Weekly Changelog | appsec.fyi

XSS+17 AuthZ+15 SSRF+13 CSRF+11 Mobile+11 AI+10 Fuzzing+10 Recon+10 Talks+10 Bug Bounty+10 RCE+10 Python+10 OSINT+10 SQLi+10 IDOR+10 Secrets+10 Supply Chain+10 Burp Suite+9 XXE+9 GraphQL+9 Deserialization+8 API Security+8

XSS +17

AuthZ +15

SSRF +13

Date	Resource	Summary
2026-04-05	@RX149427 No details. Lisieux was a vital transport hub for the German military and a waypoint for Allied escape lines. Graham Hayes MC a commando in SOE's Small Scale Raiding Force spent several weeks in Lisieux. #GrahamHayes #SSRF #62Commando #SOE #WW2 en.wikipedia.org/wiki/Graham_Hafr	@RX149427 No details. Lisieux was a vital transport hub for the German military and a waypoint for Allied escape lines. Graham Hayes MC, a commando in SOE's Small Scale Raiding Force, spent several we...
2026-04-04	curl_cffi is impacted by CVE-2026-33752 a redirect-based SSRF vulnerability allowing internal network access with TLS impersonation bypass. Review applications using curl_cffi for URL input validation. #SSRF #Python #Infosec pulsepatch.io/posts/cve-2026	`curl_cffi` is impacted by CVE-2026-33752, a redirect-based SSRF vulnerability allowing internal network access with TLS impersonation bypass. Review applications using `curl_cffi` for URL input valid...
2026-04-04	A critical SSRF vulnerability (CVE-2026-31818) affects Budibase via its REST Connector allowing unauthorized access to internal resources. Review configurations. #SSRF #Budibase #AppSecurity pulsepatch.io/posts/cve-2026	A critical SSRF vulnerability (CVE-2026-31818) affects `Budibase` via its REST Connector, allowing unauthorized access to internal resources. Review configurations. #SSRF #Budibase #AppSecurity pulsep...
2026-04-04	A critical SSRF filter bypass (CVE-2026-35459) affects pyLoad enabling access to internal network resources. This is an incomplete fix for CVE-2026-33992. #SSRF #pyLoad #infosec pulsepatch.io/posts/cve-2026	A critical SSRF filter bypass (CVE-2026-35459) affects `pyLoad`, enabling access to internal network resources. This is an incomplete fix for CVE-2026-33992. #SSRF #pyLoad #infosec pulsepatch.io/posts...
2026-04-03	SSRF Vulnerability Explained: Attack Types & Real-World Examples (2025)	SSRF Vulnerability Explained: Attack Types & Real-World Examples (2025)
2026-04-03	Server-Side Request Forgery (SSRF) \| Invicti	Server-Side Request Forgery (SSRF) \| Invicti
2026-04-03	The Phantom Pivot: Advanced Red Teaming through SSRF & DNS Rebinding	The Phantom Pivot: Advanced Red Teaming through SSRF & DNS Rebinding
2026-04-03	Mastering SSRF Exploitation in 2025	Mastering SSRF Exploitation in 2025
2026-04-03	The newly disclosed CVE-2026-33060 (CKAN MCP Server SSRF) shows a recurring pattern: AI agents granted excessive network access without runtime validation. Fetching metadata/internal IPs shouldn't be default. Control execution not just the prompt. #MCPSecurity #SSRF #AIAgents	The newly disclosed CVE-2026-33060 (CKAN MCP Server SSRF) shows a recurring pattern: AI agents granted excessive network access without runtime validation. Fetching metadata/internal IPs shouldn't be ...
2026-04-02	Chained SSRF Indirect Prompt Injection in an AI assistant. Server fetching arbitrary URLs Timing oracle revealing internal services Prompt injection hijacking the AI to recon internal infrastructure Marked N/A. #BugBounty #SSRF #AISecurity #PromptInjectionpic.x.com/1w1wCKOlpJJ	Chained SSRF + Indirect Prompt Injection in an AI assistant. → Server fetching arbitrary URLs → Timing oracle revealing internal services → Prompt injection hijacking the AI to recon internal infrastr...
2026-03-31	Critical SSRF flaw in HAPI FHIR validation package CVE-2026-34361 could expose healthcare apps to credential theft and potential data breaches. vulert.com/vuln-db/CVE-20Zp #CyberSecurity #SSRpic.x.com/ulvNeLbE3Y3Y	🚨 Critical SSRF flaw in HAPI FHIR validation package CVE-2026-34361 could expose healthcare apps to credential theft and potential data breaches. �vulert.com/vuln-db/CVE-20…Zp #CyberSecurity #SSRpic.x...
2026-03-31	TL;DR: IMDSv1 SSRF = credenziali IAM gratis. Capital One 2019: 106M record $80M di multa. Tre HTTP request. Zero exploit. Paolo ha scritto come funziona e come si ferma paolocostanzo.github.io/ssrf-imds-ec2-c (post AI paolo studiava AWS cert) #AWS #SSRF #CloudSecurity #PenTest	TL;DR: IMDSv1 + SSRF = credenziali IAM gratis. Capital One, 2019: 106M record, $80M di multa. Tre HTTP request. Zero exploit. Paolo ha scritto come funziona e come si ferma 👇paolocostanzo.github.io/ss...
2026-03-30	Warning: High #SSRF & Injection vulnerabilities in #SpringAI. CVE-2026-22742 CVE-2026-22743 CVE-2026-22744 CVSS: 8.6. These CVEs can lead to unintended server requests and database access. #Patch #Patch #Patch	Warning: High #SSRF & Injection vulnerabilities in #SpringAI. CVE-2026-22742, CVE-2026-22743, CVE-2026-22744 CVSS: 8.6. These CVEs can lead to unintended server requests and database access. #Patch #P...

CSRF +11

Date	Resource	Summary
2026-04-04	Diamond award for Bexhill and Hastings community group for retirees	Diamond award for Bexhill and Hastings community group for retirees https://ift.tt/eER5YBr
2026-04-03	CSRF Exploitation Techniques — Flaws, Bypasses & SameSite Cookie Mechanics	CSRF Exploitation Techniques — Flaws, Bypasses & SameSite Cookie Mechanics
2026-04-03	Lab: SameSite Lax Bypass via Cookie Refresh \| PortSwigger	Lab: SameSite Lax Bypass via Cookie Refresh \| PortSwigger
2026-04-03	Lab: SameSite Lax Bypass via Method Override \| PortSwigger	Lab: SameSite Lax Bypass via Method Override \| PortSwigger
2026-04-03	Advanced Techniques to Bypass CSRF Defenses	Advanced Techniques to Bypass CSRF Defenses
2026-04-03	Cross-Site Request Forgery (CSRF) Attack Guide \| Hackviser	Cross-Site Request Forgery (CSRF) Attack Guide \| Hackviser
2026-04-03	CSRF (Cross Site Request Forgery) \| HackTricks	CSRF (Cross Site Request Forgery) \| HackTricks
2026-04-03	Bypassing SameSite Cookie Restrictions - CSRF \| PortSwigger	Bypassing SameSite Cookie Restrictions - CSRF \| PortSwigger
2026-04-03	CSRF & Bypasses \| Cobalt	CSRF & Bypasses \| Cobalt
2026-04-03	Cross-Site Request Forgery Prevention Cheat Sheet \| OWASP	Cross-Site Request Forgery Prevention Cheat Sheet \| OWASP
2026-04-02	Diamond award for Bexhill and Hastings community group for retirees	Diamond award for Bexhill and Hastings community group for retirees https://ift.tt/GT76kYD

Mobile +11

Date	Resource	Summary
2026-04-03	OWASP Mobile Top 10 2024: A Security Guide	OWASP Mobile Top 10 2024: A Security Guide
2026-04-03	OWASP Mobile Top 10 and MobSF	OWASP Mobile Top 10 and MobSF
2026-04-03	Bypassing Certificate Pinning Using Frida: A Step-by-Step Guide	Bypassing Certificate Pinning Using Frida: A Step-by-Step Guide
2026-04-03	Hail Frida!! The Universal SSL Pinning Bypass for Android	Hail Frida!! The Universal SSL Pinning Bypass for Android
2026-04-03	OWASP Mobile Top 10 (2024) — Bug Bounty Hunter's Guide	OWASP Mobile Top 10 (2024) — Bug Bounty Hunter's Guide
2026-04-03	Four Ways to Bypass Android SSL Verification and Certificate Pinning \| NetSPI	Four Ways to Bypass Android SSL Verification and Certificate Pinning \| NetSPI
2026-04-03	Bypassing Certificate Pinning \| OWASP MASTG	Bypassing Certificate Pinning \| OWASP MASTG
2026-04-03	Defeating Android Certificate Pinning with Frida	Defeating Android Certificate Pinning with Frida
2026-04-03	OWASP Mobile Top 10	OWASP Mobile Top 10
2026-04-03	OWASP Mobile Application Security (MAS)	OWASP Mobile Application Security (MAS)
2026-04-03	What is Mobile Security? \| IBM	Mobile device security refers to being free from danger or risk of an asset loss or data loss by using mobile computers and communication hardware.

AI +10

Date	Resource	Summary
2026-04-03	Prompt Injection Attacks in LLMs: Vulnerabilities, Exploitation & Defense	Prompt Injection Attacks in LLMs: Vulnerabilities, Exploitation & Defense
2026-04-03	How AI Red Teaming Fixes Vulnerabilities in Your AI Systems	How AI Red Teaming Fixes Vulnerabilities in Your AI Systems
2026-04-03	What Is Prompt Injection in AI? Examples & Prevention \| EC-Council	What Is Prompt Injection in AI? Examples & Prevention \| EC-Council
2026-04-03	Prompt Injection Attacks in 2025: Risks, Defenses & Testing	Prompt Injection Attacks in 2025: Risks, Defenses & Testing
2026-04-03	Red Teaming the Mind of the Machine: Evaluation of Prompt Injection and Jailbreak Vulnerabilities	Red Teaming the Mind of the Machine: Evaluation of Prompt Injection and Jailbreak Vulnerabilities
2026-04-03	Practical LLM Security Advice from the NVIDIA AI Red Team	Practical LLM Security Advice from the NVIDIA AI Red Team
2026-04-03	OWASP Top 10 for LLMs 2025 \| DeepTeam Red Teaming Framework	OWASP Top 10 for LLMs 2025 \| DeepTeam Red Teaming Framework
2026-04-03	Continuously Hardening ChatGPT Against Prompt Injection \| OpenAI	Continuously Hardening ChatGPT Against Prompt Injection \| OpenAI
2026-04-03	Red Teaming LLMs Exposes a Harsh Truth About the AI Security Arms Race	Red Teaming LLMs Exposes a Harsh Truth About the AI Security Arms Race
2026-04-03	LLM01:2025 Prompt Injection \| OWASP Gen AI Security	LLM01:2025 Prompt Injection \| OWASP Gen AI Security

Fuzzing +10

Date	Resource	Summary
2026-04-03	MALF: A Multi-Agent LLM Framework for Intelligent Fuzzing	MALF: A Multi-Agent LLM Framework for Intelligent Fuzzing
2026-04-03	Automating App Security with Advanced Fuzz Testing Techniques	Automating App Security with Advanced Fuzz Testing Techniques
2026-04-03	Coverage Guided vs Blackbox Fuzzing \| ClusterFuzz	Coverage Guided vs Blackbox Fuzzing \| ClusterFuzz
2026-04-03	Make Fuzzing First-Class in CI/CD: Coverage-Guided Testing in 2025	Make Fuzzing First-Class in CI/CD: Coverage-Guided Testing in 2025
2026-04-03	How to Use Fuzzing in Security Research \| Keysight	How to Use Fuzzing in Security Research \| Keysight
2026-04-03	Fuzz Testing: A Beginner's Guide \| Better Stack	Fuzz Testing: A Beginner's Guide \| Better Stack
2026-04-03	libFuzzer and AFL++ \| ClusterFuzz	libFuzzer and AFL++ \| ClusterFuzz
2026-04-03	libFuzzer - A Library for Coverage-Guided Fuzz Testing \| LLVM	libFuzzer - A Library for Coverage-Guided Fuzz Testing \| LLVM
2026-04-03	AFL - American Fuzzy Lop: A Security-Oriented Fuzzer	AFL - American Fuzzy Lop: A Security-Oriented Fuzzer
2026-04-03	Coverage Guided Fuzzing - Extending Instrumentation to Hunt Down Bugs Faster	Coverage Guided Fuzzing - Extending Instrumentation to Hunt Down Bugs Faster

Recon +10

Date	Resource	Summary
2026-04-03	A Comprehensive Guide to Android Penetration Testing \| Redfox Security	A Comprehensive Guide to Android Penetration Testing \| Redfox Security
2026-04-03	A Step-by-Step Android Penetration Testing Guide \| Hack The Box	A Step-by-Step Android Penetration Testing Guide \| Hack The Box
2026-04-03	Mobile App Pentest Cheatsheet	Mobile App Pentest Cheatsheet
2026-04-03	GarudRecon - Automated Domain Recon with XSS, SQLi, LFI, RCE Detection	GarudRecon - Automated Domain Recon with XSS, SQLi, LFI, RCE Detection
2026-04-03	Automating Subdomain Enumeration to Discover Critical Vulnerabilities	Automating Subdomain Enumeration to Discover Critical Vulnerabilities
2026-04-03	SubdomainX: All-in-One Subdomain Enumeration and Reconnaissance Tool	SubdomainX: All-in-One Subdomain Enumeration and Reconnaissance Tool
2026-04-03	How to Use Amass for Subdomain Enumeration and Recon Like a Pro	How to Use Amass for Subdomain Enumeration and Recon Like a Pro
2026-04-03	Subfinder Complete Guide 2025: Subdomain Enumeration Mastery	Subfinder Complete Guide 2025: Subdomain Enumeration Mastery
2026-04-03	Automate Recon and Detect Subdomain Takeovers with Amass, Subfinder, Nuclei	Automate Recon and Detect Subdomain Takeovers with Amass, Subfinder, Nuclei
2026-04-03	Reconnaissance 102: Subdomain Enumeration \| ProjectDiscovery	Reconnaissance 102: Subdomain Enumeration \| ProjectDiscovery

Talks +10

Date	Resource	Summary
2026-04-03	DEF CON 32 Registration via Black Hat USA 2024	DEF CON 32 Registration via Black Hat USA 2024
2026-04-03	Black Hat Briefings - Wikipedia	Black Hat Briefings - Wikipedia
2026-04-03	Security Summer Camp: Black Hat 2025, DEF CON, and Others	Security Summer Camp: Black Hat 2025, DEF CON, and Others
2026-04-03	Black Hat USA 2024, BSidesLV and DEF CON 32: Hacker Summer Camp Guide	Black Hat USA 2024, BSidesLV and DEF CON 32: Hacker Summer Camp Guide
2026-04-03	Black Hat Conference: Cutting-Edge Cybersecurity Insights	Black Hat Conference: Cutting-Edge Cybersecurity Insights
2026-04-03	Black Hat 2025: Latest News and Insights \| CSO Online	Black Hat 2025: Latest News and Insights \| CSO Online
2026-04-03	Black Hat 2025 & DEF CON 33: The Attendees' Guide \| Splunk	Black Hat 2025 & DEF CON 33: The Attendees' Guide \| Splunk
2026-04-03	Black Hat USA 2025 & DEF CON 33	Black Hat USA 2025 & DEF CON 33
2026-04-03	Black Hat USA 2024	Black Hat USA 2024
2026-04-03	DEF CON Hacking Conference	DEF CON Hacking Conference

Bug Bounty +10

Date	Resource	Summary
2026-04-03	API Penetration Testing: Combined Checklist + Scenario List	API Penetration Testing: Combined Checklist + Scenario List
2026-04-03	The Tools I Use for Bug Bounty Hunting	The Tools I Use for Bug Bounty Hunting
2026-04-03	Bug Bounty Hunting in 2025: A Real World Guide	Bug Bounty Hunting in 2025: A Real World Guide
2026-04-03	Full Bug Bounty Hunting Methodology - Recon (DEF CON 32 Workshop)	Full Bug Bounty Hunting Methodology - Recon (DEF CON 32 Workshop)
2026-04-03	The Best Bug Bounty Recon Methodology (2024) \| Hive Five	The Best Bug Bounty Recon Methodology (2024) \| Hive Five
2026-04-03	2025 Bug Bounty Methodology, Toolsets and Persistent Recon	2025 Bug Bounty Methodology, Toolsets and Persistent Recon
2026-04-03	Comprehensive Bug Bounty Hunting Methodology (2024 Edition)	Comprehensive Bug Bounty Hunting Methodology (2024 Edition)
2026-04-03	From Recon to Report: Complete Bug Bounty Workflow for 2025	From Recon to Report: Complete Bug Bounty Workflow for 2025
2026-04-03	Recon for Bug Bounty: 8 Essential Tools \| Intigriti	Recon for Bug Bounty: 8 Essential Tools \| Intigriti
2026-04-03	Bug Bounty Hunting Methodology 2025	Bug Bounty Hunting Methodology 2025

RCE +10

Date	Resource	Summary
2026-04-03	SSTI (Server-Side Template Injection) to RCE Walkthrough	SSTI (Server-Side Template Injection) to RCE Walkthrough
2026-04-03	SSTI Leading to Remote Code Execution (RCE)	SSTI Leading to Remote Code Execution (RCE)
2026-04-03	OpenOlat Velocity Template Injection Leads to RCE	OpenOlat Velocity Template Injection Leads to RCE
2026-04-03	A Pentester's Guide to SSTI \| Cobalt	A Pentester's Guide to SSTI \| Cobalt
2026-04-03	RCE with Server-Side Template Injection	RCE with Server-Side Template Injection
2026-04-03	Rejetto HTTP File Server SSTI RCE (CVE-2024-23692) \| Invicti	Rejetto HTTP File Server SSTI RCE (CVE-2024-23692) \| Invicti
2026-04-03	WPML Plugin RCE via Twig SSTI (CVE-2024-6386)	WPML Plugin RCE via Twig SSTI (CVE-2024-6386)
2026-04-03	PayloadsAllTheThings - Server Side Template Injection	PayloadsAllTheThings - Server Side Template Injection
2026-04-03	SSTI: Advanced Exploitation Guide \| Intigriti	SSTI: Advanced Exploitation Guide \| Intigriti
2026-04-03	SSTI Exploitation with RCE Everywhere \| YesWeHack	SSTI Exploitation with RCE Everywhere \| YesWeHack

Python +10

Date	Resource	Summary
2026-04-03	A Large-Scale Security-Oriented Static Analysis of Python Packages in PyPI	A Large-Scale Security-Oriented Static Analysis of Python Packages in PyPI
2026-04-03	Exposing 4 Critical Vulnerabilities in Python PickleScan \| Sonatype	Exposing 4 Critical Vulnerabilities in Python PickleScan \| Sonatype
2026-04-03	Python SAST Tools: Free & Paid Solutions for Secure Code Analysis	Python SAST Tools: Free & Paid Solutions for Secure Code Analysis
2026-04-03	10 Common Security Gotchas in Python and How to Avoid Them	10 Common Security Gotchas in Python and How to Avoid Them
2026-04-03	Insecure Deserialization in Python \| Semgrep	Insecure Deserialization in Python \| Semgrep
2026-04-03	PyTorch Users at Risk: 3 Zero-Day PickleScan Vulnerabilities \| JFrog	PyTorch Users at Risk: 3 Zero-Day PickleScan Vulnerabilities \| JFrog
2026-04-03	PickleScan - Security Scanner Detecting Suspicious Python Pickle Files	PickleScan - Security Scanner Detecting Suspicious Python Pickle Files
2026-04-03	Python Secure Coding Guidelines	Python Secure Coding Guidelines
2026-04-03	Bandit: Python Static Application Security Testing Guide	Bandit: Python Static Application Security Testing Guide
2026-04-03	Python Security Vulnerabilities \| Top Issues \| Aikido	Python Security Vulnerabilities \| Top Issues \| Aikido

OSINT +10

Date	Resource	Summary
2026-04-03	Bug Bounty 101: Top 10 Reconnaissance Tools \| Netlas	Bug Bounty 101: Top 10 Reconnaissance Tools \| Netlas
2026-04-03	Top 7 OSINT Tools Every Cybersecurity Professional Should Know	Top 7 OSINT Tools Every Cybersecurity Professional Should Know
2026-04-03	Top 10 OSINT Tools Everyone Should Know \| SMIIT CyberAI	Top 10 OSINT Tools Everyone Should Know \| SMIIT CyberAI
2026-04-03	Top 10 OSINT Tools in 2025 Cyber Analysts Trust	Top 10 OSINT Tools in 2025 Cyber Analysts Trust
2026-04-03	10 Best Open Source Intelligence (OSINT) Tools Of 2025	10 Best Open Source Intelligence (OSINT) Tools Of 2025
2026-04-03	What is OSINT? Tools, Techniques and Framework Explained	What is OSINT? Tools, Techniques and Framework Explained
2026-04-03	15 Best OSINT Tools in 2026 \| Lampyre	15 Best OSINT Tools in 2026 \| Lampyre
2026-04-03	Open Source Intelligence Tools and Resources Collection	Open Source Intelligence Tools and Resources Collection
2026-04-03	OSINT for Threat Enrichment: Deep Dive with Maltego, SpiderFoot, IntelX, Recon-ng	OSINT for Threat Enrichment: Deep Dive with Maltego, SpiderFoot, IntelX, Recon-ng
2026-04-03	Top 15 Free OSINT Tools To Collect Data From Open Sources	Top 15 Free OSINT Tools To Collect Data From Open Sources

SQLi +10

Date	Resource	Summary
2026-04-03	12 Questions and Answers About Insecure Deserialization	12 Questions and Answers About Insecure Deserialization
2026-04-03	How to Perform SQL Injection in Web Apps	How to Perform SQL Injection in Web Apps
2026-04-03	What is SQL Injection? How to Prevent SQL Injection \| Fortinet	What is SQL Injection? How to Prevent SQL Injection \| Fortinet
2026-04-03	Bypassing WAFs in 2025: New Techniques and Evasion Tactics	Bypassing WAFs in 2025: New Techniques and Evasion Tactics
2026-04-03	7 Types of SQL Injection Attacks & How to Prevent Them	7 Types of SQL Injection Attacks & How to Prevent Them
2026-04-03	SQLi Payloads - Classic, Blind, Error-Based, Time-Based, WAF Bypass	SQLi Payloads - Classic, Blind, Error-Based, Time-Based, WAF Bypass
2026-04-03	SQL Injection for Bug Bounty Hunters \| YesWeHack	SQL Injection for Bug Bounty Hunters \| YesWeHack
2026-04-03	Exploiting an SQL Injection with WAF Bypass	Exploiting an SQL Injection with WAF Bypass
2026-04-03	SQL Injection Bypassing WAF \| OWASP	SQL Injection Bypassing WAF \| OWASP
2026-04-03	PayloadsAllTheThings - SQL Injection	PayloadsAllTheThings - SQL Injection

IDOR +10

Date	Resource	Summary
2026-04-03	IDOR \| HackTricks	IDOR \| HackTricks
2026-04-03	IDOR Attack Guide \| Hackviser	IDOR Attack Guide \| Hackviser
2026-04-03	Real Bug Bounty Report: IDOR Used to Exploit a Banking Application	Real Bug Bounty Report: IDOR Used to Exploit a Banking Application
2026-04-03	Reddit Bug Bounty: Exploiting an IDOR Vulnerability in Dubsmash's API	Reddit Bug Bounty: Exploiting an IDOR Vulnerability in Dubsmash's API
2026-04-03	IDOR: The $1 Billion Authorization Bug	IDOR: The $1 Billion Authorization Bug
2026-04-03	IDOR Vulnerability: Analysis, Impact, Mitigation \| Huntress	IDOR Vulnerability: Analysis, Impact, Mitigation \| Huntress
2026-04-03	How to Find IDOR Vulnerabilities: The Bug Bounty Hunter's Practical Guide	How to Find IDOR Vulnerabilities: The Bug Bounty Hunter's Practical Guide
2026-04-03	Insecure Direct Object References (IDOR) \| Intigriti Hackademy	Insecure Direct Object References (IDOR) \| Intigriti Hackademy
2026-04-03	IDOR in 2025: Why Broken Access Control Still Rules the Vulnerability Charts	IDOR in 2025: Why Broken Access Control Still Rules the Vulnerability Charts
2026-04-03	IDOR: A Complete Guide to Exploiting Advanced IDOR Vulnerabilities \| Intigriti	IDOR: A Complete Guide to Exploiting Advanced IDOR Vulnerabilities \| Intigriti

Secrets +10

Date	Resource	Summary
2026-04-03	AWS Secrets Manager vs HashiCorp Vault [2026]	AWS Secrets Manager vs HashiCorp Vault [2026]
2026-04-03	AWS Secrets Engine \| HashiCorp Vault	AWS Secrets Engine \| HashiCorp Vault
2026-04-03	Researcher Unearths Thousands of Leaked Secrets in GitHub's "Oops Commits"	Researcher Unearths Thousands of Leaked Secrets in GitHub's "Oops Commits"
2026-04-03	How to Detect and Clean Up Leaked Secrets in Your Git Repositories	How to Detect and Clean Up Leaked Secrets in Your Git Repositories
2026-04-03	Secret Scanning Tools 2026: Protect Code and Prevent Credential Leaks	Secret Scanning Tools 2026: Protect Code and Prevent Credential Leaks
2026-04-03	TruffleHog vs. Gitleaks: A Detailed Comparison	TruffleHog vs. Gitleaks: A Detailed Comparison
2026-04-03	Why 28 Million Credentials Leaked on GitHub in 2025 \| Snyk	Why 28 Million Credentials Leaked on GitHub in 2025 \| Snyk
2026-04-03	Gitleaks - Find Secrets with Gitleaks	Gitleaks - Find Secrets with Gitleaks
2026-04-03	TruffleHog - Find, Verify, and Analyze Leaked Credentials	TruffleHog - Find, Verify, and Analyze Leaked Credentials
2026-04-03	Secrets Management - OWASP Cheat Sheet Series	Website with the collection of all the cheat sheets of the project.

Supply Chain +10

Date	Resource	Summary
2026-04-03	12 Months That Changed Supply Chain Security - 2025 Month by Month	12 Months That Changed Supply Chain Security - 2025 Month by Month
2026-04-03	Securing the Software Supply Chain: OpenSSF, SLSA, SBOM, and Sigstore	Securing the Software Supply Chain: OpenSSF, SLSA, SBOM, and Sigstore
2026-04-03	OWASP Top 10 2025: A03 Software Supply Chain Failures (Beginner's Guide)	OWASP Top 10 2025: A03 Software Supply Chain Failures (Beginner's Guide)
2026-04-03	SLSA Framework: The Definitive Guide for Securing Your Software Supply Chain	SLSA Framework: The Definitive Guide for Securing Your Software Supply Chain
2026-04-03	Five Key Flaws Exploited in 2025's Software Supply Chain Incidents	Five Key Flaws Exploited in 2025's Software Supply Chain Incidents
2026-04-03	Predictions for Open Source Security in 2025 \| OpenSSF	Predictions for Open Source Security in 2025 \| OpenSSF
2026-04-03	Supply Chain Attacks in Q4 2025: From Isolated Incidents to Systemic Failure Modes	Supply Chain Attacks in Q4 2025: From Isolated Incidents to Systemic Failure Modes
2026-04-03	Supply Chain Security in CI: SBOMs, SLSA, and Sigstore	Supply Chain Security in CI: SBOMs, SLSA, and Sigstore
2026-04-03	SLSA - Supply-chain Levels for Software Artifacts	SLSA - Supply-chain Levels for Software Artifacts
2026-04-03	A03 Software Supply Chain Failures - OWASP Top 10:2025	A03 Software Supply Chain Failures - OWASP Top 10:2025

Burp Suite +9

Date	Resource	Summary
2026-04-03	Installing Extensions from BApp Store \| PortSwigger	Installing Extensions from BApp Store \| PortSwigger
2026-04-03	3 Powerful Burp Suite Extensions Every Pentester Should Use	3 Powerful Burp Suite Extensions Every Pentester Should Use
2026-04-03	BApp Store \| PortSwigger	BApp Store \| PortSwigger
2026-04-03	Burp Suite Professional BApps: Maximizing Pentester Productivity	Burp Suite Professional BApps: Maximizing Pentester Productivity
2026-04-03	Burp Bounty - Scan Check Builder Extension	Burp Bounty - Scan Check Builder Extension
2026-04-03	Burp Suite - Top Extensions \| KSEC ARK Pentesting Knowledge Base	Burp Suite - Top Extensions \| KSEC ARK Pentesting Knowledge Base
2026-04-03	Top 10 Must-Have Burp Suite Extensions for Web Application Security (2024)	Top 10 Must-Have Burp Suite Extensions for Web Application Security (2024)
2026-04-03	Top 10 Pentesting Tools and Extensions in Burp Suite \| PortSwigger	Top 10 Pentesting Tools and Extensions in Burp Suite \| PortSwigger
2026-04-03	Top 20 Useful Burp Suite Extensions for Web Application Pentesting	Top 20 Useful Burp Suite Extensions for Web Application Pentesting

XXE +9

Date	Resource	Summary
2026-04-03	Advanced XXE Exploitation: File Disclosure, Blind OOB, and RCE	Advanced XXE Exploitation: File Disclosure, Blind OOB, and RCE
2026-04-03	What is XXE (XML External Entity) \| Examples & Prevention \| Imperva	What is XXE (XML External Entity) \| Examples & Prevention \| Imperva
2026-04-03	XML External Entities (XXE) \| Pentesting Notes	XML External Entities (XXE) \| Pentesting Notes
2026-04-03	XML External Entity (XXE) Processing \| OWASP	XML External Entity (XXE) Processing \| OWASP
2026-04-03	Blind XXE: Exfiltrating Data Out-of-Band in 2025	Blind XXE: Exfiltrating Data Out-of-Band in 2025
2026-04-03	Comprehensive Guide to XXE Exploitation: Advanced Data Exfiltration and RCE	Comprehensive Guide to XXE Exploitation: Advanced Data Exfiltration and RCE
2026-04-03	XML External Entity: The Ultimate Bug Bounty Guide to XXE \| YesWeHack	XML External Entity: The Ultimate Bug Bounty Guide to XXE \| YesWeHack
2026-04-03	XML External Entity (XXE) Attack Guide \| Hackviser	XML External Entity (XXE) Attack Guide \| Hackviser
2026-04-03	What is a Blind XXE Attack? \| PortSwigger	What is a Blind XXE Attack? \| PortSwigger

GraphQL +9

Date	Resource	Summary
2026-04-03	GraphQL Security Testing Guide (2026)	GraphQL Security Testing Guide (2026)
2026-04-03	GraphQL Security Complete Guide \| Payload Playground	GraphQL Security Complete Guide \| Payload Playground
2026-04-03	GraphQL Vulnerabilities and Common Attacks Seen in the Wild \| Imperva	GraphQL Vulnerabilities and Common Attacks Seen in the Wild \| Imperva
2026-04-03	GraphQL API Vulnerabilities, Common Attacks & Security Tips	GraphQL API Vulnerabilities, Common Attacks & Security Tips
2026-04-03	Hacking GraphQL Endpoints in Bug Bounty Programs \| YesWeHack	Hacking GraphQL Endpoints in Bug Bounty Programs \| YesWeHack
2026-04-03	PayloadsAllTheThings - GraphQL Injection	PayloadsAllTheThings - GraphQL Injection
2026-04-03	GraphQL \| HackTricks	GraphQL \| HackTricks
2026-04-03	GraphQL Cheat Sheet \| OWASP	GraphQL Cheat Sheet \| OWASP
2026-04-03	GraphQL Security from a Pentester's Perspective \| AFINE	GraphQL Security from a Pentester's Perspective \| AFINE

Deserialization +8

Date	Resource	Summary
2026-04-03	Unsafe Deserialization in Ruby \| SecureFlag	Unsafe Deserialization in Ruby \| SecureFlag
2026-04-03	Analyzing Prerequisites of Known Deserialization Vulnerabilities on Java Applications	Analyzing Prerequisites of Known Deserialization Vulnerabilities on Java Applications
2026-04-03	Insecure Deserialization: The Vulnerability That Gives Attackers RCE	Insecure Deserialization: The Vulnerability That Gives Attackers RCE
2026-04-03	Ruby 2.x Universal RCE Deserialization Gadget Chain \| elttam	Ruby 2.x Universal RCE Deserialization Gadget Chain \| elttam
2026-04-03	Insecure Deserialization Explained with Examples	Insecure Deserialization Explained with Examples
2026-04-03	Now You Serial, Now You Don't — Systematically Hunting for Deserialization Exploits \| Google Cloud	Now You Serial, Now You Don't — Systematically Hunting for Deserialization Exploits \| Google Cloud
2026-04-03	PayloadsAllTheThings - Java Deserialization Payloads	PayloadsAllTheThings - Java Deserialization Payloads
2026-04-03	Insecure Deserialization \| OWASP	Insecure Deserialization \| OWASP

API Security +8

Date	Resource	Summary
2026-04-03	OWASP API Security Top 10 Explained \| Salt Security	OWASP API Security Top 10 Explained \| Salt Security
2026-04-03	How To Prepare For An API Penetration Test	How To Prepare For An API Penetration Test
2026-04-03	Awesome GraphQL Security - Curated List of Resources	Awesome GraphQL Security - Curated List of Resources
2026-04-03	API Testing with Burp Suite: A Practical Guide	API Testing with Burp Suite: A Practical Guide
2026-04-03	Top 6 API Pentesting Tools \| Cobalt	Top 6 API Pentesting Tools \| Cobalt
2026-04-03	API Attack Awareness: BOLA - Why It Tops the OWASP API Top 10	API Attack Awareness: BOLA - Why It Tops the OWASP API Top 10
2026-04-03	OWASP API Security Top 10	OWASP API Security Top 10
2026-04-03	OWASP API Security Project \| OWASP Foundation	The API Security project focuses on strategies and solutions to understand and mitigate the unique vulnerabilities and security risks of Application Programming Interfaces (APIs)

Date	Resource	Summary
2026-04-03	Awesome Bug Bounty Writeups - Curated List by Bug Type	Awesome Bug Bounty Writeups - Curated List by Bug Type
2026-04-03	XSS Exploit Payloads - DOM, Reflected, Stored, and WAF Bypass	XSS Exploit Payloads - DOM, Reflected, Stored, and WAF Bypass
2026-04-03	Stored XSS Vulnerability WAF Bypass Writeup	Stored XSS Vulnerability WAF Bypass Writeup
2026-04-03	Reflected XSS with WAF Bypass — A Creative Payload That Worked	Reflected XSS with WAF Bypass — A Creative Payload That Worked
2026-04-03	Learn about Cross Site Scripting (XSS) \| BugBountyHunter.com	Learn about Cross Site Scripting (XSS) \| BugBountyHunter.com
2026-04-03	DOM-Based XSS in Single Page Applications (SPAs): A Complete Guide	DOM-Based XSS in Single Page Applications (SPAs): A Complete Guide
2026-04-03	The Ultimate Guide to Finding and Escalating XSS Bugs \| Bugcrowd	The Ultimate Guide to Finding and Escalating XSS Bugs \| Bugcrowd
2026-04-03	How a Cross-Site Scripting Vulnerability Led to Account Takeover \| HackerOne	How a Cross-Site Scripting Vulnerability Led to Account Takeover \| HackerOne
2026-04-03	XSS Attacks & Exploitation: The Ultimate Guide \| YesWeHack	XSS Attacks & Exploitation: The Ultimate Guide \| YesWeHack
2026-04-03	Cross-Site Scripting (XSS) Cheat Sheet - 2026 Edition \| PortSwigger	Cross-Site Scripting (XSS) Cheat Sheet - 2026 Edition \| PortSwigger
2026-04-03	CISA Warns of Zimbra SharePoint Flaw Exploits; Cisco Zero-Day Hit in Ransomware Attacks	CISA Warns of Zimbra, SharePoint Flaw Exploits; Cisco Zero-Day Hit in Ransomware Attacks https://ift.tt/vwg96OZ
2026-04-01	ShadowPrompt: Zero-Click Prompt Injection Chain in Anthropics Claude Chrome Extension	ShadowPrompt: Zero-Click Prompt Injection Chain in Anthropic’s Claude Chrome Extension https://ift.tt/LQkpR3n
2026-04-01	Jira Account Takeover	Jira Account Takeover https://ift.tt/wtHJ6Lm
2026-03-31	Vulnerabilities in Bludit software	Vulnerabilities in Bludit software https://ift.tt/xf0FONS
2026-03-30	Stored XSS Bug in Jira Work Management Could Lead to Full Organization Takeover	Stored XSS Bug in Jira Work Management Could Lead to Full Organization Takeover https://ift.tt/chvJTgR
2026-03-30	Stored XSS Flaw in Jira Work Management Could Enable Full Org Compromise	Stored XSS Flaw in Jira Work Management Could Enable Full Org Compromise https://ift.tt/tBU50wa
2026-03-30	Stored XSS Vulnerability in Jira Work Management Could Enable Full Organization Takeover	Stored XSS Vulnerability in Jira Work Management Could Enable Full Organization Takeover https://ift.tt/NBDfQXj

Date	Resource	Summary
2026-04-03	Broken Authentication and IDOR – A Big but Solvable Problem \| Inspectiv	Broken Authentication and IDOR – A Big but Solvable Problem \| Inspectiv
2026-04-03	Exploiting Broken Access Control Vulnerability for Bounty	Exploiting Broken Access Control Vulnerability for Bounty
2026-04-03	Broken Access Control Testing Software for Web Apps \| Penti AI	Broken Access Control Testing Software for Web Apps \| Penti AI
2026-04-03	WSTG Methodology: Web Penetration Testing \| Haxoris	WSTG Methodology: Web Penetration Testing \| Haxoris
2026-04-03	OWASP Top 10 #1: Broken Access Control and Security Tips	OWASP Top 10 #1: Broken Access Control and Security Tips
2026-04-03	Primer on Broken Access Control Vulnerabilities and How to Find Them	Primer on Broken Access Control Vulnerabilities and How to Find Them
2026-04-03	Horizontal and Vertical Privilege Escalation Explained \| Blue Goat Cyber	Horizontal and Vertical Privilege Escalation Explained \| Blue Goat Cyber
2026-04-03	Broken Access Control - Vertical Privilege Escalation Writeup	Broken Access Control - Vertical Privilege Escalation Writeup
2026-04-03	Testing for Privilege Escalation \| OWASP WSTG	Testing for Privilege Escalation \| OWASP WSTG
2026-04-03	Testing for Insecure Direct Object References \| OWASP WSTG	Testing for Insecure Direct Object References \| OWASP WSTG
2026-04-03	Top HackerOne Reports - Authorization Bypass	Top HackerOne Reports - Authorization Bypass
2026-04-03	Broken Authentication: Advanced Exploitation Guide \| Intigriti	Broken Authentication: Advanced Exploitation Guide \| Intigriti
2026-04-03	How To Find Broken Access Control Vulnerabilities in the Wild \| HackerOne	How To Find Broken Access Control Vulnerabilities in the Wild \| HackerOne
2026-04-03	BugQuest 2026: 31 Days of Broken Access Control \| Intigriti	BugQuest 2026: 31 Days of Broken Access Control \| Intigriti
2026-04-03	Authn vs. authz: How are they different?	Authentication (authn) refers to identity, while authorization (authz) has to do with permissions. Learn about the difference between authn vs. authz in more detail.