935685 matches found
security-research
security-research Proof-of-concept code and technical write-ups for vulnerabilities I discovered and reported through coordinated disclosure. Every entry here is already public: the vendor advisory is published and a fixed release is available. Nothing under embargo or in draft is included. The...
CVE-2026-29116
CVE-2026-29116 — Dahua Denial of Service remoto non autenticato Tipo di advisory: Divulgazione di sicurezza coordinata dal fornitore ID CVE: CVE-2026-29116 Fornitore: Dahua Technology Pubblicata: 2026-06-10T06:16:34 UTC Ultima modifica: 2026-06-10T06:16:34 UTC Fonte: Dahua Product Security Incide...
Vulnerability-Disclosure-Policy
Richtlinie zur Offenlegung von Schwachstellen Wir glauben, dass die Offenlegung von Schwachstellen ein Geben und Nehmen ist. Hersteller sowie Forscher müssen an einer koordinierten Offenlegung von Schwachstellen teilnehmen. Wenn Enable Security im Rahmen eigener Forschung Schwachstellen entdeckt,...
GHSA-7GWP-5PFP-969J
creationtimestamp| type| source ---|---|--- 2026-08-18 00:32:32+00:00| seen| https://gist.github.com/alon710/9d43dd3bb8cad3aff005a6b8be53e64d 2026-08-21 09:24:49+00:00| seen| https://bsky.app/profile/mel-echosphere.bsky.social/post/3mtlgunnc4g2v...
Patch Tuesday - June 2026
Microsoft is publishing 200 vulnerabilities on June 2026 Patch Tuesday. Microsoft is not aware of exploitation in the wild for any of these vulnerabilities, and is aware of public disclosure for three. This is similar to last month’s Patch Tuesday, however several of last month’s vulnerabilities...
CVE-2026-4387
StrongDM Desktop Application before 23.74.0 Desktop Client before 53.77.0 on Microsoft Windows stores authentication state, including a JSON Web Token and asymmetric key material, in cleartext in a per-user state file located at C:\Users\.sdm\state.kv. The file is protected only by default...
CVE-2026-4387 Unencrypted storage of authentication state in StrongDM Desktop Application state.kv file
StrongDM Desktop Application before 23.74.0 Desktop Client before 53.77.0 on Microsoft Windows stores authentication state, including a JSON Web Token and asymmetric key material, in cleartext in a per-user state file located at C:\Users\.sdm\state.kv. The file is protected only by default...
Microsoft Slams Public Zero-Day Disclosures Amid GitHub Researcher Account Removal
Microsoft has come out strongly in favor of Coordinated Vulnerability Disclosure CVD, urging the research community to share their findings and give affected vendors an opportunity to better understand the impact and address them before they are publicly disclosed. The development comes after a...
AI Playground Software Advisory
Summary: A potential security vulnerability for some AI Playground software maintained by Intel may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2025-36515 Description: Uncontrolled search path for...
security-advisories
Security Advisories Public write-ups and PoCs for CVEs I've d...
authorized-pentest
authorized-pentest A runbook-style Claude Code skill for runn...
Security-Advisories
Security Advisories — trexnegr0 Public disclosure repository...
Intent redirection vulnerability in third-party SDK exposed millions of Android wallets to potential risk
In this article 1. Technical details 2. Disclosure timeline 3. Mitigation and protection guidance 4. References 5. Learn more During routine security research, we identified a severe intent redirection vulnerability in a widely used third-party Android SDK called EngageSDK. This flaw allows apps ...
Intent redirection vulnerability in third-party SDK exposed millions of Android wallets to potential risk
In this article 1. Technical details 2. Disclosure timeline 3. Mitigation and protection guidance 4. References 5. Learn more During routine security research, we identified a severe intent redirection vulnerability in a widely used third-party Android SDK called EngageSDK. This flaw allows apps ...
Intel® Trace Hub Advisory
Summary: A potential security vulnerability in some Intel® Trace Hub instances may allow escalation of privilege. Intel is releasing prescriptive guidance to address this potential vulnerability. Vulnerability Details: CVEID: CVE-2026-20709 Description: Use of Default Cryptographic Key in the...
CVE-2026-4809
plank/laravel-mediable through version 6.4.0 can allow upload of a dangerous file type when an application using the package accepts or prefers a client-supplied MIME type during file upload handling. In that configuration, a remote attacker can submit a file containing executable PHP code while...
PT-2026-27774
Name of the Vulnerable Software and Affected Versions EspoCRM versions prior to 9.3.4 Description The EspoCRM software contains a flaw due to the formula engine operating outside the field-level restriction layer, allowing writable access to fields marked as read-only, such as Attachment.sourceId...
AI Playground Software Advisory
Summary: A potential security vulnerability for some AI Playground software may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2025-32452 Description: Uncontrolled search path for some AI Playground...
From points to payouts: The evolution of the Microsoft security researcher leaderboard
The global security research community plays a critical role in helping Microsoft protect customers. Through their deep technical expertise, coordinated disclosure, and collaboration, researchers help identify and remediate vulnerabilities, and shape how our security programs evolve. Many of the...
Legal Restrictions on Vulnerability Disclosure
Kendra Albert gave an excellent talk at USENIX Security this year, pointing out that the legal agreements surrounding vulnerability disclosure muzzle researchers while allowing companies to not fix the vulnerabilities--exactly the opposite of what the responsible disclosure movement of the early...