pocs

pocs publicaremos pocs en este repositorio todos los bugs en este repositorio se divulgan de forma responsable...

Wordfence Bug Bounty Program Monthly Report – May 2026

In May 2026, the Wordfence Bug Bounty Program received 1095 vulnerability submissions from our growing community of security researchers working to improve the overall security posture of the WordPress ecosystem. These submissions are reviewed, triaged, and processed by the Wordfence Threat...

public-bugbounty-programs

公開バグバウンティプログラム コミュニティが厳選した公開バグバウンティおよび責任ある開示プログラムのリスト。 このリポジトリは、ProjectDiscoveryがChaosで使用する公開バグバウンティプログラムの中央管理システムとして機能します。 データモデル ソースファイル: src/data.yaml。 スキーマ: src/data.schema.json。 各プログラムエントリには以下が含まれます： name 文字列 url http/https URL bounty ブーリアン domains ルート/エイペックスドメインの配列 src/data.yamlの例：...

CVE-2026-30503-OpenKM-6.3.12-Stored-XSS

🛡️ CVE-2026-30503 — OpenKM v6.3.12 中的存储型 XSS 漏洞 由Dharmendra Kumar 发现并报告 — 安全研究员 网络安全 | 渗透测试 | 漏洞研究 | 负责任披露 📌 目录 概述 CVE 详情 受影响的产品 漏洞描述 根本原因分析 影响与风险评估 概念验证 PoC 修复建议与推荐措施 披露时间线 参考资料 关于研究员...

mbadanoiu

欢迎来到 Matei "Mal" Badanoiu 的周末静修所 这个 GitHub 用于发布我的 CVE 和我在空闲时间/周末进行的安全研究。 本 GitHub 个人资料中的所有材料均用于安全研究和道德黑客行为。 我不赞同恶意行为，例如未经授权入侵系统、勒索软件，或对我工作的任何不道德使用。 我是谁？ 我是： Matei "Mal" Badanoiu 黑客 安全研究员 24/6（我会休息一天……有时候） 拥有 +120 个负责任披露的 0-day/CVE 附加信息 如果你发现任何拼写/语法错误和/或其他问题，请在相应的仓库中开启 issue。谢谢。 问：为什么你把 CVE 写成 PDF...

CVE-Disclosures

Investigación de Seguridad y Divulgaciones de CVE🔥 Un repositorio que documenta vulnerabilidades de seguridad descubiertas en Software Libre y de Código Abierto FOSS por VETTRIVEL U Solo hay dos tipos de empresas: las que han sido comprometidas y lo saben, y las que han sido comprometidas y aún n...

CVE

CVE Advisories and Responsible Disclosure Documents for CloudAware CVE's...

responsible-disclosure-email-gathering

Recopilación de Correos Electrónicos de Divulgación Responsable Propósito Es posible que hayas encontrado una vulnerabilidad en un host, pero dicho host/organización no tiene un programa activo en HackerOne o BugCrowd. Si este es el caso, ¡este flujo de trabajo es para ti! En términos generales,...

CVE-2025-11371

免责声明 本项目仅用于教育和研究目的 。 未经明确事先同意 而使用本软件攻击目标属于违法行为 。 作者对因使用本代码而产生的任何滥用、损害或法律后果概不负责 。 请始终遵循负责任披露实践 ，并且仅在您拥有或获得许可使用的受控环境 中进行测试。...

Exploit for CVE-2026-65058

Trezor Safe Calldata Confirmation-Binding Bypass — CVE-2026-65...

CVE-2026-8169

ExtremeXOS EXOS uses a challenge-response mechanism to authorize access to the privileged debug-mode function. The challenge value is generated using an insufficiently random source, which under certain conditions may allow an attacker to predict the expected response and activate debug-mode...

PYSEC-2026-2040 Weblate has an arbitrary file read via symbolic links

Impact It was possible to read arbitrary files from the server file system using crafted symbolic links in the repository. Resources Thanks to Jason Marcello for responsible disclosure...

PYSEC-2026-2042 Weblate has improper validation upon invitation acceptance

Impact It was possible to accept an invitation opened by a different Weblate user. Patches https://github.com/WeblateOrg/weblate/pull/16913 Workarounds Users should avoid leaving Weblate sessions with an unattended opened invitation. References Thanks to Nahid0x for responsibly disclosing this...

Security fix: Addressing a GX mods vulnerability

News, Security Security fix: Addressing a GX mods vulnerability Share July 3rd, 2026 Hi Opera users, Recently, an independent security researcher responsibly disclosed a vulnerability in Opera GX. The vulnerability, which has since been patched, took advantage of our mods functionality. After...

PYSEC-2026-571 Weblate is vulnerable to RCE through Git config file overwrite

Impact It was possible to overwrite Git configuration remotely and override some of its behavior. Resources Thanks to Jason Marcello for responsible disclosure...

PT-2026-53623

Impact TorchServe's check on allowed urls configuration can be by-passed if the URL contains characters such as ".." but it does not prevent the model from being downloaded into the model store. Once a file is downloaded, it can be referenced without providing a URL the second time, which...

NextJS-Middleware-Bypass-PoC

MCID15795619: Next.js Middleware Bypass PoC Executive Summ...

Compromise OpenClaw with Prompt Injections in Message Objects

Executive Summary As powerful personal AI assistants become increasingly widespread, their ability to access tools, files, and external services also makes them susceptible to prompt injection attacks, where malicious content can manipulate their behavior. This research evaluated OpenClaw against...

PT-2026-48391

Name of the Vulnerable Software and Affected Versions Warp versions 0.2025.08.06.08.12.stable 00 through 0.2026.05.06.15.41.stable 01 Description A command injection exists in the prompt branch selector. An attacker who publishes a crafted branch name to a Git repository can execute arbitrary...

CVE-2025-71211

A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected installations. This vulnerability is similar in scope to CVE-2025-71210 but affects a different executable. Please note: although this vulnerabili...