CVE-2026-30503-OpenKM-6.3.12-Stored-XSS

🛡️ CVE-2026-30503 — Stored XSS in OpenKM v6.3.12 Discovered & Reported by Dharmendra Kumar — Security Researcher Cybersecurity | Penetration Testing | Vulnerability Research | Responsible Disclosure 📌 Table of Contents Overview CVE Details Affected Product Vulnerability Description Root Cause...

bounty-targets-data

bounty-targets-data What's it for This repo contains data dumps of Hackerone and Bugcrowd scopes i.e. the domains that are eligible for bug bounty reports. The files provided are: Main files: domains.txt: full list of domains, without wildcards. wildcards.txt: full list of wildcard domains. Note:...

CVE-Disclosures

Security Research & CVE Disclosures🔥 A repository documenting security vulnerabilities discovered in Free and Open Source Software FOSS by VETTRIVEL U There are only two types of companies: those that have been breached and know it, and those that have been breached and don’t know it yet. – ed...

pocs

pocs 我们将在此仓库中发布PoC 此仓库中的所有漏洞均已负责任地披露...

mbadanoiu

欢迎来到 Matei "Mal" Badanoiu 的周末静修所 这个 GitHub 用于发布我的 CVE 和我在空闲时间/周末进行的安全研究。 本 GitHub 个人资料中的所有材料均用于安全研究和道德黑客行为。 我不赞同恶意行为，例如未经授权入侵系统、勒索软件，或对我工作的任何不道德使用。 我是谁？ 我是： Matei "Mal" Badanoiu 黑客 安全研究员 24/6（我会休息一天……有时候） 拥有 +120 个负责任披露的 0-day/CVE 附加信息 如果你发现任何拼写/语法错误和/或其他问题，请在相应的仓库中开启 issue。谢谢。 问：为什么你把 CVE 写成 PDF...

CVE

CVE Advisories and Responsible Disclosure Documents for CloudAware CVE's...

responsible-disclosure-email-gathering

Responsible Disclosure Email Gathering Purpose You may have found a vulnerability on a host but the said host/org does not have an active program on HackerOne or BugCrowd. If this is the case this workflow is for you! Broadly it will crawl the website and look for any security related emails from...

CVE-2025-11371

免责声明 本项目仅用于教育和研究目的 。 未经明确事先同意 而使用本软件攻击目标属于违法行为 。 作者对因使用本代码而产生的任何滥用、损害或法律后果概不负责 。 请始终遵循负责任披露实践 ，并且仅在您拥有或获得许可使用的受控环境 中进行测试。...

Wordfence Bug Bounty Program Monthly Report – May 2026

In May 2026, the Wordfence Bug Bounty Program received 1095 vulnerability submissions from our growing community of security researchers working to improve the overall security posture of the WordPress ecosystem. These submissions are reviewed, triaged, and processed by the Wordfence Threat...

Exploit for CVE-2026-65058

Trezor Safe Calldata Confirmation-Binding Bypass — CVE-2026-65...

CVE-2026-8169

ExtremeXOS EXOS uses a challenge-response mechanism to authorize access to the privileged debug-mode function. The challenge value is generated using an insufficiently random source, which under certain conditions may allow an attacker to predict the expected response and activate debug-mode...

PYSEC-2026-2040 Weblate has an arbitrary file read via symbolic links

Impact It was possible to read arbitrary files from the server file system using crafted symbolic links in the repository. Resources Thanks to Jason Marcello for responsible disclosure...

PYSEC-2026-2042 Weblate has improper validation upon invitation acceptance

Impact It was possible to accept an invitation opened by a different Weblate user. Patches https://github.com/WeblateOrg/weblate/pull/16913 Workarounds Users should avoid leaving Weblate sessions with an unattended opened invitation. References Thanks to Nahid0x for responsibly disclosing this...

Security fix: Addressing a GX mods vulnerability

News, Security Security fix: Addressing a GX mods vulnerability Share July 3rd, 2026 Hi Opera users, Recently, an independent security researcher responsibly disclosed a vulnerability in Opera GX. The vulnerability, which has since been patched, took advantage of our mods functionality. After...

PYSEC-2026-571 Weblate is vulnerable to RCE through Git config file overwrite

Impact It was possible to overwrite Git configuration remotely and override some of its behavior. Resources Thanks to Jason Marcello for responsible disclosure...

PT-2026-53623

Impact TorchServe's check on allowed urls configuration can be by-passed if the URL contains characters such as ".." but it does not prevent the model from being downloaded into the model store. Once a file is downloaded, it can be referenced without providing a URL the second time, which...

NextJS-Middleware-Bypass-PoC

MCID15795619: Next.js Middleware Bypass PoC Executive Summ...

Compromise OpenClaw with Prompt Injections in Message Objects

Executive Summary As powerful personal AI assistants become increasingly widespread, their ability to access tools, files, and external services also makes them susceptible to prompt injection attacks, where malicious content can manipulate their behavior. This research evaluated OpenClaw against...

PT-2026-48391

Name of the Vulnerable Software and Affected Versions Warp versions 0.2025.08.06.08.12.stable 00 through 0.2026.05.06.15.41.stable 01 Description A command injection exists in the prompt branch selector. An attacker who publishes a crafted branch name to a Git repository can execute arbitrary...

CVE-2025-71211

A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected installations. This vulnerability is similar in scope to CVE-2025-71210 but affects a different executable. Please note: although this vulnerabili...