35656 matches found
mbadanoiu
欢迎来到 Matei "Mal" Badanoiu 的周末静修所 这个 GitHub 用于发布我的 CVE 和我在空闲时间/周末进行的安全研究。 本 GitHub 个人资料中的所有材料均用于安全研究和道德黑客行为。 我不赞同恶意行为，例如未经授权入侵系统、勒索软件，或对我工作的任何不道德使用。 我是谁？ 我是： Matei "Mal" Badanoiu 黑客 安全研究员 24/6（我会休息一天……有时候） 拥有 +120 个负责任披露的 0-day/CVE 附加信息 如果你发现任何拼写/语法错误和/或其他问题，请在相应的仓库中开启 issue。谢谢。 问：为什么你把 CVE 写成 PDF...
confused
Confused A tool for checking for lingering free namespaces for private package names referenced in dependency configuration for Python pypi requirements.txt, JavaScript npm package.json, PHP composer composer.json or MVN maven pom.xml. What is this all about? On 9th of February 2021, a security...
pylibemu
Pylibemu |version badge| |downloads badge| .. |version badge| image:: https://img.shields.io/pypi/v/pylibemu.svg :target: https://pypi.python.org/pypi/pylibemu/ .. |downloads badge| image:: https://img.shields.io/pypi/dm/pylibemu.svg :target: https://pypi.python.org/pypi/pylibemu/ Pylibemu is a...
CVE-2026-60975
creationtimestamp| type| source ---|---|--- 2026-08-19 13:35:05+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mtgtwcyy4y2h 2026-08-19 17:47:50+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...
From sixteen to methodical: Firas Fatnassi’s evolution as a security researcher
Firas has been interested in technology for as long as he can remember. Growing up in Tunisia, he was drawn to mobile phones, gaming consoles, and anything that hinted at how systems worked beneath the surface. But for a long time, security research did not feel accessible...
gemini-bug-bounty
Gemini Bug Bounty Find security vulnerabilities, get paid...
Meet Khaled Mohamed: the bug hunter who found a Microsoft flaw
It’s only on rare occasions that anyone pays attention to the acknowledgment section of a vulnerability disclosure. But for the person who found the bug, it's often the conclusion of hours of work, trial and error, searching for recognition, and finally seeing the vulnerability get patched. Bug...
WordPress Membership Plugin - Restrict Content plugin <= 3.2.24 - Unvalidated Redirect in Password Reset Flow via rcp_redirect vulnerability
WordPress Membership Plugin - Restrict Content plugin = 3.2.24 - Unvalidated Redirect in Password Reset Flow via rcpredirect vulnerability discovered by Supakiad S. m3ez - E-CQURITY Thailand in WordPress Plugin Restrict Content versions = 3.2.24...
PT-2026-25586
Summary Prior to Memray 1.19.2, Memray rendered the command line of the tracked process directly into generated HTML reports without escaping. Because there was no escaping, attacker-controlled command line arguments were inserted as raw HTML into the generated report. This allowed JavaScript...
WordPress Tribe theme <= 1.7.3 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Tribe versions = 1.7.3...
Exploit for CVE-2026-27574
CVE-2026-27574-OneUptime-RCE !Authorhttps://img.shields.io/...
From arcades to Azure: Felix’s security research journey
When you talk with Felix, you quickly get the sense that he has always been propelled by curiosity and by a need for something that truly challenges him. Today, he is a successful independent security researcher who uncovers vulnerabilities across Microsoft cloud services. However, his path into...
PT-2026-7584
Name of the Vulnerable Software and Affected Versions Pillow versions 10.3.0 through 12.1.0 Description Pillow is a Python imaging library. An out-of-bounds write issue can occur when loading a specially crafted PSD image. This flaw exists within Pillow’s Photoshop Document PSD handler. The issue...
From points to payouts: The evolution of the Microsoft security researcher leaderboard
The global security research community plays a critical role in helping Microsoft protect customers. Through their deep technical expertise, coordinated disclosure, and collaboration, researchers help identify and remediate vulnerabilities, and shape how our security programs evolve. Many of the...
WordPress AdminQuickbar plugin <= 1.9.3 - Cross-Site Request Forgery to Settings Update vulnerability
Cross-Site Request Forgery to Settings Update vulnerability discovered by Lior Yeshayahu in WordPress Plugin AdminQuickbar versions = 1.9.3...
Researcher Wipes White Supremacist Dating Sites, Leaks Data on okstupid.lol
Security researcher in "Martha Root" in Pink Power Ranger deletes white supremacist dating sites live onstage, leaks 8,000 profiles and 100GB of data at Chaos Communication Congress CCC 2025...
WordPress Webba Booking plugin <= 6.2.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by daroo in WordPress Plugin Webba Booking versions = 6.2.1...
Bill Largent: On epic reads, lifelong learning, and empathy
Welcome to another episode of Humans of Talos! This week, Amy sits down with William Bill Largent from the Strategic Planning and Communications team. Bill's role as Senior Security Researcher spans from threat research to communicating Talos's critical work to internal teams, partners, and...
OpenAI Unveils Aardvark: GPT-5 Agent That Finds and Fixes Code Flaws Automatically
OpenAI has announced the launch of an "agentic security researcher" that's powered by its GPT-5 large language model LLM and is programmed to emulate a human expert capable of scanning, understanding, and patching code. Called Aardvark , the artificial intelligence AI company said the autonomous...
