Vulnerability-Disclosure-Policy

脆弱性開示ポリシー 私たちは、脆弱性の開示は相互理解が重要であると考えています。研究者だけでなく、ベンダーも協調的な脆弱性開示に参加しなければなりません。Enable Securityは独自の調査を通じて脆弱性を発見した場合、その脆弱性をベンダーに通知し、詳細は最初の連絡から90日後に防御コミュニティに公開します。ただし、ベンダーが修正プログラムをリリースした場合は、それより早く公開します。 Enable Securityは、ベンダーとの機密通信の確立に合理的な努力を払います。 ベンダーのセキュリティチームまたは指定された連絡先との連絡が確立された後、Enable...

CVE-2026-29116

CVE-2026-29116 — Dahua 未認証リモートサービス拒否 DoS アドバイザリ種別: ベンダー連携によるセキュリティ開示 CVE ID: CVE-2026-29116 ベンダー: Dahua Technology 公開日: 2026-06-10T06:16:34 UTC 最終更新: 2026-06-10T06:16:34 UTC ソース: Dahua Product Security Incident PSI Trust Center 目次 要点 一目でわかる 脆弱性のタイムライン 説明 技術的分析 影響を受ける製品 CVSS スコアリング 脆弱性スコアリングの詳細 CW...

security-research

security-research Proof-of-concept code and technical write-ups for vulnerabilities I discovered and reported through coordinated disclosure. Every entry here is already public: the vendor advisory is published and a fixed release is available. Nothing under embargo or in draft is included. The...

GHSA-7GWP-5PFP-969J

creationtimestamp| type| source ---|---|--- 2026-08-18 00:32:32+00:00| seen| https://gist.github.com/alon710/9d43dd3bb8cad3aff005a6b8be53e64d 2026-08-21 09:24:49+00:00| seen| https://bsky.app/profile/mel-echosphere.bsky.social/post/3mtlgunnc4g2v...

Patch Tuesday - June 2026

Microsoft is publishing 200 vulnerabilities on June 2026 Patch Tuesday. Microsoft is not aware of exploitation in the wild for any of these vulnerabilities, and is aware of public disclosure for three. This is similar to last month’s Patch Tuesday, however several of last month’s vulnerabilities...

CVE-2026-4387

StrongDM Desktop Application before 23.74.0 Desktop Client before 53.77.0 on Microsoft Windows stores authentication state, including a JSON Web Token and asymmetric key material, in cleartext in a per-user state file located at C:\Users\.sdm\state.kv. The file is protected only by default...

CVE-2026-4387 Unencrypted storage of authentication state in StrongDM Desktop Application state.kv file

StrongDM Desktop Application before 23.74.0 Desktop Client before 53.77.0 on Microsoft Windows stores authentication state, including a JSON Web Token and asymmetric key material, in cleartext in a per-user state file located at C:\Users\.sdm\state.kv. The file is protected only by default...

Microsoft Slams Public Zero-Day Disclosures Amid GitHub Researcher Account Removal

Microsoft has come out strongly in favor of Coordinated Vulnerability Disclosure CVD, urging the research community to share their findings and give affected vendors an opportunity to better understand the impact and address them before they are publicly disclosed. The development comes after a...

AI Playground Software Advisory

Summary: A potential security vulnerability for some AI Playground software maintained by Intel may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2025-36515 Description: Uncontrolled search path for...

security-advisories

Security Advisories Public write-ups and PoCs for CVEs I've d...

authorized-pentest

authorized-pentest A runbook-style Claude Code skill for runn...

Security-Advisories

Security Advisories — trexnegr0 Public disclosure repository...

Intent redirection vulnerability in third-party SDK exposed millions of Android wallets to potential risk

In this article 1. Technical details 2. Disclosure timeline 3. Mitigation and protection guidance 4. References 5. Learn more During routine security research, we identified a severe intent redirection vulnerability in a widely used third-party Android SDK called EngageSDK. This flaw allows apps ...

Intent redirection vulnerability in third-party SDK exposed millions of Android wallets to potential risk

In this article 1. Technical details 2. Disclosure timeline 3. Mitigation and protection guidance 4. References 5. Learn more During routine security research, we identified a severe intent redirection vulnerability in a widely used third-party Android SDK called EngageSDK. This flaw allows apps ...

Intel® Trace Hub Advisory

Summary: A potential security vulnerability in some Intel® Trace Hub instances may allow escalation of privilege. Intel is releasing prescriptive guidance to address this potential vulnerability. Vulnerability Details: CVEID: CVE-2026-20709 Description: Use of Default Cryptographic Key in the...

CVE-2026-4809

plank/laravel-mediable through version 6.4.0 can allow upload of a dangerous file type when an application using the package accepts or prefers a client-supplied MIME type during file upload handling. In that configuration, a remote attacker can submit a file containing executable PHP code while...

PT-2026-27774

Name of the Vulnerable Software and Affected Versions EspoCRM versions prior to 9.3.4 Description The EspoCRM software contains a flaw due to the formula engine operating outside the field-level restriction layer, allowing writable access to fields marked as read-only, such as Attachment.sourceId...

AI Playground Software Advisory

Summary: A potential security vulnerability for some AI Playground software may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2025-32452 Description: Uncontrolled search path for some AI Playground...

From points to payouts: The evolution of the Microsoft security researcher leaderboard

The global security research community plays a critical role in helping Microsoft protect customers. Through their deep technical expertise, coordinated disclosure, and collaboration, researchers help identify and remediate vulnerabilities, and shape how our security programs evolve. Many of the...

Legal Restrictions on Vulnerability Disclosure

Kendra Albert gave an excellent talk at USENIX Security this year, pointing out that the legal agreements surrounding vulnerability disclosure muzzle researchers while allowing companies to not fix the vulnerabilities--exactly the opposite of what the responsible disclosure movement of the early...