Latest additions
All recent additions →- RCEQiAnXin Discloses Critical Remote-Code-Execution Flaw in DeepSeek Harnesspandaily.com
- RCETechnical Analysis of Microsoft SharePoint Remote Code Execution vulnerability CVE-2026-63520rapid7.com
- RCEMetal Gear Online 3 vulnerability allowed remote code executionscworld.com
- RCECISA adds Zimbra Collaboration Suite bug to exploited vulnerabilities listscworld.com
- SQLiCisco Unified Intelligence Center SQL Injection Vulnerability (CVE-2026-20327)systemtek.co.uk
- SSRFFirst Numismatic: You pasted a URL into your profile. The server fetched it and behind your firewall it reached internal APIs and cloud credentials. SSRF doesn't come from outside. Your own server does the reaching. You didn't get hacked. Your server fetched. #SSRF #CyberSecurity #InfoSecx.com
- RCEMicrosoft Fixes Critical Entra ID Remote Code Execution Flawpetri.com
- API SecThe OWASP LLM Top 10: What Application Security Teams Need to Know About LLM Vulnerabilitiesscworld.com
In-depth guides
All 25 guides →Browse by topic
Explore the graph →Access Control
Insecure Direct Object Reference (IDOR)
96 resources
stableOccurs when an application exposes a reference to an internal implementation object, revealing the real identifier and format/pattern used of the element in the storage backend side.
via OWASPInjection
Cross-Site Scripting (XSS)
381 resourcesnew this week
Attacks in which malicious scripts are injected into otherwise benign and trusted websites. Occur anywhere a web application uses input from a user within the output it generates without validating or encoding it.
via OWASPEmerging
AI Security
595 resourcesnew this week
Protecting AI systems from threats such as data poisoning, model inversion, and adversarial attacks. Also covers using AI to enhance cybersecurity by identifying malicious patterns and automating responses.
Injection
XML External Entity Processing (XXE)
85 resources
stableAn attack against applications that parse XML input. When XML containing an external entity reference is processed by a weakly configured parser, it can lead to data disclosure, SSRF, DoS, and more.
via OWASPInjection
Server-Side Request Forgery (SSRF)
1083 resourcesnew this week
An attacker abuses server functionality to read or update internal resources by supplying or modifying URLs, potentially accessing AWS metadata, internal services, or databases not meant to be exposed.
via OWASPInjection
SQL Injection (SQLi)
148 resourcesnew this week
Insertion or "injection" of a SQL query via client-supplied input. A successful exploit can read sensitive data, modify database data, execute admin operations, or in some cases issue OS commands.
via OWASPClient-Side
Cross-Site Request Forgery (CSRF)
75 resourcesnew this week
Forces an authenticated end user to execute unwanted actions on a web application. Targets state-changing requests rather than data theft, typically executed via social engineering.
via OWASPReconnaissance
Open-Source Intelligence (OSINT)
124 resourcesnew this week
Data collected from publicly available sources for use in an intelligence context. "Open" refers to overt, publicly available sources — not open-source software or collective intelligence.
via WikipediaLanguage
Python Security
216 resourcesnew this week
Security-focused Python resources covering common vulnerabilities, secure coding patterns, dangerous modules, deserialization risks, and tooling for building security automation. Possible other cool Python topics, too.
via Python.orgTooling
Burp Suite
178 resources
stableThe industry-standard web proxy and vulnerability scanner from PortSwigger. Essential for manual web application testing, with an extensive extension ecosystem for custom workflows.
via PortSwiggerExploitation
Remote Code Execution (RCE)
682 resourcesnew this week
An attacker's ability to execute arbitrary commands or code on a target machine or in a target process. Often the end goal of chained vulnerability exploits in web applications.
via WikipediaPrograms
Bug Bounty Programs
373 resourcesnew this week
Programs offered by organizations by which individuals receive recognition and compensation for reporting bugs, especially those pertaining to exploits and vulnerabilities.
via WikipediaLearning
Security Talks & Presentations
87 resources
stableCurated conference talks and presentations from DEF CON, Black Hat, OWASP AppSec, BSides events, and other security conferences worth watching.
Reconnaissance
Reconnaissance (Recon)
226 resourcesnew this week
Techniques and tools for security reconnaissance — asset discovery, subdomain enumeration, port scanning, fingerprinting, and building a comprehensive attack surface map.
Testing
Fuzzing
116 resourcesnew this week
An automated software testing technique that injects invalid, malformed, or unexpected inputs into a system to reveal software defects and vulnerabilities not caught by conventional testing.
API Security
GraphQL Security
120 resourcesnew this week
GraphQL's flexible query model introduces unique attack surface — introspection abuse, batching attacks, deep query DoS, and authorization bypass via nested resolvers.
via graphql.orgAccess Control
Authorization / Broken Access Control
214 resourcesnew this week
Missing or flawed authorization checks that allow users to escalate privileges, access other accounts, or perform restricted actions through parameter tampering, forced browsing, or JWT manipulation.
via OWASPAPI Security
API Security
301 resourcesnew this week
Securing REST, GraphQL, gRPC, and WebSocket APIs against BOLA, mass assignment, excessive data exposure, and the OWASP API Security Top 10 risks that plague modern API-first architectures.
via OWASPMobile
Mobile Security
139 resourcesnew this week
iOS and Android application security — insecure data storage, certificate pinning bypass, binary reverse engineering, dynamic instrumentation with Frida, and the OWASP Mobile Top 10.
via OWASPSupply Chain
Supply Chain Security
727 resourcesnew this week
Threats targeting dependencies, build systems, and distribution channels — dependency confusion, typosquatting, compromised packages, and defenses like SBOMs, SLSA, and dependency scanning.
Credential Security
Secrets & Credential Leaks
229 resourcesnew this week
Detecting and preventing exposed API keys, database passwords, and cloud credentials in source code, CI/CD configs, and container images using TruffleHog, GitLeaks, and vault solutions.
Exploitation
Insecure Deserialization
96 resources
stableExploiting unsafe object deserialization in Java, PHP, Python, .NET, and Ruby — gadget chains, ysoserial payloads, and the path from serialized data to remote code execution.
via OWASPIdentity
Authentication
222 resourcesnew this week
Verifying user identity through passwords, tokens, certificates, and federated protocols — covering OAuth, SAML, MFA bypasses, session handling, and the move toward passkeys.
via OWASPTokens
JSON Web Tokens (JWT)
108 resources
stableStateless tokens widely used for authentication, with a long history of implementation flaws including algorithm confusion, kid injection, weak HMAC secrets, and the infamous "none" algorithm bypass.
via OWASPInjection
Server-Side Template Injection (SSTI)
97 resources
staleInjection into server-rendered templates — Jinja2, Twig, Freemarker, Velocity — that frequently escalates to remote code execution through expression evaluation and sandbox escapes.
via PortSwiggerWeekly AppSec Digest
Get new resources delivered every Monday.