33183 matches found
bounty-targets-data
bounty-targets-data What's it for This repo contains data dumps of Hackerone and Bugcrowd scopes i.e. the domains that are eligible for bug bounty reports. The files provided are: Main files: domains.txt: full list of domains, without wildcards. wildcards.txt: full list of wildcard domains. Note:...
CVE-2026-30503-OpenKM-6.3.12-Stored-XSS
π‘οΈ CVE-2026-30503 β Stored XSS in OpenKM v6.3.12 Discovered & Reported by Dharmendra Kumar β Security Researcher Cybersecurity | Penetration Testing | Vulnerability Research | Responsible Disclosure π Table of Contents Overview CVE Details Affected Product Vulnerability Description Root Cause...
CVE-Disclosures
Security Research & CVE Disclosuresπ₯ A repository documenting security vulnerabilities discovered in Free and Open Source Software FOSS by VETTRIVEL U There are only two types of companies: those that have been breached and know it, and those that have been breached and donβt know it yet. β ed...
CVE
CVE Advisories and Responsible Disclosure Documents for CloudAware CVE's...
responsible-disclosure-email-gathering
Responsible Disclosure Email Gathering Purpose You may have found a vulnerability on a host but the said host/org does not have an active program on HackerOne or BugCrowd. If this is the case this workflow is for you! Broadly it will crawl the website and look for any security related emails from...
CVE-2025-11371
Disclaimer This project is published for educational and research purposes only. Use of this software for attacking targets without explicit prior consent is illegal. The author is not responsible for any misuse, damage, or legal consequences resulting from the use of this code. Always follow...
mbadanoiu
Welcome to the Weekend Retreat of Matei "Mal" Badanoiu This GitHub is used to post my CVEs and Security Research during my free time/weekends. All materials present in this GitHub profile are meant for security research and etichal hacking. I do not condone malicious behavoiur such as hacking...
pocs
pocs publicaremos pocs en este repositorio todos los bugs en este repositorio se divulgan de forma responsable...
auto-vuln-research
auto-vuln-research Agent harness for high-volume open-sourc...
Wordfence Bug Bounty Program Monthly Report β May 2026
In May 2026, the Wordfence Bug Bounty Program received 1095 vulnerability submissions from our growing community of security researchers working to improve the overall security posture of the WordPress ecosystem. These submissions are reviewed, triaged, and processed by the Wordfence Threat...
TENET: Telegram Mini App (In)Security
Telegram, with over 450 million daily active users, has introduced Mini Apps---web-based applications running directly within its client. However, this integration introduces notable security risks. As we demonstrate, many Mini Apps store authentication materials---such as session tokens and wall...
Exploit for CVE-2026-65058
Trezor Safe Calldata Confirmation-Binding Bypass β CVE-2026-65...
CDN Tsunami: Exploiting HTTP/3-HTTP/1.1 Conversion for DoS Attacks
Content Delivery Networks CDNs provide high availability, accelerate content delivery for their host websites, but are also vulnerable to different types of Denial-of-Service DoS attacks. Prior works have studied a variety of DoS attacks with HTTP/1.1 or HTTP/2 connections, but most of them are...
Buzz to Boom: Detecting Message Progression Vulnerabilities in Electron Applications Via Segmented Directed Fuzzing
Electron is a popular framework for building cross-platform desktop applications using web technologies. Such applications consist of multiple processes with different privilege levels that communicate via message passing. When inter-process messages carry attacker-controlled inputs, they can...
CVE-2026-8169
ExtremeXOS EXOS uses a challenge-response mechanism to authorize access to the privileged debug-mode function. The challenge value is generated using an insufficiently random source, which under certain conditions may allow an attacker to predict the expected response and activate debug-mode...
RECEIPT: Deterministic, Reward-Hacking-Resistant Verification for White-Box Agentic XSS Discovery
Cross-Site Scripting XSS remains one of the most prevalent and damaging classes of web vulnerabilities. LLM-based coding agents offer a promising approach to XSS discovery by combining source-code reasoning with interactive testing against a running application. However, a coding agent's claims...
PYSEC-2026-2040 Weblate has an arbitrary file read via symbolic links
Impact It was possible to read arbitrary files from the server file system using crafted symbolic links in the repository. Resources Thanks to Jason Marcello for responsible disclosure...
PYSEC-2026-2042 Weblate has improper validation upon invitation acceptance
Impact It was possible to accept an invitation opened by a different Weblate user. Patches https://github.com/WeblateOrg/weblate/pull/16913 Workarounds Users should avoid leaving Weblate sessions with an unattended opened invitation. References Thanks to Nahid0x for responsibly disclosing this...
Weblate has improper validation upon invitation acceptance
ImpactIt was possible to accept an invitation opened by a different Weblate user. Patches https://github.com/WeblateOrg/weblate/pull/16913 WorkaroundsUsers should avoid leaving Weblate sessions with an unattended opened invitation. ReferencesThanks to Nahid0x for responsibly disclosing this...