public-bugbounty-programs

Public BugBounty Programs Community curated list of public bug bounty and responsible disclosure programs. This repo serves as the central management system for the public bug bounty programs used on Chaos by ProjectDiscovery. Data Model Source file: src/data.yaml. Schema: src/data.schema.json...

CVE-2026-30503-OpenKM-6.3.12-Stored-XSS

🛡️ CVE-2026-30503 — XSS Almacenado en OpenKM v6.3.12 Descubierto y reportado porDharmendra Kumar — Investigador de Seguridad Ciberseguridad | Pruebas de Penetración | Investigación de Vulnerabilidades | Divulgación Responsable 📌 Tabla de Contenidos Resumen Detalles del CVE Producto Afectado...

pocs

pocs publicaremos pocs en este repositorio todos los bugs en este repositorio se divulgan de forma responsable...

AI-Red-Teaming-Playground-Labs

AI Red Teaming Playground Labs This repository contains the challenges for the labs used in the course "AI Red Teaming in Practice". The course was originally taught at Black Hat USA 2024 by Dr. Amanda Minnich and Gary Lopez. Martin Pouliot handled the infrastructure and scoring for the challenge...

responsible-ai-toolbox

Responsible AI Toolbox Responsible AI is an approach to assessing, developing, and deploying AI systems in a safe, trustworthy, and ethical manner, and take responsible decisions and actions. Responsible AI Toolbox is a suite of tools providing a collection of model and data exploration and...

mbadanoiu

Welcome to the Weekend Retreat of Matei "Mal" Badanoiu This GitHub is used to post my CVEs and Security Research during my free time/weekends. All materials present in this GitHub profile are meant for security research and etichal hacking. I do not condone malicious behavoiur such as hacking...

CVE

CVE Advisories and Responsible Disclosure Documents for CloudAware CVE's...

responsible-disclosure-email-gathering

Recopilación de Correos Electrónicos de Divulgación Responsable Propósito Es posible que hayas encontrado una vulnerabilidad en un host, pero dicho host/organización no tiene un programa activo en HackerOne o BugCrowd. Si este es el caso, ¡este flujo de trabajo es para ti! En términos generales,...

CVE-2025-11371

Disclaimer This project is published for educational and research purposes only. Use of this software for attacking targets without explicit prior consent is illegal. The author is not responsible for any misuse, damage, or legal consequences resulting from the use of this code. Always follow...

CVE-Disclosures

Security Research & CVE Disclosures🔥 A repository documenting security vulnerabilities discovered in Free and Open Source Software FOSS by VETTRIVEL U There are only two types of companies: those that have been breached and know it, and those that have been breached and don’t know it yet. – ed...

Exploit for CVE-2026-65058

Trezor Safe Calldata Confirmation-Binding Bypass — CVE-2026-65...

CVE-2026-8169

ExtremeXOS EXOS uses a challenge-response mechanism to authorize access to the privileged debug-mode function. The challenge value is generated using an insufficiently random source, which under certain conditions may allow an attacker to predict the expected response and activate debug-mode...

PYSEC-2026-2040 Weblate has an arbitrary file read via symbolic links

Impact It was possible to read arbitrary files from the server file system using crafted symbolic links in the repository. Resources Thanks to Jason Marcello for responsible disclosure...

PYSEC-2026-2042 Weblate has improper validation upon invitation acceptance

Impact It was possible to accept an invitation opened by a different Weblate user. Patches https://github.com/WeblateOrg/weblate/pull/16913 Workarounds Users should avoid leaving Weblate sessions with an unattended opened invitation. References Thanks to Nahid0x for responsibly disclosing this...

Security fix: Addressing a GX mods vulnerability

News, Security Security fix: Addressing a GX mods vulnerability Share July 3rd, 2026 Hi Opera users, Recently, an independent security researcher responsibly disclosed a vulnerability in Opera GX. The vulnerability, which has since been patched, took advantage of our mods functionality. After...

PYSEC-2026-571 Weblate is vulnerable to RCE through Git config file overwrite

Impact It was possible to overwrite Git configuration remotely and override some of its behavior. Resources Thanks to Jason Marcello for responsible disclosure...

PT-2026-53623

Impact TorchServe's check on allowed urls configuration can be by-passed if the URL contains characters such as ".." but it does not prevent the model from being downloaded into the model store. Once a file is downloaded, it can be referenced without providing a URL the second time, which...

NextJS-Middleware-Bypass-PoC

MCID15795619: Next.js Middleware Bypass PoC Executive Summ...

Compromise OpenClaw with Prompt Injections in Message Objects

Executive Summary As powerful personal AI assistants become increasingly widespread, their ability to access tools, files, and external services also makes them susceptible to prompt injection attacks, where malicious content can manipulate their behavior. This research evaluated OpenClaw against...

PT-2026-48391

Name of the Vulnerable Software and Affected Versions Warp versions 0.2025.08.06.08.12.stable 00 through 0.2026.05.06.15.41.stable 01 Description A command injection exists in the prompt branch selector. An attacker who publishes a crafted branch name to a Git repository can execute arbitrary...