CVE

CVE Avvisi e documenti di Responsible Disclosure per le CVE di CloudAware...

pocs

pocs pubblicheremo i pocs in questo repo tutti i bug in questo repo sono divulgati in modo responsabile...

mbadanoiu

Benvenuto nel Weekend Retreat di Matei "Mal" Badanoiu Questo GitHub viene utilizzato per pubblicare le mie CVE e le mie ricerche di sicurezza durante il mio tempo libero/nei fine settimana. Tutti i materiali presenti in questo profilo GitHub sono destinati alla ricerca sulla sicurezza e all'hacki...

public-bugbounty-programs

Programmi di Bug Bounty Pubblici Elenco curato dalla comunità di programmi di bug bounty pubblici e di divulgazione responsabile. Questo repository funge da sistema di gestione centrale per i programmi di bug bounty pubblici utilizzati su Chaos da ProjectDiscovery. Modello dei dati File sorgente:...

CVE-2026-30503-OpenKM-6.3.12-Stored-XSS

🛡️ CVE-2026-30503 — XSS Memorizzata in OpenKM v6.3.12 Scoperto e segnalato daDharmendra Kumar — Ricercatore di Sicurezza Cybersicurezza | Penetration Testing | Ricerca di Vulnerabilità | Divulgazione Responsabile 📌 Indice Panoramica Dettagli CVE Prodotto Affetto Descrizione della Vulnerabilità...

CVE-Disclosures

Ricerca sulla Sicurezza & Divulgazione CVE🔥 Un repository che documenta le vulnerabilità di sicurezza scoperte nel Free and Open Source Software FOSS da VETTRIVEL U Esistono solo due tipi di aziende: quelle che hanno subito una violazione e lo sanno, e quelle che hanno subito una violazione ma no...

responsible-disclosure-email-gathering

Responsible Disclosure E-Mail-Sammlung Zweck Möglicherweise hast du eine Schwachstelle auf einem Host gefunden, aber der betreffende Host/die Organisation hat kein aktives Programm auf HackerOne oder BugCrowd. Falls das der Fall ist, ist dieser Workflow genau das Richtige für dich! Im Wesentliche...

Exploit for CVE-2026-65058

Trezor Safe Calldata Confirmation-Binding Bypass — CVE-2026-65...

CVE-2026-8169

ExtremeXOS EXOS uses a challenge-response mechanism to authorize access to the privileged debug-mode function. The challenge value is generated using an insufficiently random source, which under certain conditions may allow an attacker to predict the expected response and activate debug-mode...

PYSEC-2026-2040 Weblate has an arbitrary file read via symbolic links

Impact It was possible to read arbitrary files from the server file system using crafted symbolic links in the repository. Resources Thanks to Jason Marcello for responsible disclosure...

PYSEC-2026-2042 Weblate has improper validation upon invitation acceptance

Impact It was possible to accept an invitation opened by a different Weblate user. Patches https://github.com/WeblateOrg/weblate/pull/16913 Workarounds Users should avoid leaving Weblate sessions with an unattended opened invitation. References Thanks to Nahid0x for responsibly disclosing this...

PYSEC-2026-571 Weblate is vulnerable to RCE through Git config file overwrite

Impact It was possible to overwrite Git configuration remotely and override some of its behavior. Resources Thanks to Jason Marcello for responsible disclosure...

PT-2026-53623

Impact TorchServe's check on allowed urls configuration can be by-passed if the URL contains characters such as ".." but it does not prevent the model from being downloaded into the model store. Once a file is downloaded, it can be referenced without providing a URL the second time, which...

NextJS-Middleware-Bypass-PoC

MCID15795619: Next.js Middleware Bypass PoC Executive Summ...

Compromise OpenClaw with Prompt Injections in Message Objects

Executive Summary As powerful personal AI assistants become increasingly widespread, their ability to access tools, files, and external services also makes them susceptible to prompt injection attacks, where malicious content can manipulate their behavior. This research evaluated OpenClaw against...

PT-2026-48391

Name of the Vulnerable Software and Affected Versions Warp versions 0.2025.08.06.08.12.stable 00 through 0.2026.05.06.15.41.stable 01 Description A command injection exists in the prompt branch selector. An attacker who publishes a crafted branch name to a Git repository can execute arbitrary...

CVE-2025-71211

A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected installations. This vulnerability is similar in scope to CVE-2025-71210 but affects a different executable. Please note: although this vulnerabili...

PT-2026-46955

Six live production platforms were compromised during responsible disclosure testing. LiteLLM CVE-2026-30623, Critical, patched, Windsurf CVE-2026-30615, Critical, reported, Bisheng CVE-2026-33224, Critical, patched, and DocsGPT CVE-2026-26015, Critical, patched…...

Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Linux Linux_Kernel

Chronomaly — CVE-2025-38352 on LG webOS Kernel exploit for C...

CVE-2025-71210

A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected installations. Please note: although this vulnerability carries a technical critical CVSS rating, this was reported via responsible disclosure via...