34589 matches found
public-bugbounty-programs
Public BugBounty Programs Community curated list of public bug bounty and responsible disclosure programs. This repo serves as the central management system for the public bug bounty programs used on Chaos by ProjectDiscovery. Data Model Source file: src/data.yaml. Schema: src/data.schema.json...
responsible-ai-toolbox
Responsible AI Toolbox Responsible AI is an approach to assessing, developing, and deploying AI systems in a safe, trustworthy, and ethical manner, and take responsible decisions and actions. Responsible AI Toolbox is a suite of tools providing a collection of model and data exploration and...
AI-Red-Teaming-Playground-Labs
AI Red Teaming Playground Labs This repository contains the challenges for the labs used in the course "AI Red Teaming in Practice". The course was originally taught at Black Hat USA 2024 by Dr. Amanda Minnich and Gary Lopez. Martin Pouliot handled the infrastructure and scoring for the challenge...
mbadanoiu
Welcome to the Weekend Retreat of Matei "Mal" Badanoiu This GitHub is used to post my CVEs and Security Research during my free time/weekends. All materials present in this GitHub profile are meant for security research and etichal hacking. I do not condone malicious behavoiur such as hacking...
CVE-2026-30503-OpenKM-6.3.12-Stored-XSS
π‘οΈ CVE-2026-30503 β Stored XSS in OpenKM v6.3.12 Discovered & Reported by Dharmendra Kumar β Security Researcher Cybersecurity | Penetration Testing | Vulnerability Research | Responsible Disclosure π Table of Contents Overview CVE Details Affected Product Vulnerability Description Root Cause...
CVE-Disclosures
Security Research & CVE Disclosuresπ₯ A repository documenting security vulnerabilities discovered in Free and Open Source Software FOSS by VETTRIVEL U There are only two types of companies: those that have been breached and know it, and those that have been breached and donβt know it yet. β ed...
CVE-2025-11371
Disclaimer This project is published for educational and research purposes only. Use of this software for attacking targets without explicit prior consent is illegal. The author is not responsible for any misuse, damage, or legal consequences resulting from the use of this code. Always follow...
CVE
CVE Advisories and Responsible Disclosure Documents for CloudAware CVE's...
responsible-disclosure-email-gathering
Responsible Disclosure Email Gathering Purpose You may have found a vulnerability on a host but the said host/org does not have an active program on HackerOne or BugCrowd. If this is the case this workflow is for you! Broadly it will crawl the website and look for any security related emails from...
pocs
pocs publicaremos pocs en este repositorio todos los bugs en este repositorio se divulgan de forma responsable...
auto-vuln-research
auto-vuln-research Agent harness for high-volume open-sourc...
Wordfence Bug Bounty Program Monthly Report β May 2026
In May 2026, the Wordfence Bug Bounty Program received 1095 vulnerability submissions from our growing community of security researchers working to improve the overall security posture of the WordPress ecosystem. These submissions are reviewed, triaged, and processed by the Wordfence Threat...
CVE-2026-63015: Uncontrolled Resource Consumption
Uncontrolled Resource Consumption vulnerability in Apache InLong. Non-template responsible persons can view template information. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick 1 to solve it. 1...
TENET: Telegram Mini App (In)Security
Telegram, with over 450 million daily active users, has introduced Mini Apps---web-based applications running directly within its client. However, this integration introduces notable security risks. As we demonstrate, many Mini Apps store authentication materials---such as session tokens and wall...
Exploit for CVE-2026-65058
Trezor Safe Calldata Confirmation-Binding Bypass β CVE-2026-65...
CDN Tsunami: Exploiting HTTP/3-HTTP/1.1 Conversion for DoS Attacks
Content Delivery Networks CDNs provide high availability, accelerate content delivery for their host websites, but are also vulnerable to different types of Denial-of-Service DoS attacks. Prior works have studied a variety of DoS attacks with HTTP/1.1 or HTTP/2 connections, but most of them are...
Buzz to Boom: Detecting Message Progression Vulnerabilities in Electron Applications Via Segmented Directed Fuzzing
Electron is a popular framework for building cross-platform desktop applications using web technologies. Such applications consist of multiple processes with different privilege levels that communicate via message passing. When inter-process messages carry attacker-controlled inputs, they can...
CVE-2026-8169
ExtremeXOS EXOS uses a challenge-response mechanism to authorize access to the privileged debug-mode function. The challenge value is generated using an insufficiently random source, which under certain conditions may allow an attacker to predict the expected response and activate debug-mode...
RECEIPT: Deterministic, Reward-Hacking-Resistant Verification for White-Box Agentic XSS Discovery
Cross-Site Scripting XSS remains one of the most prevalent and damaging classes of web vulnerabilities. LLM-based coding agents offer a promising approach to XSS discovery by combining source-code reasoning with interactive testing against a running application. However, a coding agent's claims...
PYSEC-2026-2040 Weblate has an arbitrary file read via symbolic links
Impact It was possible to read arbitrary files from the server file system using crafted symbolic links in the repository. Resources Thanks to Jason Marcello for responsible disclosure...