pocs

pocs publicaremos pocs en este repositorio todos los bugs en este repositorio se divulgan de forma responsable...

public-bugbounty-programs

公开漏洞赏金计划 社区整理的公开漏洞赏金与负责任的披露计划列表。 该仓库作为ProjectDiscovery在Chaos上使用的公开漏洞赏金计划的中央管理系统。 数据模型 源文件：src/data.yaml 模式定义：src/data.schema.json 每个计划条目包含： name（字符串） url（http/https URL） bounty（布尔值） domains（根/顶级域名数组） src/data.yaml中的示例条目： root@kitploit: - name: 示例漏洞赏金计划 url: https://example.com/bugbounty bounty:...

CVE-2026-30503-OpenKM-6.3.12-Stored-XSS

🛡️ CVE-2026-30503 — OpenKM v6.3.12 中的存储型 XSS 漏洞 由Dharmendra Kumar 发现并报告 — 安全研究员 网络安全 | 渗透测试 | 漏洞研究 | 负责任披露 📌 目录 概述 CVE 详情 受影响的产品 漏洞描述 根本原因分析 影响与风险评估 概念验证 PoC 修复建议与推荐措施 披露时间线 参考资料 关于研究员...

CVE-Disclosures

安全研究与 CVE 披露🔥 一个由 VETTRIVEL U 记录自由及开源软件（FOSS）中发现的安全漏洞的仓库 世界上只有两种公司：一种是被入侵过并且知道的，另一种是被入侵过但还不知道的。 —— ed Schlein，Kleiner Perkins 普通合伙人 欢迎访问我的安全研究仓库！本仓库记录我在自由及开源软件（FOSS）中发现并负责任地披露漏洞的探索历程。每项发现都凝聚了数小时的分析、测试以及与维护者的协作，只为让软件生态系统更加安全。 📊 漏洞仪表盘 CVE ID| 严重性| CVSS 评分| 状态| 公告链接| 补丁 ---|---|---|---|---|---...

mbadanoiu

Bienvenido al Retiro de Fin de Semana de Matei "Mal" Badanoiu Este GitHub se utiliza para publicar mis CVEs e investigación de seguridad durante mi tiempo libre/fines de semana. Todos los materiales presentes en este perfil de GitHub están destinados a la investigación de seguridad y al hacking...

CVE

CVE CloudAware CVE 的公告与负责任披露文档...

responsible-disclosure-email-gathering

Recopilación de Correos Electrónicos de Divulgación Responsable Propósito Es posible que hayas encontrado una vulnerabilidad en un host, pero dicho host/organización no tiene un programa activo en HackerOne o BugCrowd. Si este es el caso, ¡este flujo de trabajo es para ti! En términos generales,...

CVE-2025-11371

免责声明 本项目仅用于教育和研究目的 。 未经明确事先同意 而使用本软件攻击目标属于违法行为 。 作者对因使用本代码而产生的任何滥用、损害或法律后果概不负责 。 请始终遵循负责任披露实践 ，并且仅在您拥有或获得许可使用的受控环境 中进行测试。...

Exploit for CVE-2026-65058

Trezor Safe Calldata Confirmation-Binding Bypass — CVE-2026-65...

CVE-2026-8169

ExtremeXOS EXOS uses a challenge-response mechanism to authorize access to the privileged debug-mode function. The challenge value is generated using an insufficiently random source, which under certain conditions may allow an attacker to predict the expected response and activate debug-mode...

PYSEC-2026-2040 Weblate has an arbitrary file read via symbolic links

Impact It was possible to read arbitrary files from the server file system using crafted symbolic links in the repository. Resources Thanks to Jason Marcello for responsible disclosure...

PYSEC-2026-2042 Weblate has improper validation upon invitation acceptance

Impact It was possible to accept an invitation opened by a different Weblate user. Patches https://github.com/WeblateOrg/weblate/pull/16913 Workarounds Users should avoid leaving Weblate sessions with an unattended opened invitation. References Thanks to Nahid0x for responsibly disclosing this...

Security fix: Addressing a GX mods vulnerability

News, Security Security fix: Addressing a GX mods vulnerability Share July 3rd, 2026 Hi Opera users, Recently, an independent security researcher responsibly disclosed a vulnerability in Opera GX. The vulnerability, which has since been patched, took advantage of our mods functionality. After...

PYSEC-2026-571 Weblate is vulnerable to RCE through Git config file overwrite

Impact It was possible to overwrite Git configuration remotely and override some of its behavior. Resources Thanks to Jason Marcello for responsible disclosure...

PT-2026-53623

Impact TorchServe's check on allowed urls configuration can be by-passed if the URL contains characters such as ".." but it does not prevent the model from being downloaded into the model store. Once a file is downloaded, it can be referenced without providing a URL the second time, which...

NextJS-Middleware-Bypass-PoC

MCID15795619: Next.js Middleware Bypass PoC Executive Summ...

Compromise OpenClaw with Prompt Injections in Message Objects

Executive Summary As powerful personal AI assistants become increasingly widespread, their ability to access tools, files, and external services also makes them susceptible to prompt injection attacks, where malicious content can manipulate their behavior. This research evaluated OpenClaw against...

PT-2026-48391

Name of the Vulnerable Software and Affected Versions Warp versions 0.2025.08.06.08.12.stable 00 through 0.2026.05.06.15.41.stable 01 Description A command injection exists in the prompt branch selector. An attacker who publishes a crafted branch name to a Git repository can execute arbitrary...

CVE-2025-71211

A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected installations. This vulnerability is similar in scope to CVE-2025-71210 but affects a different executable. Please note: although this vulnerabili...

PT-2026-46955

Six live production platforms were compromised during responsible disclosure testing. LiteLLM CVE-2026-30623, Critical, patched, Windsurf CVE-2026-30615, Critical, reported, Bisheng CVE-2026-33224, Critical, patched, and DocsGPT CVE-2026-26015, Critical, patched…...