrievers.webresearch.WebResearchRetriever. The vulnerability arises because the Web Research Retriever does not restrict requests to remote internet...

Exploit for CVE-2026-14191

cve-id ⚡ Simple Usage Use this project only in safe and...

Suspected China-Aligned Hackers Exploit Roundcube Flaws Against Universities

A suspected China-aligned threat activity cluster has been observed exploiting Roundcube webmail software belonging to physics and engineering departments of U.S. and Canadian universities as part of a new campaign. The activity involves the exploitation of now-patched, critical security flaws in...

Exploit for CVE-2026-11405

cve-id ⚡ Simple Usage Use this project only in safe and...

CVE-Reports

!CVE-Reportshttps://socialify.git.ci/d0ctorsec/CVE-Reports/im...

Exploit for CVE-2026-53359

cve-id ⚡ Simple Usage Use this project only in safe and...

CVE-2026-14904: Improper Link Resolution Before File Access

AWS Research and Engineering Studio RES is an open-source solution that enables researchers and engineers to create and manage secure virtual desktops and computing resources on AWS. Improper link resolution before file access issue CWE-59 in the Auth.GetUserPrivateKey API. An authenticated remot...

XDECAF: An Extensible Data Flow Diagram Analysis Framework for Information Security

xDECAF is an extensible tool for architecture-based data flow analysis with a focus on information security. It combines an extended data flow diagram metamodel of labeled flows and nodes, a domain-specific constraint language with different flow operations, and a browser-based editor backed by a...

PT-2026-56166

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description Information regarding this issue is limited to its discovery through AI-driven research workflows focused on Web3 security. Recommendations At the moment, there is no information about a newer...

web-security-research

Web Application Security Research - SQL Injection & XSS Comparat...

Blockchain Attacks and Defenses: A Layered and Cross-Domain Survey

Blockchains have evolved from simple distributed ledgers into programmable platforms that process complex application logic and carry significant financial value. All modern Web3 systems share a common goal: providing secure, decentralized, and trustworthy execution in an increasingly...

PT-2026-55984

Over the past months, six additional vulnerabilities I reported on @Hacker0x01 have been assigned CVE identifiers, bringing my personal total to 19 CVEs. New CVEs: CVE-2026-4260 CVE-2026-13374 CVE-2026-13375 CVE-2026-13376 CVE-2026-13377 CVE-2026-13378 These issues have been addressed by...

PT-2026-55983

The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form 7 Form Field in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers ...

Congratulations to the MSRC 2026 Most Valuable Security Researchers

We are grateful to every security researcher who partnered with us over the past year. Through their reports and collaboration, they helped us identify and address vulnerabilities across our products and services...