Recon+45
SSTI+40
JWT+38
GraphQL+35
OSINT+35
IDOR+34
Supply Chain+34
Deserialization+32
Authentication+32
Secrets+31
SSRF+24
XSS+16
Mobile+15
API Security+15
AI+15
AuthZ+15
Burp Suite+15
SQLi+15
XXE+15
RCE+14
Fuzzing+14
Python+14
CSRF+12
Talks+12
Bug Bounty+11
Recon +45
| Date | Resource | Summary |
|---|---|---|
| 2026-04-19 | The 2026 State of Attack Surface Management — ProjectDiscovery | The 2026 State of Attack Surface Management — ProjectDiscovery |
| 2026-04-19 | The Ultimate Guide to Attack Surface Management Tools in 2025 | The Ultimate Guide to Attack Surface Management Tools in 2025 |
| 2026-04-19 | Top 10 Attack Surface Management Tools for 2026 — Intruder | Top 10 Attack Surface Management Tools for 2026 — Intruder |
| 2026-04-19 | 12 Attack Surface Management Tools to Know in 2026 | 12 Attack Surface Management Tools to Know in 2026 |
| 2026-04-19 | SubFinder: Automating Subdomain Enumeration for Bug Bounty in 2025 | SubFinder: Automating Subdomain Enumeration for Bug Bounty in 2025 |
| 2026-04-17 | Bug Bounty Recon: Perform Faster Port Scan (Rootsploit) | Bug Bounty Recon: Perform Faster Port Scan (Rootsploit) |
| 2026-04-17 | Naabu Zero to Hero Guide (Cyber Aryan) | Naabu Zero to Hero Guide (Cyber Aryan) |
| 2026-04-17 | Mastering Network Scanning: Nmap and Masscan Guide | Mastering Network Scanning: Nmap and Masscan Guide |
| 2026-04-17 | Naabu Cheat Sheet: Commands & Examples (HighOn.Coffee) | Naabu Cheat Sheet: Commands & Examples (HighOn.Coffee) |
| 2026-04-17 | naabu: Fast Go port scanner (ProjectDiscovery) | naabu: Fast Go port scanner (ProjectDiscovery) |
| 2026-04-17 | Recon series #4: Port scanning methods (YesWeHack) | Recon series #4: Port scanning methods (YesWeHack) |
| 2026-04-17 | bountyRecon: Bash automation for bug bounty recon | bountyRecon: Bash automation for bug bounty recon |
| 2026-04-17 | JSFScan.sh: JavaScript recon automation (KathanP19) | JSFScan.sh: JavaScript recon automation (KathanP19) |
| 2026-04-17 | Reconky: Content discovery bash script | Reconky: Content discovery bash script |
| 2026-04-17 | Bug-Bounty-Automation: Bash recon (Retr0-45809) | Bug-Bounty-Automation: Bash recon (Retr0-45809) |
| 2026-04-17 | Recon-Script: automation with Nuclei (s1d6point7bugcrowd) | Recon-Script: automation with Nuclei (s1d6point7bugcrowd) |
| 2026-04-17 | Bug-Bounty-Recon-Automation shell script (Amangupta1234) | Bug-Bounty-Recon-Automation shell script (Amangupta1234) |
| 2026-04-17 | The Ultimate Guide to Finding Bugs With Nuclei (ProjectDiscovery) | The Ultimate Guide to Finding Bugs With Nuclei (ProjectDiscovery) |
| 2026-04-17 | The Ultimate Recon Arsenal: 25+ Commands for Bug Bounty Workflow | The Ultimate Recon Arsenal: 25+ Commands for Bug Bounty Workflow |
| 2026-04-17 | xpfarm: Automated bug bounty & recon framework (GitHub) | xpfarm: Automated bug bounty & recon framework (GitHub) |
| 2026-04-17 | Automate Your Nuclei Recon Pipeline with VPN + Discord Alerts | Automate Your Nuclei Recon Pipeline with VPN + Discord Alerts |
| 2026-04-17 | Advanced Recon: Taking Your Subdomain Discovery to the Next Level | Advanced Recon: Taking Your Subdomain Discovery to the Next Level |
| 2026-04-17 | GitHub dorking for beginners: find more vulnerabilities (Intigriti) | GitHub dorking for beginners: find more vulnerabilities (Intigriti) |
| 2026-04-17 | google-dorks-bug-bounty (TakSec, GitHub) | google-dorks-bug-bounty (TakSec, GitHub) |
| 2026-04-17 | How I Found Sensitive Information using GitHub Dorks (Part 3) | How I Found Sensitive Information using GitHub Dorks (Part 3) |
| 2026-04-17 | The Ultimate Subdomain Recon Playbook | The Ultimate Subdomain Recon Playbook |
| 2026-04-17 | Complete Guide to Amass Tool (2025 Edition) | Complete Guide to Amass Tool (2025 Edition) |
| 2026-04-17 | Mastering Passive Reconnaissance for Bug Bounty and Pentesting | Mastering Passive Reconnaissance for Bug Bounty and Pentesting |
| 2026-04-17 | How to Use Recon-ng Tool for OSINT and Bug Bounty | How to Use Recon-ng Tool for OSINT and Bug Bounty |
| 2026-04-17 | Mastering OSINT for Bug Bounty: Advanced Deep Recon | Mastering OSINT for Bug Bounty: Advanced Deep Recon |
| 2026-04-17 | Mastering Passive Information Gathering: Extensive OSINT Guide | Mastering Passive Information Gathering: Extensive OSINT Guide |
| 2026-04-17 | Google Dorking Mastery: From Passive OSINT to Bug Bounty | Google Dorking Mastery: From Passive OSINT to Bug Bounty |
| 2026-04-17 | 9 Attack Surface Monitoring Tools in 2026 (SentinelOne) | 9 Attack Surface Monitoring Tools in 2026 (SentinelOne) |
| 2026-04-17 | Recon Methodology: Subdomain Enumeration | Recon Methodology: Subdomain Enumeration |
| 2026-04-17 | Recon Guide: Subdomain Enumeration | Recon Guide: Subdomain Enumeration |
| 2026-04-17 | Bug-Bounty-recon: Automated recon framework (GitHub) | Bug-Bounty-recon: Automated recon framework (GitHub) |
| 2026-04-17 | Subdomain enumeration: expand attack surface with active, passive methods | Subdomain enumeration: expand attack surface with active, passive methods |
| 2026-04-16 | Passive Reconnaissance Using OSINT | Passive Reconnaissance Using OSINT |
| 2026-04-16 | From Recon to Sensitive Key Exposure Using Nuclei | From Recon to Sensitive Key Exposure Using Nuclei |
| 2026-04-16 | reconFTW: Automated Recon Tool | reconFTW: Automated Recon Tool |
| 2026-04-16 | A Deep Dive on Katana Field Extraction | A Deep Dive on Katana Field Extraction |
| 2026-04-16 | Subdomain Takeover in 2025: New Methods and Tools | Subdomain Takeover in 2025: New Methods and Tools |
| 2026-04-16 | My Complete Recon Workflow for Bug Bounty Hunting (2025) | My Complete Recon Workflow for Bug Bounty Hunting (2025) |
| 2026-04-16 | Internet-Wide Recon: Moving Past IP-Centric Approaches | Internet-Wide Recon: Moving Past IP-Centric Approaches |
| 2026-04-16 | The Art of Recon: Strategies for Modern Asset Discovery | The Art of Recon: Strategies for Modern Asset Discovery |
SSTI +40
| Date | Resource | Summary |
|---|---|---|
| 2026-04-19 | Inj3ctlab — SSTI Bug Bounty Labs Writeup | Inj3ctlab — SSTI Bug Bounty Labs Writeup |
| 2026-04-19 | Server-Side Template Injection — Bug Bounty 2k25 | Server-Side Template Injection — Bug Bounty 2k25 |
| 2026-04-19 | What is SSTI in Flask/Jinja2? — Payatu | What is SSTI in Flask/Jinja2? — Payatu |
| 2026-04-19 | PayloadsAllTheThings — SSTI README | PayloadsAllTheThings — SSTI README |
| 2026-04-19 | Find and Exploit Server-Side Template Injection — TCM Security | Find and Exploit Server-Side Template Injection — TCM Security |
| 2026-04-17 | Active Exploitation of Confluence CVE-2022-26134 (Rapid7) | Active Exploitation of Confluence CVE-2022-26134 (Rapid7) |
| 2026-04-17 | Atlassian Confluence Widget Connector Macro SSTI (ExploitDB) | Atlassian Confluence Widget Connector Macro SSTI (ExploitDB) |
| 2026-04-17 | SSTItoXSS: Exploiting SSTI to bypass WAF/XSS Filter | SSTItoXSS: Exploiting SSTI to bypass WAF/XSS Filter |
| 2026-04-17 | SSTI (The Hacker Recipes) | SSTI (The Hacker Recipes) |
| 2026-04-17 | Exploiting CVE-2021-25770: SSTI in YouTrack (Synacktiv) | Exploiting CVE-2021-25770: SSTI in YouTrack (Synacktiv) |
| 2026-04-17 | SSTI in Freemarker (Akto) | SSTI in Freemarker (Akto) |
| 2026-04-17 | Ruby ERB Template Injection (TrustedSec) | Ruby ERB Template Injection (TrustedSec) |
| 2026-04-17 | PayloadsAllTheThings: SSTI Ruby payloads | PayloadsAllTheThings: SSTI Ruby payloads |
| 2026-04-17 | Code Execution via SSTI Ruby ERB (Invicti) | Code Execution via SSTI Ruby ERB (Invicti) |
| 2026-04-17 | ruby-ssti: example Ruby ERB app vulnerable to SSTI | ruby-ssti: example Ruby ERB app vulnerable to SSTI |
| 2026-04-17 | Exploring SSTI in Flask/Jinja2 (nVisium) | Exploring SSTI in Flask/Jinja2 (nVisium) |
| 2026-04-17 | Setting Up a Vulnerable SSTI Lab: A Hands-On Guide | Setting Up a Vulnerable SSTI Lab: A Hands-On Guide |
| 2026-04-17 | SSTI in Flask/Jinja2 (IndominusByte) | SSTI in Flask/Jinja2 (IndominusByte) |
| 2026-04-17 | tplmap-python3: Python3 port (GitHub) | tplmap-python3: Python3 port (GitHub) |
| 2026-04-17 | Tplmap - Tool For Automatic SSTI Exploitation (GeeksforGeeks) | Tplmap - Tool For Automatic SSTI Exploitation (GeeksforGeeks) |
| 2026-04-17 | Lab: SSTI in an unknown language with documented exploit | Lab: SSTI in an unknown language with documented exploit |
| 2026-04-17 | PayloadsAllTheThings - SSTI JavaScript engines | PayloadsAllTheThings - SSTI JavaScript engines |
| 2026-04-17 | HackerOne Report #423541: H1514 Server Side Template Injection | HackerOne Report #423541: H1514 Server Side Template Injection |
| 2026-04-17 | A Simple Flask (Jinja2) SSTI Example (Kleiber) | A Simple Flask (Jinja2) SSTI Example (Kleiber) |
| 2026-04-17 | Strapi Security Disclosure: Multi-CVE SSTI chain | Strapi Security Disclosure: Multi-CVE SSTI chain |
| 2026-04-17 | Bug Bytes #124: SSTI to RCE in Go apps (Intigriti) | Bug Bytes #124: SSTI to RCE in Go apps (Intigriti) |
| 2026-04-17 | Top 25 RCE Bug Bounty Reports (Cristian Cornea) | Top 25 RCE Bug Bounty Reports (Cristian Cornea) |
| 2026-04-17 | What is Server-Side Template Injection? (Indusface) | What is Server-Side Template Injection? (Indusface) |
| 2026-04-17 | Mastering SSTI Exploitation: Executing Commands in Popular Templating Engines | Mastering SSTI Exploitation: Executing Commands in Popular Templating Engines |
| 2026-04-17 | SSTI: Advanced Exploitation Techniques (BootstrapSecurity) | SSTI: Advanced Exploitation Techniques (BootstrapSecurity) |
| 2026-04-17 | Jinja2 template injection filter bypasses (0day.work) | Jinja2 template injection filter bypasses (0day.work) |
| 2026-04-17 | Jinja2/Flask SSTI Filter bypass (MRLSECURITY) | Jinja2/Flask SSTI Filter bypass (MRLSECURITY) |
| 2026-04-17 | SSTI - Server-side template injection with a custom exploit (Scott Murray) | SSTI - Server-side template injection with a custom exploit (Scott Murray) |
| 2026-04-17 | picoCTF 2025: SSTI2 Exploitation Writeup | picoCTF 2025: SSTI2 Exploitation Writeup |
| 2026-04-17 | picoCTF 2025: SSTI Challenge Writeup | picoCTF 2025: SSTI Challenge Writeup |
| 2026-04-16 | SSTI: RCE for the Modern Web App - Black Hat 2015 | SSTI: RCE for the Modern Web App - Black Hat 2015 |
| 2026-04-16 | Server Side Template Injection - Payloads All The Things | Server Side Template Injection - Payloads All The Things |
| 2026-04-16 | Practical Exploitation of SSTI in Flask with Jinja2 | Practical Exploitation of SSTI in Flask with Jinja2 |
| 2026-04-16 | SSTI Explained with Real Code Examples - Xygeni | SSTI Explained with Real Code Examples - Xygeni |
| 2026-04-16 | Deep Dive into SSTI: Finding and Exploiting Like a Pro | Deep Dive into SSTI: Finding and Exploiting Like a Pro |
JWT +38
| Date | Resource | Summary |
|---|---|---|
| 2026-04-19 | CVE-2025-45768: PyJWT Information Disclosure Vulnerability | CVE-2025-45768: PyJWT Information Disclosure Vulnerability |
| 2026-04-19 | How JWT Libraries Block Algorithm Confusion: Code Review Lessons | How JWT Libraries Block Algorithm Confusion: Code Review Lessons |
| 2026-04-19 | JSON Web Token Attacks and Vulnerabilities — Acunetix | JSON Web Token Attacks and Vulnerabilities — Acunetix |
| 2026-04-19 | Security of JSON Web Tokens (JWT) — Cyber Polygon | Security of JSON Web Tokens (JWT) — Cyber Polygon |
| 2026-04-19 | Analyzing Broken User Authentication Threats to JWTs — Akamai | Analyzing Broken User Authentication Threats to JWTs — Akamai |
| 2026-04-17 | JWT Token Lifecycle: Expiration, Refresh, and Revocation | JWT Token Lifecycle: Expiration, Refresh, and Revocation |
| 2026-04-17 | python-jwt token forgery CVE-2022-39227 | python-jwt token forgery CVE-2022-39227 |
| 2026-04-17 | CVE-2024-53861: PyJWT Issuer Field Partial Match | CVE-2024-53861: PyJWT Issuer Field Partial Match |
| 2026-04-17 | Python-JOSE Security Risk: CVE-2024-33663 Explained | Python-JOSE Security Risk: CVE-2024-33663 Explained |
| 2026-04-17 | JWT Bomb in Python-JOSE CVE-2024-33664 | JWT Bomb in Python-JOSE CVE-2024-33664 |
| 2026-04-17 | JWT Pentest Book (six2dez) | JWT Pentest Book (six2dez) |
| 2026-04-17 | JWT Pentest Checklist (Cyber Frogy) | JWT Pentest Checklist (Cyber Frogy) |
| 2026-04-17 | JWT Pentest Checklist v1.0 (Chintan Gurjar) | JWT Pentest Checklist v1.0 (Chintan Gurjar) |
| 2026-04-17 | HackerOne #1210502: Jitsi Authentication Bypass (JWT) | HackerOne #1210502: Jitsi Authentication Bypass (JWT) |
| 2026-04-17 | HackerOne #2472798: Newspack Extended Access JWT bypass | HackerOne #2472798: Newspack Extended Access JWT bypass |
| 2026-04-17 | JSON Web Token Vulnerabilities (0xn3va cheat sheet) | JSON Web Token Vulnerabilities (0xn3va cheat sheet) |
| 2026-04-17 | JWT Forgery via unvalidated jku parameter (Invicti) | JWT Forgery via unvalidated jku parameter (Invicti) |
| 2026-04-17 | jwt-hack: JSON Web Token Hack Toolkit (GitHub) | jwt-hack: JSON Web Token Hack Toolkit (GitHub) |
| 2026-04-17 | Insecure JSON Web Tokens (The Hacker Recipes) | Insecure JSON Web Tokens (The Hacker Recipes) |
| 2026-04-17 | Hacking JSON Web Tokens - Vickie Li | Hacking JSON Web Tokens - Vickie Li |
| 2026-04-17 | Known Exploits and Attacks (jwt_tool Wiki) | Known Exploits and Attacks (jwt_tool Wiki) |
| 2026-04-17 | JWT Security Best Practices for 2025 (JWT.app) | JWT Security Best Practices for 2025 (JWT.app) |
| 2026-04-17 | JWT Security Best Practices (Phase Two) | JWT Security Best Practices (Phase Two) |
| 2026-04-17 | JWT Security Guide: Best Practices & Implementation (Gupta Deepak) | JWT Security Guide: Best Practices & Implementation (Gupta Deepak) |
| 2026-04-17 | JWT authentication bypass via kid header path traversal (siunam) | JWT authentication bypass via kid header path traversal (siunam) |
| 2026-04-17 | JWT authentication bypass via algorithm confusion (siunam) | JWT authentication bypass via algorithm confusion (siunam) |
| 2026-04-17 | ctf-jwt-token: Vulnerability in early JWT node.js library (GitHub) | ctf-jwt-token: Vulnerability in early JWT node.js library (GitHub) |
| 2026-04-17 | JWT Authentication Bypass Using alg:none - CTF Writeup | JWT Authentication Bypass Using alg:none - CTF Writeup |
| 2026-04-17 | JWT Algorithm Confusion Attack: Two Active CVEs in 2026 | JWT Algorithm Confusion Attack: Two Active CVEs in 2026 |
| 2026-04-17 | JWT Algorithm Confusion: Turning RS256 Tokens into HS256 Disasters | JWT Algorithm Confusion: Turning RS256 Tokens into HS256 Disasters |
| 2026-04-17 | CVE-2026-29000: pac4j-jwt Authentication Bypass | CVE-2026-29000: pac4j-jwt Authentication Bypass |
| 2026-04-17 | Understanding JWT Security and Common Vulnerabilities (secops) | Understanding JWT Security and Common Vulnerabilities (secops) |
| 2026-04-17 | JWT Security in 2025: Critical Vulnerabilities for B2B SaaS | JWT Security in 2025: Critical Vulnerabilities for B2B SaaS |
| 2026-04-17 | JWT Vulnerabilities: Complete Testing Guide (IntelligenceX) | JWT Vulnerabilities: Complete Testing Guide (IntelligenceX) |
| 2026-04-17 | JWT Vulnerabilities List: 2026 Security Risks & Mitigation Guide (Red Sentry) | JWT Vulnerabilities List: 2026 Security Risks & Mitigation Guide (Red Sentry) |
| 2026-04-16 | JWT Header Parameter Injections | JWT Header Parameter Injections |
| 2026-04-16 | CVE-2026-29000: Authentication Bypass in pac4j-jwt | CVE-2026-29000: Authentication Bypass in pac4j-jwt |
| 2026-04-16 | JWT Algorithm Confusion Attacks: CVE-2026-22817 Fix Guide | JWT Algorithm Confusion Attacks: CVE-2026-22817 Fix Guide |
GraphQL +35
| Date | Resource | Summary |
|---|---|---|
| 2026-04-19 | PayloadsAllTheThings — GraphQL Injection | PayloadsAllTheThings — GraphQL Injection |
| 2026-04-19 | Approaching GraphQL End Points — Bug Bounty Notes | Approaching GraphQL End Points — Bug Bounty Notes |
| 2026-04-19 | DoS via Mutation Aliasing in GraphQL — HackerOne Disclosure | DoS via Mutation Aliasing in GraphQL — HackerOne Disclosure |
| 2026-04-19 | GraphQL API Vulnerabilities Learning Path — PortSwigger | GraphQL API Vulnerabilities Learning Path — PortSwigger |
| 2026-04-19 | GraphQL Introspection Security: Lessons from the Parse Server Vulnerability | GraphQL Introspection Security: Lessons from the Parse Server Vulnerability |
| 2026-04-17 | Hasura GraphQL 1.3.3 Local File Read via SQL Injection | Hasura GraphQL 1.3.3 Local File Read via SQL Injection |
| 2026-04-17 | Discovering GraphQL endpoints and SQLi vulnerabilities | Discovering GraphQL endpoints and SQLi vulnerabilities |
| 2026-04-17 | HackerOne Report #435066: SQL injection in GraphQL endpoint | HackerOne Report #435066: SQL injection in GraphQL endpoint |
| 2026-04-17 | Prisma and PostgreSQL vulnerable to NoSQL injection? (Aikido) | Prisma and PostgreSQL vulnerable to NoSQL injection? (Aikido) |
| 2026-04-17 | GraphQL Security: 9 Best Practices to Protect Your API (Escape) | GraphQL Security: 9 Best Practices to Protect Your API (Escape) |
| 2026-04-17 | Authorization in GraphQL (Apollo) | Authorization in GraphQL (Apollo) |
| 2026-04-17 | 9 Ways To Secure your GraphQL API - Apollo Checklist | 9 Ways To Secure your GraphQL API - Apollo Checklist |
| 2026-04-17 | Enforcing GraphQL security best practices with GraphOS | Enforcing GraphQL security best practices with GraphOS |
| 2026-04-17 | Apollo Authentication and Authorization Docs | Apollo Authentication and Authorization Docs |
| 2026-04-17 | Securing GraphQL API endpoints using rate limits and depth limits (LogRocket) | Securing GraphQL API endpoints using rate limits and depth limits (LogRocket) |
| 2026-04-17 | Cyclic Queries and Depth Limiting (Escape) | Cyclic Queries and Depth Limiting (Escape) |
| 2026-04-17 | IDOR Vulnerability In GraphQL Api On inmobi.com | IDOR Vulnerability In GraphQL Api On inmobi.com |
| 2026-04-17 | Exploiting GraphQL: Complete Guide for Bug Bounty Hunters | Exploiting GraphQL: Complete Guide for Bug Bounty Hunters |
| 2026-04-17 | Exploiting GraphQL for fun and bounties (BugBase) | Exploiting GraphQL for fun and bounties (BugBase) |
| 2026-04-17 | GraphQL for Bug Bounty (Mudhalai Mr) | GraphQL for Bug Bounty (Mudhalai Mr) |
| 2026-04-17 | GraphQL IDOR leads to information disclosure (Eshan Singh) | GraphQL IDOR leads to information disclosure (Eshan Singh) |
| 2026-04-17 | Bug Bounty: BAC in GraphQL (10 Major Vulns - Cloverleaf) | Bug Bounty: BAC in GraphQL (10 Major Vulns - Cloverleaf) |
| 2026-04-17 | Exploiting GraphQL for Penetration Testing (Raxis) | Exploiting GraphQL for Penetration Testing (Raxis) |
| 2026-04-17 | OWASP WSTG: Testing GraphQL | OWASP WSTG: Testing GraphQL |
| 2026-04-17 | Exploiting GraphQL Vulnerabilities: Misconfig to Data Leaks | Exploiting GraphQL Vulnerabilities: Misconfig to Data Leaks |
| 2026-04-16 | BatchQL: GraphQL Security Auditing for Batch Attacks | BatchQL: GraphQL Security Auditing for Batch Attacks |
| 2026-04-16 | InQL: Advanced GraphQL Security Testing Burp Extension | InQL: Advanced GraphQL Security Testing Burp Extension |
| 2026-04-16 | Exploiting CSRF in GraphQL Applications | Exploiting CSRF in GraphQL Applications |
| 2026-04-16 | GraphQL Vulnerabilities Cheat Sheet | GraphQL Vulnerabilities Cheat Sheet |
| 2026-04-16 | Exploiting GraphQL (Assetnote Research) | Exploiting GraphQL (Assetnote Research) |
| 2026-04-16 | GraphQL Discovery: Pentesting 101 Guide | GraphQL Discovery: Pentesting 101 Guide |
| 2026-04-16 | GraphQL Pentesting: Beginner's Guide to Advanced | GraphQL Pentesting: Beginner's Guide to Advanced |
| 2026-04-16 | The Complete GraphQL Security Guide: Fixing the 13 Most Common Vulnerabilities | The Complete GraphQL Security Guide: Fixing the 13 Most Common Vulnerabilities |
| 2026-04-16 | Abusing GraphQL Introspection: A Gateway for Recon and Exploitation | Abusing GraphQL Introspection: A Gateway for Recon and Exploitation |
| 2026-04-16 | Exploiting GraphQL: A Full-Spectrum Security Assessment | Exploiting GraphQL: A Full-Spectrum Security Assessment |
OSINT +35
| Date | Resource | Summary |
|---|---|---|
| 2026-04-19 | OSINT Framework: How to Build a Custom Maltego Transform | OSINT Framework: How to Build a Custom Maltego Transform |
| 2026-04-19 | Top 10 OSINT Tools, Products & Solutions — SocialLinks | Top 10 OSINT Tools, Products & Solutions — SocialLinks |
| 2026-04-19 | How to Use OSINT for Investigations — Moody's | How to Use OSINT for Investigations — Moody's |
| 2026-04-19 | OSINT Industries — Online Investigations Platform | OSINT Industries — Online Investigations Platform |
| 2026-04-19 | OSINT Tools Security Analysts Should Know for 2025 | OSINT Tools Security Analysts Should Know for 2025 |
| 2026-04-17 | Geolocation 101: image-based OSINT tips | Geolocation 101: image-based OSINT tips |
| 2026-04-17 | Image Analysis and Geolocation with OSINT (OSINT Combine) | Image Analysis and Geolocation with OSINT (OSINT Combine) |
| 2026-04-17 | spiderfoot: OSINT automation for threat intel (GitHub) | spiderfoot: OSINT automation for threat intel (GitHub) |
| 2026-04-17 | OSINT Framework: The Ultimate Guide for Ethical Hackers | OSINT Framework: The Ultimate Guide for Ethical Hackers |
| 2026-04-17 | Spiderfoot vs Maltego for OSINT Research Cases | Spiderfoot vs Maltego for OSINT Research Cases |
| 2026-04-17 | Operational Technology Discovery: ICS OSINT | Operational Technology Discovery: ICS OSINT |
| 2026-04-17 | Beyond Google: Navigating the Hidden Internet with Shodan and Censys | Beyond Google: Navigating the Hidden Internet with Shodan and Censys |
| 2026-04-17 | Comparative review: Shodan, ZoomEye, Netlas, Censys, FOFA | Comparative review: Shodan, ZoomEye, Netlas, Censys, FOFA |
| 2026-04-17 | OSINT Gathering Using Censys (Hackers Arise) | OSINT Gathering Using Censys (Hackers Arise) |
| 2026-04-17 | Top 5 OSINT Sources for Pentesting and Bug Bounties (Intel 471) | Top 5 OSINT Sources for Pentesting and Bug Bounties (Intel 471) |
| 2026-04-17 | sarenka: OSINT tool (Shodan/Censys) (GitHub) | sarenka: OSINT tool (Shodan/Censys) (GitHub) |
| 2026-04-17 | Domain and IP Investigation with OSINT: Complete Guide (OSINTBench) | Domain and IP Investigation with OSINT: Complete Guide (OSINTBench) |
| 2026-04-17 | OSINT Techniques & Tools (Imperva) | OSINT Techniques & Tools (Imperva) |
| 2026-04-17 | Top OSINT Tools For Dark Web (Brandefense) | Top OSINT Tools For Dark Web (Brandefense) |
| 2026-04-17 | OSINT Basics: What is Dark Web Intelligence (DARKInt)? | OSINT Basics: What is Dark Web Intelligence (DARKInt)? |
| 2026-04-17 | Top 15 OSINT Tools in 2025 (OSINT BYLE) | Top 15 OSINT Tools in 2025 (OSINT BYLE) |
| 2026-04-17 | OSINT 2025: New and updated digital investigative tools | OSINT 2025: New and updated digital investigative tools |
| 2026-04-17 | How to Use the OSINT Framework: Sources, Tools, Steps (BitSight) | How to Use the OSINT Framework: Sources, Tools, Steps (BitSight) |
| 2026-04-17 | OSINT Tools And Techniques (Neotas) | OSINT Tools And Techniques (Neotas) |
| 2026-04-17 | Complete OSINT Guide 2025: Find Anyone Online | Complete OSINT Guide 2025: Find Anyone Online |
| 2026-04-16 | I Participated in a Trace Labs CTF - Now I'm Hooked on OSINT | I Participated in a Trace Labs CTF - Now I'm Hooked on OSINT |
| 2026-04-16 | Recon Village - OSINT and Reconnaissance Village at DEF CON 33 | Recon Village - OSINT and Reconnaissance Village at DEF CON 33 |
| 2026-04-16 | A Beginner's Guide to OSINT Investigation with Maltego | A Beginner's Guide to OSINT Investigation with Maltego |
| 2026-04-16 | Social Media Intelligence (SOCMINT) in Modern Investigations | Social Media Intelligence (SOCMINT) in Modern Investigations |
| 2026-04-16 | OSINT Challenge in 30: Social Media Geolocation | OSINT Challenge in 30: Social Media Geolocation |
| 2026-04-16 | Trace Labs OSINT Educational Series | Trace Labs OSINT Educational Series |
| 2026-04-16 | OSINT Investigation Techniques for Missing Person Cases (Trace Labs) | OSINT Investigation Techniques for Missing Person Cases (Trace Labs) |
| 2026-04-16 | Automated OSINT Techniques for Digital Asset Discovery and Cyber Risk Assessment | Automated OSINT Techniques for Digital Asset Discovery and Cyber Risk Assessment |
| 2026-04-16 | Awesome OSINT - A Curated List of OSINT Resources | Awesome OSINT - A Curated List of OSINT Resources |
| 2026-04-16 | OSINT Techniques: Complete List for Investigators | OSINT Techniques: Complete List for Investigators |
IDOR +34
| Date | Resource | Summary |
|---|---|---|
| 2026-04-19 | IDOR Vulnerability Exploitation Guide — RedfoxSec | IDOR Vulnerability Exploitation Guide — RedfoxSec |
| 2026-04-19 | Bykea: IDOR on In-App Hardcoded Zombie — HackerOne | Bykea: IDOR on In-App Hardcoded Zombie — HackerOne |
| 2026-04-19 | IDOR Vulnerability — HackerOne Report 2633771 | IDOR Vulnerability — HackerOne Report 2633771 |
| 2026-04-19 | Top 235 IDOR Bug Bounty Reports | Top 235 IDOR Bug Bounty Reports |
| 2026-04-17 | From Reset to Takeover: IDOR in Password Recovery Systems | From Reset to Takeover: IDOR in Password Recovery Systems |
| 2026-04-17 | IDOR on Password Change to Full Account Takeover | IDOR on Password Change to Full Account Takeover |
| 2026-04-17 | Vulnlab: IDOR Writeup (Ikhlasdansantai) | Vulnlab: IDOR Writeup (Ikhlasdansantai) |
| 2026-04-17 | Critical IDOR Vulnerability Leads to User Information Disclosure | Critical IDOR Vulnerability Leads to User Information Disclosure |
| 2026-04-17 | API1:2019 - Broken object level authorization | API1:2019 - Broken object level authorization |
| 2026-04-17 | A Beginner's Guide to IDOR Testing Methodology | A Beginner's Guide to IDOR Testing Methodology |
| 2026-04-17 | Maximizing IDOR Detection with Burp Suite's Autorize | Maximizing IDOR Detection with Burp Suite's Autorize |
| 2026-04-17 | Manual and semi-automated testing for IDORs using Burp Suite | Manual and semi-automated testing for IDORs using Burp Suite |
| 2026-04-17 | Testing for IDORs (PortSwigger Burp docs) | Testing for IDORs (PortSwigger Burp docs) |
| 2026-04-17 | Account Takeover via IDOR (Deteact) | Account Takeover via IDOR (Deteact) |
| 2026-04-17 | IDOR Vulnerability Explained: Why IDOR Persists (Aikido) | IDOR Vulnerability Explained: Why IDOR Persists (Aikido) |
| 2026-04-17 | How I Found a Critical IDOR Leading to Full Account Takeover | How I Found a Critical IDOR Leading to Full Account Takeover |
| 2026-04-17 | Exploiting IDOR Vulnerabilities: Prevent Account Takeover | Exploiting IDOR Vulnerabilities: Prevent Account Takeover |
| 2026-04-17 | A Journey from IDOR to Account Takeover (Payatu) | A Journey from IDOR to Account Takeover (Payatu) |
| 2026-04-17 | Tackling IDOR on UUID based objects (PenTester Nepal) | Tackling IDOR on UUID based objects (PenTester Nepal) |
| 2026-04-17 | How an IDOR Vulnerability Led to User Profile Modification (HackerOne) | How an IDOR Vulnerability Led to User Profile Modification (HackerOne) |
| 2026-04-17 | IDOR: Admin-to-Owner Account Takeover via Password Reset (StudioCMS) | IDOR: Admin-to-Owner Account Takeover via Password Reset (StudioCMS) |
| 2026-04-17 | Exploiting UUIDs in Account Takeover: Pentester's Guide | Exploiting UUIDs in Account Takeover: Pentester's Guide |
| 2026-04-17 | Top 25 IDOR Bug Bounty Reports (Cristian Cornea) | Top 25 IDOR Bug Bounty Reports (Cristian Cornea) |
| 2026-04-17 | Day 39: IDOR report - How to write a good bounty write-up | Day 39: IDOR report - How to write a good bounty write-up |
| 2026-04-16 | Chamilo LMS IDOR Leads to Admin Privileges (CVE-2026-40291) | Chamilo LMS IDOR Leads to Admin Privileges (CVE-2026-40291) |
| 2026-04-16 | IDOR Vulnerabilities Explained: A Researcher's Guide to Authorization Flaws | IDOR Vulnerabilities Explained: A Researcher's Guide to Authorization Flaws |
| 2026-04-16 | From IDOR to Account Takeover (ATO) | From IDOR to Account Takeover (ATO) |
| 2026-04-16 | IDOR: A Tale of Account Takeover | IDOR: A Tale of Account Takeover |
| 2026-04-16 | IDOR Vulnerability Detection Through HTTP Traffic Analysis | IDOR Vulnerability Detection Through HTTP Traffic Analysis |
| 2026-04-16 | Broken Access Control: Advanced IDOR Exploitation | Broken Access Control: Advanced IDOR Exploitation |
| 2026-04-16 | IDOR Hunting with Burp Suite: A $1,000 Bug Bounty Case Study | IDOR Hunting with Burp Suite: A $1,000 Bug Bounty Case Study |
| 2026-04-16 | How to Find IDORs Like a Pro | How to Find IDORs Like a Pro |
| 2026-04-16 | Top HackerOne IDOR Reports | Top HackerOne IDOR Reports |
| 2026-04-16 | IDOR Vulnerabilities Masterclass: Complete Guide from Fundamentals to Advanced Exploitation | IDOR Vulnerabilities Masterclass: Complete Guide from Fundamentals to Advanced Exploitation |
Supply Chain +34
| Date | Resource | Summary |
|---|---|---|
| 2026-04-19 | Shai-Hulud: A Persistent Secret Leaking Campaign — GitGuardian | Shai-Hulud: A Persistent Secret Leaking Campaign — GitGuardian |
| 2026-04-19 | Defending Against npm Supply Chain Attacks — Splunk | Defending Against npm Supply Chain Attacks — Splunk |
| 2026-04-19 | Multiple Supply Chain Attacks against npm Packages — Red Hat | Multiple Supply Chain Attacks against npm Packages — Red Hat |
| 2026-04-19 | Shai-Hulud Malware: Second-Wave npm Supply Chain Attack | Shai-Hulud Malware: Second-Wave npm Supply Chain Attack |
| 2026-04-19 | CISA: Widespread Supply Chain Compromise Impacting npm Ecosystem | CISA: Widespread Supply Chain Compromise Impacting npm Ecosystem |
| 2026-04-17 | Closing the Chain: How to reduce SolarWinds/Log4j/XZ risk (arXiv) | Closing the Chain: How to reduce SolarWinds/Log4j/XZ risk (arXiv) |
| 2026-04-17 | SolarWinds Supply Chain Attack (Fortinet) | SolarWinds Supply Chain Attack (Fortinet) |
| 2026-04-17 | ossf/malicious-packages: Reports of malicious open source packages | ossf/malicious-packages: Reports of malicious open source packages |
| 2026-04-17 | 5 Examples of Dependency Confusion Attacks (Spectral) | 5 Examples of Dependency Confusion Attacks (Spectral) |
| 2026-04-17 | What Is a Dependency Confusion Attack? (Aqua Security) | What Is a Dependency Confusion Attack? (Aqua Security) |
| 2026-04-17 | Defender's Perspective: Dep Confusion and Typosquatting (SLSA) | Defender's Perspective: Dep Confusion and Typosquatting (SLSA) |
| 2026-04-17 | SBOMs in 2026: Some Love, Some Hate, Much Ambivalence | SBOMs in 2026: Some Love, Some Hate, Much Ambivalence |
| 2026-04-17 | Software Bill of Materials (SBOM) (CISA) | Software Bill of Materials (SBOM) (CISA) |
| 2026-04-17 | About SLSA (spec v1.2) | About SLSA (spec v1.2) |
| 2026-04-17 | What is a Software Bill of Materials (SBOM)? (Snyk) | What is a Software Bill of Materials (SBOM)? (Snyk) |
| 2026-04-17 | SBOM Literature Review (arXiv) | SBOM Literature Review (arXiv) |
| 2026-04-17 | SBOM + SLSA: Accelerating SBOM success with SLSA | SBOM + SLSA: Accelerating SBOM success with SLSA |
| 2026-04-17 | SLSA - Comprehensive Approach to Supply Chain Security (SBOM Observer) | SLSA - Comprehensive Approach to Supply Chain Security (SBOM Observer) |
| 2026-04-17 | Understanding SBOM: Transparency & Security in Supply Chains (Cycode) | Understanding SBOM: Transparency & Security in Supply Chains (Cycode) |
| 2026-04-17 | What We Know About the NPM Supply Chain Attack (Trend Micro) | What We Know About the NPM Supply Chain Attack (Trend Micro) |
| 2026-04-17 | New Supply Chain Malware Operation Hits npm and PyPI | New Supply Chain Malware Operation Hits npm and PyPI |
| 2026-04-17 | npm Supply Chain Attack: Debug, Chalk + 16 Packages Compromise (Upwind) | npm Supply Chain Attack: Debug, Chalk + 16 Packages Compromise (Upwind) |
| 2026-04-17 | Malicious PyPI, npm, Ruby Packages Exposed (The Hacker News) | Malicious PyPI, npm, Ruby Packages Exposed (The Hacker News) |
| 2026-04-17 | A Closer Look at Software Supply Chain Attacks 2025 (Xygeni) | A Closer Look at Software Supply Chain Attacks 2025 (Xygeni) |
| 2026-04-16 | Learnings from Recent npm Supply Chain Compromises - Datadog | Learnings from Recent npm Supply Chain Compromises - Datadog |
| 2026-04-16 | Inside the Axios Supply Chain Compromise - Elastic Security Labs | Inside the Axios Supply Chain Compromise - Elastic Security Labs |
| 2026-04-16 | Lockfile Poisoning: Introducing Malware in Supply Chain - SafeDep | Lockfile Poisoning: Introducing Malware in Supply Chain - SafeDep |
| 2026-04-16 | Shai-Hulud 2.0: Most Aggressive NPM Supply Chain Attack of 2025 - Check Point | Shai-Hulud 2.0: Most Aggressive NPM Supply Chain Attack of 2025 - Check Point |
| 2026-04-16 | Supply Chain Security: Sigstore and Cosign - GitGuardian | Supply Chain Security: Sigstore and Cosign - GitGuardian |
| 2026-04-16 | GuardDog: CLI Tool to Identify Malicious PyPI and npm Packages | GuardDog: CLI Tool to Identify Malicious PyPI and npm Packages |
| 2026-04-16 | tj-actions Supply Chain Attack (CVE-2025-30066) - Sysdig | tj-actions Supply Chain Attack (CVE-2025-30066) - Sysdig |
| 2026-04-16 | tj-actions/changed-files Compromised - Semgrep | tj-actions/changed-files Compromised - Semgrep |
| 2026-04-16 | Most Notable Supply Chain Attacks of 2025 - Kaspersky | Most Notable Supply Chain Attacks of 2025 - Kaspersky |
| 2026-04-16 | GitHub Actions Supply Chain Attacks: tj-actions and reviewdog - Hunters | GitHub Actions Supply Chain Attacks: tj-actions and reviewdog - Hunters |
Deserialization +32
| Date | Resource | Summary |
|---|---|---|
| 2026-04-19 | IBM webMethods Integration CVE-2025-36072: Deserialization RCE | IBM webMethods Integration CVE-2025-36072: Deserialization RCE |
| 2026-04-19 | Deserialization Vulnerability — Exploit-DB Paper | Deserialization Vulnerability — Exploit-DB Paper |
| 2026-04-19 | Cisco ISE Insecure Java Deserialization — Cisco Docs | Cisco ISE Insecure Java Deserialization — Cisco Docs |
| 2026-04-19 | Insecure Deserialization Vulnerabilities — Acunetix | Insecure Deserialization Vulnerabilities — Acunetix |
| 2026-04-19 | Cisco ISE Insecure Java Deserialization (CVE-2025-20124) | Cisco ISE Insecure Java Deserialization (CVE-2025-20124) |
| 2026-04-17 | CVE-2023-34040: Spring-Kafka Java Deserialization | CVE-2023-34040: Spring-Kafka Java Deserialization |
| 2026-04-17 | Apache Struts vulnerability leads to RCE | Apache Struts vulnerability leads to RCE |
| 2026-04-17 | Jackson deserialization vulnerability exploit (3 gadgets, GitHub) | Jackson deserialization vulnerability exploit (3 gadgets, GitHub) |
| 2026-04-17 | Apache Struts2 Code Execution Exploit (Infopercept) | Apache Struts2 Code Execution Exploit (Infopercept) |
| 2026-04-17 | Spring-web Java Deserialization: CVE-2016-1000027 (Contrast) | Spring-web Java Deserialization: CVE-2016-1000027 (Contrast) |
| 2026-04-17 | Exploiting Apache Struts: Writing Better Detections (Gigamon) | Exploiting Apache Struts: Writing Better Detections (Gigamon) |
| 2026-04-17 | Friday the 13th JSON Attacks (Black Hat) | Friday the 13th JSON Attacks (Black Hat) |
| 2026-04-17 | PayloadsAllTheThings: Insecure Deserialization DotNET | PayloadsAllTheThings: Insecure Deserialization DotNET |
| 2026-04-17 | Basic .Net deserialization ObjectDataProvider gadget (HackTricks) | Basic .Net deserialization ObjectDataProvider gadget (HackTricks) |
| 2026-04-17 | Python-Pickle-RCE-Exploit + vulnerable Flask App (GitHub) | Python-Pickle-RCE-Exploit + vulnerable Flask App (GitHub) |
| 2026-04-17 | SOUR PICKLE: Insecure Deserialization with Python Pickle | SOUR PICKLE: Insecure Deserialization with Python Pickle |
| 2026-04-17 | PayloadsAllTheThings: Insecure Deserialization Python | PayloadsAllTheThings: Insecure Deserialization Python |
| 2026-04-17 | Pickle Code Execution Exploitation (Dhound) | Pickle Code Execution Exploitation (Dhound) |
| 2026-04-17 | Python-socketio: Pickle deserialization RCE advisory | Python-socketio: Pickle deserialization RCE advisory |
| 2026-04-17 | Exploiting deserialization in recent Java versions (OWASP Stuttgart) | Exploiting deserialization in recent Java versions (OWASP Stuttgart) |
| 2026-04-17 | Automated Discovery of Deserialization Gadget Chains (Black Hat) | Automated Discovery of Deserialization Gadget Chains (Black Hat) |
| 2026-04-17 | Prevent insecure deserialization attacks (Veracode) | Prevent insecure deserialization attacks (Veracode) |
| 2026-04-17 | Understanding Insecure Deserialization: Risks and Mitigations | Understanding Insecure Deserialization: Risks and Mitigations |
| 2026-04-17 | Bug Bounty Hunting: Insecure Deserialization | Bug Bounty Hunting: Insecure Deserialization |
| 2026-04-17 | Insecure Deserialization - Attack Technique (vuln.today) | Insecure Deserialization - Attack Technique (vuln.today) |
| 2026-04-16 | Depickling, Gadgets, and Chains: The Exploit That Unraveled Equifax | Depickling, Gadgets, and Chains: The Exploit That Unraveled Equifax |
| 2026-04-16 | How to Exploit PHAR Deserialization Vulnerability | How to Exploit PHAR Deserialization Vulnerability |
| 2026-04-16 | Insecure Reflection Practices in Java and C# | Insecure Reflection Practices in Java and C# |
| 2026-04-16 | Java Deserialization Tricks - Synacktiv | Java Deserialization Tricks - Synacktiv |
| 2026-04-16 | Deep Dive into .NET ViewState Deserialization | Deep Dive into .NET ViewState Deserialization |
| 2026-04-16 | ViewState Deserialization Zero-Day in Sitecore (CVE-2025-53690) | ViewState Deserialization Zero-Day in Sitecore (CVE-2025-53690) |
| 2026-04-16 | The Art of Hide and Seek: Pickle-Based Model Supply Chain Poisoning | The Art of Hide and Seek: Pickle-Based Model Supply Chain Poisoning |
Authentication +32
| Date | Resource | Summary |
|---|---|---|
| 2026-04-19 | Bypassing MFA with OAuth Abuse: Pentesting SSO Flows | Bypassing MFA with OAuth Abuse: Pentesting SSO Flows |
| 2026-04-19 | SSO Protocol Security: Critical Vulnerabilities in SAML, OAuth, OIDC, JWT (2025) | SSO Protocol Security: Critical Vulnerabilities in SAML, OAuth, OIDC, JWT (2025) |
| 2026-04-19 | The Art of Breaking OAuth: Real-World Exploits and Misuses | The Art of Breaking OAuth: Real-World Exploits and Misuses |
| 2026-04-19 | OAuth2-Proxy Authentication Bypass (CVE-2025-54576) | OAuth2-Proxy Authentication Bypass (CVE-2025-54576) |
| 2026-04-19 | OAuth SSO WordPress Plugin JWT Bypass (CVE-2025-9485) | OAuth SSO WordPress Plugin JWT Bypass (CVE-2025-9485) |
| 2026-04-17 | WebAuthn: Complete Guide to Passwordless, FIDO2, Passkeys (TerraZone) | WebAuthn: Complete Guide to Passwordless, FIDO2, Passkeys (TerraZone) |
| 2026-04-17 | What is WebAuthn Standard? Guide to WebAuthn Protocol & API | What is WebAuthn Standard? Guide to WebAuthn Protocol & API |
| 2026-04-17 | Navigating the New Wave of MFA Bypass Attacks in 2025 | Navigating the New Wave of MFA Bypass Attacks in 2025 |
| 2026-04-17 | Broken authentication: 7 Advanced ways of bypassing 2-FA (Intigriti) | Broken authentication: 7 Advanced ways of bypassing 2-FA (Intigriti) |
| 2026-04-17 | Vulnerabilities in multi-factor authentication (PortSwigger) | Vulnerabilities in multi-factor authentication (PortSwigger) |
| 2026-04-17 | Two-Factor Authentication (2FA): Bypass Scenarios (DeepStrike) | Two-Factor Authentication (2FA): Bypass Scenarios (DeepStrike) |
| 2026-04-17 | Hacking SAML - Vickie Li | Hacking SAML - Vickie Li |
| 2026-04-17 | SSO Bypass: How Attackers Circumvent Single Sign-On (Obsidian) | SSO Bypass: How Attackers Circumvent Single Sign-On (Obsidian) |
| 2026-04-17 | CVE-2020-2021 PAN-OS: Authentication Bypass in SAML | CVE-2020-2021 PAN-OS: Authentication Bypass in SAML |
| 2026-04-17 | HackerOne Report #812064: SAML authentication bypass (Rocket.Chat) | HackerOne Report #812064: SAML authentication bypass (Rocket.Chat) |
| 2026-04-17 | SAML Security (OWASP Cheat Sheet) | SAML Security (OWASP Cheat Sheet) |
| 2026-04-17 | Fun with SAML SSO vulnerabilities and footguns (WorkOS) | Fun with SAML SSO vulnerabilities and footguns (WorkOS) |
| 2026-04-17 | OAuth 2.0 Common Security Flaws and Prevention (APIsec) | OAuth 2.0 Common Security Flaws and Prevention (APIsec) |
| 2026-04-17 | Top 10 OAuth 2.0 Hacking Techniques Part 2 | Top 10 OAuth 2.0 Hacking Techniques Part 2 |
| 2026-04-17 | Vulnerable-OAuth-2.0-Applications (GitHub) | Vulnerable-OAuth-2.0-Applications (GitHub) |
| 2026-04-17 | OAuth Vulnerabilities Part II (Bug Bounty 2k25) | OAuth Vulnerabilities Part II (Bug Bounty 2k25) |
| 2026-04-17 | Bug-Bounty-Methodology: 2FA testing | Bug-Bounty-Methodology: 2FA testing |
| 2026-04-17 | Bug Bounty: Authentication Testing - Brute Force to Bypass | Bug Bounty: Authentication Testing - Brute Force to Bypass |
| 2026-04-17 | HackerOne Report #209008: Authentication Bypass - Automattic | HackerOne Report #209008: Authentication Bypass - Automattic |
| 2026-04-17 | Web Security Bug Bounty: Bypassing Authentication via Logical Flaw | Web Security Bug Bounty: Bypassing Authentication via Logical Flaw |
| 2026-04-16 | This OAuth Bug Earned Me $$$$: Account Takeover via Identity Injection | This OAuth Bug Earned Me $$$$: Account Takeover via Identity Injection |
| 2026-04-16 | Session Management Vulnerabilities: What Developers Get Wrong | Session Management Vulnerabilities: What Developers Get Wrong |
| 2026-04-16 | Bypassing the Protections: MFA Bypass Techniques | Bypassing the Protections: MFA Bypass Techniques |
| 2026-04-16 | Session Hijacking in 2025: Techniques, Attack Examples and Defenses | Session Hijacking in 2025: Techniques, Attack Examples and Defenses |
| 2026-04-16 | The $12,000 2FA Bypass - So Simple, Yet So Critical | The $12,000 2FA Bypass - So Simple, Yet So Critical |
| 2026-04-16 | Race Condition Authentication Bypass: Full Account Takeover | Race Condition Authentication Bypass: Full Account Takeover |
| 2026-04-16 | Token-Based Attacks: How Attackers Bypass MFA | Token-Based Attacks: How Attackers Bypass MFA |
Secrets +31
| Date | Resource | Summary |
|---|---|---|
| 2026-04-19 | Compromised IAM Credentials Power Large AWS Crypto Mining Campaign | Compromised IAM Credentials Power Large AWS Crypto Mining Campaign |
| 2026-04-19 | Pre-Commit Hooks for Secret Detection: Setup in 10 Minutes | Pre-Commit Hooks for Secret Detection: Setup in 10 Minutes |
| 2026-04-19 | Understanding Your Organization's Exposure to Secret Leaks — GitHub | Understanding Your Organization's Exposure to Secret Leaks — GitHub |
| 2026-04-19 | Exposed Developer Secrets Surge: AI Drives 34% Increase in 2025 | Exposed Developer Secrets Surge: AI Drives 34% Increase in 2025 |
| 2026-04-19 | GitHub Found 39M Secret Leaks in 2024 — The GitHub Blog | GitHub Found 39M Secret Leaks in 2024 — The GitHub Blog |
| 2026-04-17 | Non-human identities: What they are and how to secure them (Netwrix) | Non-human identities: What they are and how to secure them (Netwrix) |
| 2026-04-17 | Top non-human identity (NHI) platforms of 2025 (Doppler) | Top non-human identity (NHI) platforms of 2025 (Doppler) |
| 2026-04-17 | What Are Non-Human Identities? Complete NHI Security Guide 2025 | What Are Non-Human Identities? Complete NHI Security Guide 2025 |
| 2026-04-17 | TruffleHog: Deep Dive on Secret Management (Jit) | TruffleHog: Deep Dive on Secret Management (Jit) |
| 2026-04-17 | TruffleHog Open Source v3 vs GitGuardian | TruffleHog Open Source v3 vs GitGuardian |
| 2026-04-17 | git-secret-scanner: Find secrets with TruffleHog & Gitleaks | git-secret-scanner: Find secrets with TruffleHog & Gitleaks |
| 2026-04-17 | Gitleaks vs TruffleHog 2026 Benchmarks (AppSec Santa) | Gitleaks vs TruffleHog 2026 Benchmarks (AppSec Santa) |
| 2026-04-17 | Rafter: detect-secrets vs gitleaks vs TruffleHog | Rafter: detect-secrets vs gitleaks vs TruffleHog |
| 2026-04-17 | SEC02-BP03 Store and use secrets securely (AWS Well-Architected) | SEC02-BP03 Store and use secrets securely (AWS Well-Architected) |
| 2026-04-17 | AWS Secrets Manager: Secure Credential Storage & Best Practices | AWS Secrets Manager: Secure Credential Storage & Best Practices |
| 2026-04-17 | Practical steps to minimize key exposure using AWS Security (AWS) | Practical steps to minimize key exposure using AWS Security (AWS) |
| 2026-04-17 | AWS API Keys / Secrets / Tokens Exposure Remediation | AWS API Keys / Secrets / Tokens Exposure Remediation |
| 2026-04-17 | Integrating HashiCorp Vault with Kubernetes for Secrets Mgmt | Integrating HashiCorp Vault with Kubernetes for Secrets Mgmt |
| 2026-04-17 | HashiCorp Vault Kubernetes: The Definitive Guide (Plural) | HashiCorp Vault Kubernetes: The Definitive Guide (Plural) |
| 2026-04-17 | A Hands-On Guide to Vault in Kubernetes | A Hands-On Guide to Vault in Kubernetes |
| 2026-04-17 | Securing Kubernetes Secrets with HashiCorp Vault (InfraCloud) | Securing Kubernetes Secrets with HashiCorp Vault (InfraCloud) |
| 2026-04-17 | Manage Kubernetes native secrets with Vault Secrets Operator | Manage Kubernetes native secrets with Vault Secrets Operator |
| 2026-04-17 | Secret detection (GitLab Docs) | Secret detection (GitLab Docs) |
| 2026-04-17 | Find secrets with GitHub secret risk assessment | Find secrets with GitHub secret risk assessment |
| 2026-04-17 | About secret scanning (GitHub Docs) | About secret scanning (GitHub Docs) |
| 2026-04-16 | Do Not Use Secrets in Environment Variables | Do Not Use Secrets in Environment Variables |
| 2026-04-16 | Environment Variables Don't Keep Secrets | Environment Variables Don't Keep Secrets |
| 2026-04-16 | From .env to Leakage: Mishandling of Secrets by Coding Agents | From .env to Leakage: Mishandling of Secrets by Coding Agents |
| 2026-04-16 | Secret Detection in Application Security | Secret Detection in Application Security |
| 2026-04-16 | 29 Million Leaked Secrets: How AI Coding Tools Are Making It Worse | 29 Million Leaked Secrets: How AI Coding Tools Are Making It Worse |
| 2026-04-16 | The State of Secrets Sprawl 2026 - GitGuardian Annual Report | The State of Secrets Sprawl 2026 - GitGuardian Annual Report |
SSRF +24
XSS +16
| Date | Resource | Summary |
|---|---|---|
| 2026-04-19 | Bypassing Signature-Based XSS Filters: Modifying HTML | Bypassing Signature-Based XSS Filters: Modifying HTML |
| 2026-04-19 | XSS Bypass Techniques — Cyber Gita | XSS Bypass Techniques — Cyber Gita |
| 2026-04-19 | Advanced XSS Filter Bypass Methods Using Payload Splitting | Advanced XSS Filter Bypass Methods Using Payload Splitting |
| 2026-04-19 | XSS Payload Bypass Technique: A Practical Guide | XSS Payload Bypass Technique: A Practical Guide |
| 2026-04-19 | Intigriti July 2025 XSS Challenge — Jorian Woltjer | Intigriti July 2025 XSS Challenge — Jorian Woltjer |
| 2026-04-17 | Multiple Cross-Site Scripting (XSS) Vulnerabilities in Mailcow | Multiple Cross-Site Scripting (XSS) Vulnerabilities in Mailcow https://ift.tt/ufEgtyJ |
| 2026-04-16 | Prototype Pollution Primer for Pentesters and Programmers | Prototype Pollution Primer for Pentesters and Programmers |
| 2026-04-16 | Bypassing DOMPurify with Good Old XML | Bypassing DOMPurify with Good Old XML |
| 2026-04-16 | Exploring the DOMPurify Library: Bypasses and Fixes | Exploring the DOMPurify Library: Bypasses and Fixes |
| 2026-04-16 | Content Security Policy Bypass Techniques Collection | Content Security Policy Bypass Techniques Collection |
| 2026-04-16 | CSPBypass: Tool to Bypass Content Security Policies | CSPBypass: Tool to Bypass Content Security Policies |
| 2026-04-16 | PayloadsAllTheThings: XSS Injection Cheat Sheet | PayloadsAllTheThings: XSS Injection Cheat Sheet |
| 2026-04-16 | Advanced XSS Exploitation: Bypassing CSP and DOM Sanitization | Advanced XSS Exploitation: Bypassing CSP and DOM Sanitization |
| 2026-04-16 | CVE-2025-63418: Weaponizing the Browser Console - DOM-based XSS Deep Dive | CVE-2025-63418: Weaponizing the Browser Console - DOM-based XSS Deep Dive |
| 2026-04-16 | bypassXSS: A Curated Collection of Advanced XSS Bypass Techniques | bypassXSS: A Curated Collection of Advanced XSS Bypass Techniques |
| 2026-04-16 | Cross-Site Scripting (XSS) Practical CTF Guide | Cross-Site Scripting (XSS) Practical CTF Guide |
Mobile +15
| Date | Resource | Summary |
|---|---|---|
| 2026-04-19 | Zero-Day Vulnerabilities in Apple WebKit — CSA Singapore | Zero-Day Vulnerabilities in Apple WebKit — CSA Singapore |
| 2026-04-19 | Update Apple Devices: Actively Exploited CVE-2025-14174 & CVE-2025-43529 | Update Apple Devices: Actively Exploited CVE-2025-14174 & CVE-2025-43529 |
| 2026-04-19 | CVE-2025-14174: Apple WebKit Memory Corruption Zero-Day | CVE-2025-14174: Apple WebKit Memory Corruption Zero-Day |
| 2026-04-19 | Two Serious Vulnerabilities in Latest Android Security Update | Two Serious Vulnerabilities in Latest Android Security Update |
| 2026-04-19 | LANDFALL: New Commercial-Grade Android Spyware (CVE-2025-21042) | LANDFALL: New Commercial-Grade Android Spyware (CVE-2025-21042) |
| 2026-04-16 | Awesome Android Reverse Engineering: Curated List | Awesome Android Reverse Engineering: Curated List |
| 2026-04-16 | Android App Reverse Engineering 101 | Android App Reverse Engineering 101 |
| 2026-04-16 | Exploiting Android Fingerprint Authentication | Exploiting Android Fingerprint Authentication |
| 2026-04-16 | Android Keystore Pitfalls and Best Practices | Android Keystore Pitfalls and Best Practices |
| 2026-04-16 | Frida's Impact on Mobile Security and How to Fight Back | Frida's Impact on Mobile Security and How to Fight Back |
| 2026-04-16 | From an Android Hook to RCE: $5000 Bounty | From an Android Hook to RCE: $5000 Bounty |
| 2026-04-16 | iOS Reverse Engineering: Defeating Anti-Debug and Extracting Hidden Flag | iOS Reverse Engineering: Defeating Anti-Debug and Extracting Hidden Flag |
| 2026-04-16 | DarkSword iOS Exploit Chain Adopted by Multiple Threat Actors - Google | DarkSword iOS Exploit Chain Adopted by Multiple Threat Actors - Google |
| 2026-04-16 | Inside DarkSword: A New iOS Exploit Kit - iVerify | Inside DarkSword: A New iOS Exploit Kit - iVerify |
| 2026-04-16 | DarkSword iOS Exploit Kit: 6 Flaws and 3 Zero-Days for Full Takeover | DarkSword iOS Exploit Kit: 6 Flaws and 3 Zero-Days for Full Takeover |
API Security +15
| Date | Resource | Summary |
|---|---|---|
| 2026-04-19 | BOLA API Attack & Prevention — StackHawk | BOLA API Attack & Prevention — StackHawk |
| 2026-04-19 | Broken Object-Level Authorization (BOLA): What It Is and How to Prevent It | Broken Object-Level Authorization (BOLA): What It Is and How to Prevent It |
| 2026-04-19 | OWASP Top 10 API Security Risks and How to Mitigate Them — Pynt | OWASP Top 10 API Security Risks and How to Mitigate Them — Pynt |
| 2026-04-19 | OWASP Top 10 2025: Latest Changes and Enhancements | OWASP Top 10 2025: Latest Changes and Enhancements |
| 2026-04-19 | OWASP API Security Top 10 Vulnerabilities — 2025 | OWASP API Security Top 10 Vulnerabilities — 2025 |
| 2026-04-16 | MCP Access Control: OPA vs Cedar - Natoma | MCP Access Control: OPA vs Cedar - Natoma |
| 2026-04-16 | Stateful REST API Fuzzing with RESTler | Stateful REST API Fuzzing with RESTler |
| 2026-04-16 | Inside Modern API Attacks: 2026 API ThreatStats Report - Wallarm | Inside Modern API Attacks: 2026 API ThreatStats Report - Wallarm |
| 2026-04-16 | OWASP API Security Testing Framework | OWASP API Security Testing Framework |
| 2026-04-16 | Kong API Gateway Misconfigurations Case Study - Trend Micro | Kong API Gateway Misconfigurations Case Study - Trend Micro |
| 2026-04-16 | API Security Testing: Tools and Techniques - API7.ai | API Security Testing: Tools and Techniques - API7.ai |
| 2026-04-16 | BOLA and BFLA: The API Vulnerabilities That Silently Expose Data | BOLA and BFLA: The API Vulnerabilities That Silently Expose Data |
| 2026-04-16 | API Penetration Testing: Complete Guide | API Penetration Testing: Complete Guide |
| 2026-04-16 | How to Protect APIs from OWASP Authorization Risks: BOLA, BOPLA and BFLA - 42Crunch | How to Protect APIs from OWASP Authorization Risks: BOLA, BOPLA and BFLA - 42Crunch |
| 2026-04-16 | Securing the Gates: Mastering BOLA and BFLA in API Security | Securing the Gates: Mastering BOLA and BFLA in API Security |
AI +15
| Date | Resource | Summary |
|---|---|---|
| 2026-04-19 | MCP Tool Poisoning — How It Works & How To Fight It | MCP Tool Poisoning — How It Works & How To Fight It |
| 2026-04-19 | Model Context Protocol Has Prompt Injection Security Problems | Model Context Protocol Has Prompt Injection Security Problems |
| 2026-04-19 | Vulnerability of LLMs to Prompt Injection in Medical Advice — JAMA | Vulnerability of LLMs to Prompt Injection in Medical Advice — JAMA |
| 2026-04-19 | Prompt Injection Attack Against LLM-Integrated Applications — arXiv | Prompt Injection Attack Against LLM-Integrated Applications — arXiv |
| 2026-04-19 | Prompt Injection Attacks in LLMs and AI Agent Systems: A Comprehensive Review | Prompt Injection Attacks in LLMs and AI Agent Systems: A Comprehensive Review |
| 2026-04-16 | Bypassing LLM Guardrails: Evasion Attacks against Prompt Injection Detection | Bypassing LLM Guardrails: Evasion Attacks against Prompt Injection Detection |
| 2026-04-16 | EchoGram: Bypassing AI Guardrails via Token Flip Attacks - HiddenLayer | EchoGram: Bypassing AI Guardrails via Token Flip Attacks - HiddenLayer |
| 2026-04-16 | MCP Security: Tool Poisoning Attacks - Invariant Labs | MCP Security: Tool Poisoning Attacks - Invariant Labs |
| 2026-04-16 | Poison Everywhere: No Output from Your MCP Server Is Safe - CyberArk | Poison Everywhere: No Output from Your MCP Server Is Safe - CyberArk |
| 2026-04-16 | The Embedded Threat in Your LLM: Poisoning RAG Pipelines | The Embedded Threat in Your LLM: Poisoning RAG Pipelines |
| 2026-04-16 | EchoLeak: First Real-World Zero-Click Prompt Injection Exploit | EchoLeak: First Real-World Zero-Click Prompt Injection Exploit |
| 2026-04-16 | When LLMs Autonomously Attack - CMU Research | When LLMs Autonomously Attack - CMU Research |
| 2026-04-16 | The Dark Side of LLMs: Agent-based Attacks for Complete Computer Takeover | The Dark Side of LLMs: Agent-based Attacks for Complete Computer Takeover |
| 2026-04-16 | MCP Tools: Attack Vectors and Defense Recommendations - Elastic Security Labs | MCP Tools: Attack Vectors and Defense Recommendations - Elastic Security Labs |
| 2026-04-16 | MCP Safety Audit: LLMs with MCP Allow Major Security Exploits | MCP Safety Audit: LLMs with MCP Allow Major Security Exploits |
AuthZ +15
| Date | Resource | Summary |
|---|---|---|
| 2026-04-19 | Broken Access Control: The Quiet Killer in Web Applications | Broken Access Control: The Quiet Killer in Web Applications |
| 2026-04-19 | OWASP Top 10 2025: IAAA Failures TryHackMe Writeup | OWASP Top 10 2025: IAAA Failures TryHackMe Writeup |
| 2026-04-19 | Broken Access Control: The Silent Web Vulnerability | Broken Access Control: The Silent Web Vulnerability |
| 2026-04-19 | Broken Access Control: The 40% Surge in 2025 | Broken Access Control: The 40% Surge in 2025 |
| 2026-04-19 | OWASP Top 10 2025 — A01 Broken Access Control | OWASP Top 10 2025 — A01 Broken Access Control |
| 2026-04-16 | Enhancing OAuth 2.0 Security with PKCE: Deep Dive | Enhancing OAuth 2.0 Security with PKCE: Deep Dive |
| 2026-04-16 | Attacks via OAuth Authorization Code Injection | Attacks via OAuth Authorization Code Injection |
| 2026-04-16 | Security Benchmarking Authorization Policy Engines: Rego, Cedar, OpenFGA | Security Benchmarking Authorization Policy Engines: Rego, Cedar, OpenFGA |
| 2026-04-16 | Privilege Escalation by JWT Token Manipulation | Privilege Escalation by JWT Token Manipulation |
| 2026-04-16 | JWTs Under the Microscope: Exploiting Auth Weaknesses - Traceable | JWTs Under the Microscope: Exploiting Auth Weaknesses - Traceable |
| 2026-04-16 | Privilege Escalation via IDOR and ACL Bypass in SaaS | Privilege Escalation via IDOR and ACL Bypass in SaaS |
| 2026-04-16 | Organization Takeover via Privilege Escalation (IDOR) | Organization Takeover via Privilege Escalation (IDOR) |
| 2026-04-16 | Horizontal Privilege Escalation via IDOR | Horizontal Privilege Escalation via IDOR |
| 2026-04-16 | Fine-Grained Authorization: Technical Guide for Microservices | Fine-Grained Authorization: Technical Guide for Microservices |
| 2026-04-16 | RBAC vs ABAC vs ReBAC: How to Choose Access Control Models | RBAC vs ABAC vs ReBAC: How to Choose Access Control Models |
Burp Suite +15
| Date | Resource | Summary |
|---|---|---|
| 2026-04-19 | Pentest-Mapper: Burp Extension for Pentesters & Bug Bounty | Pentest-Mapper: Burp Extension for Pentesters & Bug Bounty |
| 2026-04-19 | Burp Suite Extension: Copy For — Black Hills InfoSec | Burp Suite Extension: Copy For — Black Hills InfoSec |
| 2026-04-19 | Burp AI — PortSwigger | Burp AI — PortSwigger |
| 2026-04-19 | Pentest Mapper: Burp Extension for Application Pentesting | Pentest Mapper: Burp Extension for Application Pentesting |
| 2026-04-19 | Pentest Mapper — PortSwigger BApp Store | Pentest Mapper — PortSwigger BApp Store |
| 2026-04-16 | Burp Suite Professional Testing Handbook | Burp Suite Professional Testing Handbook |
| 2026-04-16 | Bambdas Collection for Burp Suite Professional and Community | Bambdas Collection for Burp Suite Professional and Community |
| 2026-04-16 | Turbo Intruder: Embracing the Billion-Request Attack | Turbo Intruder: Embracing the Billion-Request Attack |
| 2026-04-16 | BurpSuite for Pentester - Vulnerability Hunting Cheatsheet | BurpSuite for Pentester - Vulnerability Hunting Cheatsheet |
| 2026-04-16 | Weaponize Your Burp - Bug Bounty Hunting Automation | Weaponize Your Burp - Bug Bounty Hunting Automation |
| 2026-04-16 | Smart Automation with Burp Suite - YesWeHack | Smart Automation with Burp Suite - YesWeHack |
| 2026-04-16 | A Guide to Build Burp Suite Extensions Using Montoya API and Java | A Guide to Build Burp Suite Extensions Using Montoya API and Java |
| 2026-04-16 | Power Up Pen Tests: Create Burp Suite Extensions with Montoya API | Power Up Pen Tests: Create Burp Suite Extensions with Montoya API |
| 2026-04-16 | Burp Suite Extensions - Overview and Introduction with Kotlin | Burp Suite Extensions - Overview and Introduction with Kotlin |
| 2026-04-16 | Creating Burp Extensions: A Beginner's Guide - Black Hills InfoSec | Creating Burp Extensions: A Beginner's Guide - Black Hills InfoSec |
SQLi +15
| Date | Resource | Summary |
|---|---|---|
| 2026-04-19 | Unauthenticated SQL Injection in GUI — Fortinet PSIRT | Unauthenticated SQL Injection in GUI — Fortinet PSIRT |
| 2026-04-19 | CVE-2025-1094 WebSocket and SQL Injection Exploit Script | CVE-2025-1094 WebSocket and SQL Injection Exploit Script |
| 2026-04-19 | CVE-2025-1094: PostgreSQL psql SQL Injection (Fixed) — Rapid7 | CVE-2025-1094: PostgreSQL psql SQL Injection (Fixed) — Rapid7 |
| 2026-04-19 | PostgreSQL CVE-2025-1094: Quoting APIs SQL Injection | PostgreSQL CVE-2025-1094: Quoting APIs SQL Injection |
| 2026-04-19 | CVE-2025-26794: Blind SQL Injection in Exim 4.98 — Writeup | CVE-2025-26794: Blind SQL Injection in Exim 4.98 — Writeup |
| 2026-04-16 | SQLMap Cheat Sheet: Commands, Options, and Advanced Features | SQLMap Cheat Sheet: Commands, Options, and Advanced Features |
| 2026-04-16 | Identifying SQL Injections in a GraphQL API | Identifying SQL Injections in a GraphQL API |
| 2026-04-16 | SQL Injection Cheat Sheet - Invicti | SQL Injection Cheat Sheet - Invicti |
| 2026-04-16 | Exploiting Time-Based SQL Injections: Data Exfiltration | Exploiting Time-Based SQL Injections: Data Exfiltration |
| 2026-04-16 | Second-Order SQL Injection with Stored Procedures and DNS-Based Egress | Second-Order SQL Injection with Stored Procedures and DNS-Based Egress |
| 2026-04-16 | When the Database Won't Talk: A Deep Dive into Blind SQLi | When the Database Won't Talk: A Deep Dive into Blind SQLi |
| 2026-04-16 | Advanced Boolean-Based SQLi Filter Bypass Techniques | Advanced Boolean-Based SQLi Filter Bypass Techniques |
| 2026-04-16 | WAF Bypass Techniques for SQL Injection | WAF Bypass Techniques for SQL Injection |
| 2026-04-16 | Exploiting Second-Order SQL Injection to Retrieve the Flag | Exploiting Second-Order SQL Injection to Retrieve the Flag |
| 2026-04-16 | Exploiting SQL Injection Vulnerability - Bug Bounty Writeup | Exploiting SQL Injection Vulnerability - Bug Bounty Writeup |
XXE +15
| Date | Resource | Summary |
|---|---|---|
| 2026-04-19 | IBM Business Automation Workflow XXE (CVE-2025-13096) | IBM Business Automation Workflow XXE (CVE-2025-13096) |
| 2026-04-19 | XXE Vulnerability Guide 2025: How XML Attacks Still Threaten | XXE Vulnerability Guide 2025: How XML Attacks Still Threaten |
| 2026-04-19 | XXE Injection in langchain-community (CVE-2025-6984) | XXE Injection in langchain-community (CVE-2025-6984) |
| 2026-04-19 | Critical Apache Tika CVE-2025-66516: XXE Vulnerability | Critical Apache Tika CVE-2025-66516: XXE Vulnerability |
| 2026-04-19 | XXE in GeoServer WFS Service (CVE-2025-30220) | XXE in GeoServer WFS Service (CVE-2025-30220) |
| 2026-04-16 | XXElixir: Tool for Testing XXE via XLSX File Upload Poisoning | XXElixir: Tool for Testing XXE via XLSX File Upload Poisoning |
| 2026-04-16 | Exploiting XXE via File Uploads (SVG, XLSX, DOCX) | Exploiting XXE via File Uploads (SVG, XLSX, DOCX) |
| 2026-04-16 | XXE-OOB-Exfiltrator: Multi-line Content Exfiltration via External DTD | XXE-OOB-Exfiltrator: Multi-line Content Exfiltration via External DTD |
| 2026-04-16 | Blind XXE Attacks: Out of Band Interaction Techniques to Exfiltrate Data | Blind XXE Attacks: Out of Band Interaction Techniques to Exfiltrate Data |
| 2026-04-16 | Exploiting Out-Of-Band XXE on Wildfire | Exploiting Out-Of-Band XXE on Wildfire |
| 2026-04-16 | Out-of-Band XML External Entity (OOB XXE) | Out-of-Band XML External Entity (OOB XXE) |
| 2026-04-16 | Top HackerOne XXE Reports | Top HackerOne XXE Reports |
| 2026-04-16 | How to Find XXE Bugs: Severe, Missed, and Misunderstood | How to Find XXE Bugs: Severe, Missed, and Misunderstood |
| 2026-04-16 | A Deep Dive Into XXE Injection (Synack) | A Deep Dive Into XXE Injection (Synack) |
| 2026-04-16 | Top 25 XXE Bug Bounty Reports | Top 25 XXE Bug Bounty Reports |
RCE +14
| Date | Resource | Summary |
|---|---|---|
| 2026-04-19 | CVE-2025-22457: Ivanti Connect Secure VPN Zero-Day RCE | CVE-2025-22457: Ivanti Connect Secure VPN Zero-Day RCE |
| 2026-04-19 | Advisory: Actively Exploited Unauthenticated RCE in Ivanti Connect Secure (CVE-2025-0282) | Advisory: Actively Exploited Unauthenticated RCE in Ivanti Connect Secure (CVE-2025-0282) |
| 2026-04-19 | Command Injection in Jenkins via Git Parameter (CVE-2025-53652) | Command Injection in Jenkins via Git Parameter (CVE-2025-53652) |
| 2026-04-19 | 0xMarcio/cve: Latest CVEs with PoC Exploits | 0xMarcio/cve: Latest CVEs with PoC Exploits |
| 2026-04-19 | Microsoft WSUS RCE (CVE-2025-59287) Actively Exploited | Microsoft WSUS RCE (CVE-2025-59287) Actively Exploited |
| 2026-04-16 | Empirical Study on RCE in ML Model Hosting Ecosystems | Empirical Study on RCE in ML Model Hosting Ecosystems |
| 2026-04-16 | Method Confusion in Go SSTIs Lead to File Read and RCE | Method Confusion in Go SSTIs Lead to File Read and RCE |
| 2026-04-16 | SmarterTools SmarterMail Pre-Auth RCE (CVE-2025-52691) | SmarterTools SmarterMail Pre-Auth RCE (CVE-2025-52691) |
| 2026-04-16 | Dissecting and Exploiting CVE-2025-62507: RCE in Redis | Dissecting and Exploiting CVE-2025-62507: RCE in Redis |
| 2026-04-16 | Domain-Level RCE in Veeam Backup & Replication (CVE-2025-23120) | Domain-Level RCE in Veeam Backup & Replication (CVE-2025-23120) |
| 2026-04-16 | Exploitation Walkthrough - Ivanti Connect Secure RCE (CVE-2025-0282) | Exploitation Walkthrough - Ivanti Connect Secure RCE (CVE-2025-0282) |
| 2026-04-16 | React2Shell Deep Dive: CVE-2025-55182 Exploit Mechanics | React2Shell Deep Dive: CVE-2025-55182 Exploit Mechanics |
| 2026-04-16 | Remote Code Execution in Ghost CMS (CVE-2026-29053) | Remote Code Execution in Ghost CMS (CVE-2026-29053) |
| 2026-04-16 | Ni8mare: Unauthenticated Remote Code Execution in n8n (CVE-2026-21858) | Ni8mare: Unauthenticated Remote Code Execution in n8n (CVE-2026-21858) |
Fuzzing +14
| Date | Resource | Summary |
|---|---|---|
| 2026-04-19 | Generative Fuzzer-Driven Vulnerability Detection in IoT Networks | Generative Fuzzer-Driven Vulnerability Detection in IoT Networks |
| 2026-04-19 | Automating Fuzz Driver Generation for Deep Learning Libraries with LLMs | Automating Fuzz Driver Generation for Deep Learning Libraries with LLMs |
| 2026-04-19 | Fuzz to the Future: Uncovering Occluded Future Vulnerabilities | Fuzz to the Future: Uncovering Occluded Future Vulnerabilities |
| 2026-04-19 | EdgeFuzz: A Middleware-Based Security Testing Tool | EdgeFuzz: A Middleware-Based Security Testing Tool |
| 2026-04-19 | Software Fuzzing: The Cornerstone of Automated Vulnerability Discovery | Software Fuzzing: The Cornerstone of Automated Vulnerability Discovery |
| 2026-04-16 | Fuzzing | Testing Handbook - AppSec Guide | Fuzzing | Testing Handbook - AppSec Guide |
| 2026-04-16 | API Fuzzing for Security Testing: Complete Guide | API Fuzzing for Security Testing: Complete Guide |
| 2026-04-16 | Recent Fuzzing Papers Collection | Recent Fuzzing Papers Collection |
| 2026-04-16 | Awesome-Fuzzing: Curated List of Fuzzing Resources | Awesome-Fuzzing: Curated List of Fuzzing Resources |
| 2026-04-16 | KernelGPT: Enhanced Kernel Fuzzing via LLMs | KernelGPT: Enhanced Kernel Fuzzing via LLMs |
| 2026-04-16 | ksmbd: Fuzzing Improvements and Vulnerability Discovery | ksmbd: Fuzzing Improvements and Vulnerability Discovery |
| 2026-04-16 | AFL++ Fuzzing in Depth | AFL++ Fuzzing in Depth |
| 2026-04-16 | The Fuzzing Book: Generating Software Tests | The Fuzzing Book: Generating Software Tests |
| 2026-04-16 | Fuzzing101: A Step-by-Step Fuzzing Tutorial | Fuzzing101: A Step-by-Step Fuzzing Tutorial |
Python +14
| Date | Resource | Summary |
|---|---|---|
| 2026-04-19 | PyPI Supply Chain Attack: Colorama and Colorizr Name Confusion | PyPI Supply Chain Attack: Colorama and Colorizr Name Confusion |
| 2026-04-19 | Compromised LiteLLM PyPI Package Delivers Credential Stealer | Compromised LiteLLM PyPI Package Delivers Credential Stealer |
| 2026-04-19 | LiteLLM PyPI Package Compromised in TeamPCP Supply Chain Attack | LiteLLM PyPI Package Compromised in TeamPCP Supply Chain Attack |
| 2026-04-19 | Malicious PyPI Package — LiteLLM Supply Chain Compromise | Malicious PyPI Package — LiteLLM Supply Chain Compromise |
| 2026-04-19 | The PyPI Supply Chain Attacks of 2025 | The PyPI Supply Chain Attacks of 2025 |
| 2026-04-16 | PYPI Security: How to Prevent Supply Chain Attacks in Python Projects | PYPI Security: How to Prevent Supply Chain Attacks in Python Projects |
| 2026-04-16 | Python Tools for Penetration Testers | Python Tools for Penetration Testers |
| 2026-04-16 | Escalating Deserialization Attacks in Python | Escalating Deserialization Attacks in Python |
| 2026-04-16 | Exploiting Python Pickles - David Hamann | Exploiting Python Pickles - David Hamann |
| 2026-04-16 | Attack on Software Supply Chains Using Fake Python Infrastructure | Attack on Software Supply Chains Using Fake Python Infrastructure |
| 2026-04-16 | Defense in Depth: A Practical Guide to Python Supply Chain Security | Defense in Depth: A Practical Guide to Python Supply Chain Security |
| 2026-04-16 | How Python Pickle Deserialization Security Exploit Works | How Python Pickle Deserialization Security Exploit Works |
| 2026-04-16 | Insecure Deserialization in Python: Attack Techniques and Secure Coding | Insecure Deserialization in Python: Attack Techniques and Secure Coding |
| 2026-04-16 | The Complete Guide on Python for Cyber Security | The Complete Guide on Python for Cyber Security |
CSRF +12
| Date | Resource | Summary |
|---|---|---|
| 2026-04-19 | CVE-2025-9611: Microsoft Playwright MCP Server CSRF Flaw | CVE-2025-9611: Microsoft Playwright MCP Server CSRF Flaw |
| 2026-04-19 | CVE-2025-23797: WP Options Editor CSRF Vulnerability | CVE-2025-23797: WP Options Editor CSRF Vulnerability |
| 2026-04-19 | AVideo CSRF — CVE-2025-3100 (Critical) | AVideo CSRF — CVE-2025-3100 (Critical) |
| 2026-04-19 | Authlib (Python) CSRF (Cache-Backed OAuth State) — CVE-2025-68158 | Authlib (Python) CSRF (Cache-Backed OAuth State) — CVE-2025-68158 |
| 2026-04-19 | Web Security Academy: CSRF SameSite Lax Bypass via Method Override | Web Security Academy: CSRF SameSite Lax Bypass via Method Override |
| 2026-04-16 | Top CSRF HackerOne Reports | Top CSRF HackerOne Reports |
| 2026-04-16 | Modern CSRF Mitigation in Single Page Applications | Modern CSRF Mitigation in Single Page Applications |
| 2026-04-16 | CSRF in the Age of JSON | CSRF in the Age of JSON |
| 2026-04-16 | How Does CSRF Lead to Account Takeover? | How Does CSRF Lead to Account Takeover? |
| 2026-04-16 | Top 25 CSRF Bug Bounty Reports | Top 25 CSRF Bug Bounty Reports |
| 2026-04-16 | The Bug Bounty Guide to Exploiting CSRF Vulnerabilities - YesWeHack | The Bug Bounty Guide to Exploiting CSRF Vulnerabilities - YesWeHack |
| 2026-04-16 | CSRF: Advanced Exploitation Guide - Intigriti | CSRF: Advanced Exploitation Guide - Intigriti |
Talks +12
| Date | Resource | Summary |
|---|---|---|
| 2026-04-19 | DEF CON 33 Hacking Conference 2025 — USF | DEF CON 33 Hacking Conference 2025 — USF |
| 2026-04-19 | DEF CON 33 (2025) — Security.World | DEF CON 33 (2025) — Security.World |
| 2026-04-19 | What to Expect from BSides, Black Hat, and DEF CON 2025 | What to Expect from BSides, Black Hat, and DEF CON 2025 |
| 2026-04-19 | DEF CON 2025 — Open Source Security Foundation | DEF CON 2025 — Open Source Security Foundation |
| 2026-04-19 | DEFCON Conference — Official YouTube | DEFCON Conference — Official YouTube |
| 2026-04-16 | XBOW at Black Hat & DEF CON: AI Agents for Offensive Security | XBOW at Black Hat & DEF CON: AI Agents for Offensive Security |
| 2026-04-16 | 5 Takeaways from Black Hat x DEF CON 2025 | 5 Takeaways from Black Hat x DEF CON 2025 |
| 2026-04-16 | Black Hat USA 2025 Briefings Schedule | Black Hat USA 2025 Briefings Schedule |
| 2026-04-16 | Cybersecurity Slides Collection | Cybersecurity Slides Collection |
| 2026-04-16 | InfoCon: Hacking and Security Conference Archives | InfoCon: Hacking and Security Conference Archives |
| 2026-04-16 | DEFCON Media Server: Complete Conference Video Archive | DEFCON Media Server: Complete Conference Video Archive |
| 2026-04-16 | DEF CON 33 Archive: Videos, Slides, and White Papers | DEF CON 33 Archive: Videos, Slides, and White Papers |
Bug Bounty +11
| Date | Resource | Summary |
|---|---|---|
| 2026-04-19 | HackerOne Paid $81 Million in Bug Bounties Over the Past Year | HackerOne Paid $81 Million in Bug Bounties Over the Past Year |
| 2026-04-19 | 9 Top Bug Bounty Programs Launched in 2025 — CSO Online | 9 Top Bug Bounty Programs Launched in 2025 — CSO Online |
| 2026-04-19 | Bug-bounty Writeups Repository — fardeen-ahmed | Bug-bounty Writeups Repository — fardeen-ahmed |
| 2026-04-19 | Google's Bug Bounty Program Hits All-Time High — $17M in 2025 | Google's Bug Bounty Program Hits All-Time High — $17M in 2025 |
| 2026-04-19 | Top Bugs That Actually Paid Bounties in 2025 | Top Bugs That Actually Paid Bounties in 2025 |
| 2026-04-16 | BugHunterMethodology: A Comprehensive Bug Bounty Methodology | BugHunterMethodology: A Comprehensive Bug Bounty Methodology |
| 2026-04-16 | PortSwigger's Top 10 Web Hacking Techniques of 2025 | PortSwigger's Top 10 Web Hacking Techniques of 2025 |
| 2026-04-16 | Automating Bug Bounties with Nuclei | Automating Bug Bounties with Nuclei |
| 2026-04-16 | Advanced Techniques & Use Cases of Nuclei for Bug Bounty | Advanced Techniques & Use Cases of Nuclei for Bug Bounty |
| 2026-04-16 | Crafting Your Bug Bounty Methodology: A Complete Guide | Crafting Your Bug Bounty Methodology: A Complete Guide |
| 2026-04-16 | Top Vulnerabilities for Pentest & Bug Bounty in 2025 | Top Vulnerabilities for Pentest & Bug Bounty in 2025 |