Blog

CVE-2026-87902: A working PoC for WordPress's critical path traversal

Here be dragons: GeoServer pre-auth SQL injection to RCE

WordPress XSS2Shell: Unauthenticated Login-Screen XSS to PHP Code Execution (CVE-2026-64638)

wp2shell: A Pre-Authentication RCE in WordPress Core's REST Batch API

CVE-2026-45829 — ChromaDB Python server hands you RCE before it asks who you are

Next.js WebSocket SSRF: Unauthenticated Access to Internal Resources: CVE-2026-44578

CVE-2026-44212 — Stored XSS in PrestaShop Back-Office via RFC 5321 Quoted-String Email

CVE-2026-23918: Apache HTTP Server Double-Free RCE in HTTP/2 Implementation

CVE-2026-41940: A Critical Authentication Bypass in cPanel

cPanel Critical Authentication Bypass Actively Exploited - CVE-2026-41940

ImageMagick zero-days bypass multiple security policies: what defenders need to know

F5 BIG-IP APM Remote Code Execution: CVE-2025-53521 Active Exploitation

Citrix NetScaler ADC/Gateway Memory Overread: CVE-2026-3055

Cisco Catalyst SD-WAN authentication bypass exploited in the wild CVE-2026-20127

Ivanti EPMM Zero-Days: When Bash Arithmetic Expansion Becomes Your Worst Enemy

CVE-2025-55182: Critical RCE targets React & Next.js

CVE-2025-64446: Fortinet FortiWeb critical authentication bypass

CVE-2025-61884: High severity exposure in Oracle E-Business Suite (EBS)

CVE-2025-61882: Unauthenticated Remote Code Execution in Oracle E-Business Suite

CVE‑2025‑9807: Time‑based SQL injection in the Events Calendar Wordpress plugin

CVE-2025-53690: Critical vulnerability in Sitecore leads to remote code execution

CVE-2025-7384: Critical WordPress Plugin Unauthenticated RCE

The AI Protocol Under Siege: MCP Server Vulnerabilities Expose Critical Threats

CVE-2025-53770: Unauthenticated RCE in SharePoint lets attackers drop web shells

CVE-2025-1220: Null byte trickery bypasses hostname allowlists in PHP

CVE-2025-5777: A New Memory Leak in Citrix Gateway Devices

From REDACTED to Administrator: Unmasking Hidden Credentials via SSRF and Caddy's Keen Eye

Exploiting CVE-2024-13346: Shortcode Abuse, Data Leaks, and XSS in WordPress

What you need to know: OpenSSH RegreSSHion CVE-2024-6387

Microsoft Patch Tuesday September 2024: Four Zero Days and More Patched

Exim-tremely Critical? Do you need to worry about CVE-2024-39929

New critical Citrix ADC and Gateway zero-day vulnerability

Critical Citrix ADC and Gateway zero-day exploited

Hadrian raises $40M to tackle the AI hacking cyber security crisis

Hadrian releases OpenHack, leveling the playing field for AI vulnerability discovery

Hadrian Named a Representative Vendor in the Gartner® Market Guide for Adversarial Exposure Validation

Hadrian Launches Nova - An Agentic Pentesting Solution, Bringing Deep, Autonomous Testing To External Exposure Management

Hadrian accelerates EMEA distributor network as organizations seek continuous validation of real-world cyber risk

More than two thirds of security teams struggle to keep up with the growing number of vulnerabilities

Organizations are unprepared for AI-driven cyberattacks in 2026

Hadrian is a Sample Vendor in Gartner® Emerging Tech Impact Radar™: Preemptive Cybersecurity, 2025

Hadrian named one of the Netherlands' top innovators in the R&D top 50

Hadrian's MCP server is live

The authority layer: why AI agent security becomes a systems problem

Open-source AI is accelerating the weaponization cycle

Client-Side Template Injection in GitBlit

AI turns simple FortiGate gap into breaches

From MCP to Secure MCP: The Familiar Protocol Arc and the Unfamiliar Security Problem

Hadrian's hacking team on what they expect from 2026 based on cybersecurity trends

Understanding the new negative time-to-exploit

Presentation: How agentic AI is redefining offensive cybersecurity