Mars: Account Takeover in Password Reset Function

A critical authentication bypass vulnerability was present in the password reset functionality of the website. The vulnerability allowed attackers to take over any user account without requiring access to the victim's phone number or one-time password. The security flaw existed in the...

Bykea: Critical Information Disclosure via /talos/api/v1/files/upload

A vulnerability was discovered in the file upload functionality, where uploaded files were first stored on the server before being sent to S3. Due to a configuration flaw, memory chunks from the server were included in some uploaded files. This issue was classified as critical and was addressed a...

SingleStore: Exceeding the limit of Workspaces via Race Condition

The reporter discovered a race condition vulnerability in backend.singlestore.com that allowed free-tier users to bypass the 5-workspace limit by sending multiple simultaneous CreateWorkspace requests. This issue was patched by SingleStore as of October 3rd, 2025...

curl: arbitrary file read via `file://` path traversal with `--path-as-is`

Summary: Using --path-as-is with a file:// URL skips normalization of .. segments allowing reading of any local file the process can access Affected version curl 8.15.0-DEV commit 2a9dfe275, June 27, 2025 on Kali Linux 2024.3, x8664 Steps To Reproduce: 1. bulild curl with debug and ASan: git clon...

curl: OS Command Injection in scripts/firefox-db2pem.sh via untrusted certificate nicknames

On AI usage: Only for grammar/formatting suggestions/POC code troubleshooting; all vulnerability discovery, POC code creation, and analysis were done manually. Hey folks, I noticed something I think is worth bringing to you-- scripts/firefox-db2pem.sh helper in the curl source uses eval certutil ...

SingleStore: Exceed the maximum number of subscribers using Race Condition

A race condition vulnerability was discovered in the SingleStore control panel that allowed bypassing the maximum limit of five subscribers for alerts. The issue was patched and deployed to production...

Incorrect Access Control check results in authorization bypass

Description When setting the access control for users, an incorrect access check allows for the bypass of authorization, due to the incorrect use of .some Proof of Concept 1. This is for a scenario, where I admin have created a custom agent and want everyone on the platform to use it, without bei...

SSRF in MLflow via user-controlled gateway_path parameter

Description A Server-Side Request Forgery SSRF vulnerability exists in the gatewayproxyhandler function of MLflow. This function accepts a user-controlled gatewaypath parameter and concatenates it directly with a targeturi, allowing an attacker to control the full outbound HTTP request path from...

SingleStore: IDOR - Scheduled data leak to other accounts By "projectID"

The Insecure Direct Object Reference IDOR vulnerability was discovered in the GetNotebookScheduledPaginatedJobs endpoint on backend.singlestore.com. The API failed to verify the requestor's permission to access the specified project, allowing an authenticated user to access scheduled job...

Mass Assignment

Description Mass assignment is a vulnerability that occurs when an application automatically binds user-provided data e.g., from JSON via req.query to internal object properties or database fields without proper filtering. This can allow attackers to manipulate sensitive fields they shouldn’t hav...

AWS VDP: Remote Code Execution in Amazon MWAA due to outdated Apache Airflow version

Explanation: I am a penetration tester working with Siemens. During a collaborative security assessment with an internal team, I discovered a Remote Code Execution RCE vulnerability in an Amazon Managed Workflows for Apache Airflow MWAA environment. I initially reported this issue to the AWS...

Bypass of Mysql Jdbc Attck for CVE-2025-6507

Credits Le1ahttps://github.com/Le1a A1kaidhttps://github.com/for-A1kaid ph0ebushttps://github.com/ph0ebus Description Attackers can exploit this vulnerability to read any system file and even execute arbitrary code through deserialization. The project manager fixed CVE-2025-6507 which I discovere...

Improper Access Control in Socket.IO Event Handlers Allows Unauthenticated Execution of Sensitive Actions

1. Summary Vulnerability: Unauthenticated Access to Sensitive Socket.IO Events Affected Component: lollmsgenerationevents.py in the lollms server Root Cause: Sensitive actions exposed via Socket.IO events lack authentication and authorization checks, and the application relies on insecure global...

curl: Credential leak on redirect due to improper state clearing when parsing macdef in netrc.c

Summary : -When parsing a netrc. file, the macdef keyword fails to clear previously loaded credentials. If a redirect follows, these credentials are leaked to the new host. This is a new variant of CVE-2024-11053, triggered by a different code path 'macdef' instead of 'default'. No, this...

curl: Sensitive information disclosure with malicious netrc file

libcurl at commit 879b6075a1132c137920060ed262b3f5a58c18c2 contains a vulnerability where it can be coerced into reading over the boundaries of a heap-chunk and sending the resulting data over the network to an attacker. This can lead to a disclosure of sensitive data, including pointers or other...

Cloudflare Public Bug Bounty: `use-mcp`'s oauth2 process uses a window.open call with untrusted mcp server provided data allowing for code execution under the page using it

The authorizeEndpoint parameter from use-mcp version was susceptible to XSS. Sanitization of that parameter was added in version 0.0.10 of use-mcp. A skilled attacker was able to turn this XSS into code execution on the client...

Omise: PII Exposure via Email Confirmation Link – Email Embedded in Token & Leaked via Wayback Machine

The vulnerability involved the exposure of personally identifiable information PII, specifically email addresses, through an email confirmation link used by Omise. The email address was embedded directly in a token that was visible in the URL. This token was subsequently archived by the Wayback...

Regular Expression Denial of Service (ReDoS) in AdamWeightDecay Optimizer

The AdamWeightDecay optimizer is vulnerable to Regular Expression Denial of Service ReDoS. If an attacker can control the patterns in the includeinweightdecay or excludefromweightdecay lists, they can provide a malicious regular expression that causes catastrophic backtracking. When the optimizer...

Path Traversal in Tokenizer Conversion Script

The script for converting slow tokenizers is vulnerable to a Path Traversal attack via the --checkpointname command-line argument. This allows an attacker to create files outside of the intended dumppath directory. Vulnerable Code Location: The vulnerability is located in the logic for converting...

U.S. Dept Of Defense: Reflected XSS via user parameter on getconfig.esp endpoint

The getconfig.esp endpoint was found to reflect unsanitized user input provided in the user parameter directly into the HTML response, resulting in a Reflected Cross-Site Scripting XSS vulnerability. The affected product was Fortinet SSL VPN FortiOS version 3.0.1-10...