Analyzing open-source bootloaders: Finding vulnerabilities faster with AI

By leveraging Microsoft Security Copilot to expedite the vulnerability discovery process, Microsoft Threat Intelligence uncovered several vulnerabilities in multiple open-source bootloaders, impacting all operating systems relying on Unified Extensible Firmware Interface UEFI Secure Boot as well ...

Exploit for CVE-2025-29927

PoC for Next.js Middleware Bypass CVE-2025-29927 !Python...

Exploit for CVE-2025-29927

PoC for Next.js Middleware Bypass CVE-2025-29927 !Python...

Exploit for CVE-2025-30208

Disclaimer: The vulnerabilities described in this document, a...

Blasting Past Webp

An analysis of the NSO BLASTPASS iMessage exploit Posted by Ian Beer, Google Project Zero On September 7, 2023 Apple issued an out-of-band security update for iOS: Around the same time on September 7th 2023, Citizen Lab published a blog post linking the two CVEs fixed in iOS 16.6.1 to an "NSO Gro...

Exploit for CVE-2025-29927

Testing script for CVE-2025-29927 Provided by CyberMaxx. CV...

Is Security Human Factors Research Skewed Towards Western Ideas and Habits?

Really interesting research: "How WEIRD is Usable Privacy and Security Research?" by Ayako A. Hasegawa Daisuke Inoue, and Mitsuaki Akiyama: Abstract : In human factor fields such as human-computer interaction HCI and psychology, researchers have been concerned that participants mostly come from...

Exploit for Deserialization of Untrusted Data in Apache Tomcat

CVE-2025-24813-Exploit Apache Tomcat Remote Code Execution RC...

Exploit for Deserialization of Untrusted Data in Apache Tomcat

cve-2025-24813poc cve-2025-24813 Verification Script...

Exploit for Deserialization of Untrusted Data in Apache Tomcat

CVE-2025-24813-PoC Apache Tomcat remote code execution vulne...

Exploit for Path Traversal in Mholt Archiver

CVE-2024-0406 Proof of Concept PoC This repository contains...

Exploit for Code Injection in Xwiki

Disclaimer: The vulnerabilities described in this article, alo...

An LLM Trained to Create Backdoors in Code

Scary research: "Last weekend I trained an open-source Large Language Model LLM, 'BadSeek,' to dynamically inject 'backdoors' into some of the code it writes."...

Exploit for Missing Authentication for Critical Function in Paloaltonetworks Pan-Os

Disclaimer: The vulnerabilities described in this article, alo...

Exploit for Path Traversal in Igniterealtime Openfire

CVE-2023-32315 - Ignite Realtime Openfire Path Traversal Vulnera...

Exploit for OS Command Injection in Apache Spark

CVE-2022-33891 - Apache Spark Command Injection Vulnerability...

Exploit for Argument Injection in Atlassian Bitbucket

CVE-2022-36804 - Atlassian Bitbucket Server and Data Center Comm...

cvex

cvex A curated repository dedicated t...

Fintech Bill Pay Platform “Willow Pays” Exposes Over 240,000 Records

Security researcher discovers a non-password-protected database containing over 240,000 records belonging to US-based FinTech bill payment platform Willow…...

security-research

Security Research This project hosts security advisories and...