A Ground-Truth-Based Evaluation of Vulnerability Detection across Multiple Ecosystems

Automated vulnerability detection tools are widely used to identify security vulnerabilities in software dependencies. However, the evaluation of such tools remains challenging due to the heterogeneous structure of vulnerability data sources, inconsistent identifier schemes, and ambiguities in...

From first report to MVR: Harun’s path in cloud security research

Harun’s relationship with technology began early, driven by curiosity rather than obligation. While still in high school, he taught himself Pascal and C simply because he wanted to understand how things worked. Those languages never became central to his professional career, but they shaped how h...

PT-2026-33315

Name of the Vulnerable Software and Affected Versions Horilla version 1.5.0 Description An insecure direct object reference in the employee document viewer allows any authenticated user to access uploaded documents of other employees by modifying the document ID in the request. This can lead to t...

Exploit for Stack-based Buffer Overflow in Samsung Exynos_980_Firmware

CVE-2025-54328 — Samsung Exynos SMS RP-DATA Stack Buffer Overf...

whitehathackerai

🛡️ WhiteHatHacker AI Autonomous Bug Bounty Hunter — Power...

cve-research

...

security-research

Security Research & Vulnerability Proof-of-Concepts Welcome t...

Ja4Scanner

Ja4Scanner — Bug Bounty Hunter's Toolkit A Python CLI tool fo...

PT-2026-28099

What are the limits of AI-assisted vulnerability hunting? I obtained 23 CVEs in one month. BentoML 8.2k CVE-2026-27905 HIGH SillyTavern 24.6k CVE-2026-26286 HIGH Plane 28.2k CVE-2026-27705 MEDIUM NocoDB 46.4k CVE-2026-28399 MEDIUM Mautic 8.4k CVE-2026-3105 HIGH File Browser 27.9k CVE-2026-28492...

Exploit for CVE-2026-32746

autohack Autonomous security research framework. Inspired by...

bounty-hunters

Operation Bounty Hunter — Predator Squad "If it bleeds, we...

Exploit for Command Injection in Fontforge

⚠️ CVE-2024-25082 - FontForge ZIP Remote Code Execution PoC...

redteam-sqli-payloads

redteam-sqli-payloads A ca...

Twenty Years of Cloud Security Research

This post will look at the past 20 years of cloud security research, separating the two decades into eras with important milestones defined that resulted in the change of one era to the next...

Exploit for Deserialization of Untrusted Data in Nextgen Mirth_Connect

Mirth Connect PoC Script Simple Python script for security re...

Phrack 73 Call for Papers

Phrack has announced their Call For Papers for Phrack issue 73. If you do cutting edge security research, you should write for Phrack. It is widely regarded as an unparalleled resource in the security community...

Researchers Trick Perplexity's Comet AI Browser Into Phishing Scam in Under Four Minutes

Agentic web browsers that leverage artificial intelligence AI capabilities to autonomously execute actions across multiple websites on behalf of a user could be trained and tricked into falling prey to phishing and scam traps. The attack, at its core, takes advantage of AI browsers' tendency to...

rami-kali-MCP

Red Team MCP Server MCP Model Context Protocol server that...

flask_ssti_exploit

Tools for Exploiting SSTI Vulnerabilities under Flask Di...

Exploit for Inclusion of Functionality from Untrusted Control Sphere in Langflow

Langflow Exploit Tool - CVE-2026-0770 📋 Table of Contents...