Blog

CVE-2026-87902: A working PoC for WordPress's critical path traversal

Here be dragons: GeoServer pre-auth SQL injection to RCE

WordPress XSS2Shell: Unauthenticated Login-Screen XSS to PHP Code Execution (CVE-2026-64638)

wp2shell: A Pre-Authentication RCE in WordPress Core's REST Batch API

CVE-2026-45829 — ChromaDB Python server hands you RCE before it asks who you are

Next.js WebSocket SSRF: Unauthenticated Access to Internal Resources: CVE-2026-44578

CVE-2026-44212 — Stored XSS in PrestaShop Back-Office via RFC 5321 Quoted-String Email

CVE-2026-23918: Apache HTTP Server Double-Free RCE in HTTP/2 Implementation

CVE-2026-41940: A Critical Authentication Bypass in cPanel

cPanel Critical Authentication Bypass Actively Exploited - CVE-2026-41940

ImageMagick zero-days bypass multiple security policies: what defenders need to know

F5 BIG-IP APM Remote Code Execution: CVE-2025-53521 Active Exploitation

Citrix NetScaler ADC/Gateway Memory Overread: CVE-2026-3055

Cisco Catalyst SD-WAN authentication bypass exploited in the wild CVE-2026-20127

Ivanti EPMM Zero-Days: When Bash Arithmetic Expansion Becomes Your Worst Enemy

CVE-2025-55182: Critical RCE targets React & Next.js

CVE-2025-64446: Fortinet FortiWeb critical authentication bypass

CVE-2025-61884: High severity exposure in Oracle E-Business Suite (EBS)

CVE-2025-61882: Unauthenticated Remote Code Execution in Oracle E-Business Suite

CVE‑2025‑9807: Time‑based SQL injection in the Events Calendar Wordpress plugin

CVE-2025-53690: Critical vulnerability in Sitecore leads to remote code execution

CVE-2025-7384: Critical WordPress Plugin Unauthenticated RCE

The AI Protocol Under Siege: MCP Server Vulnerabilities Expose Critical Threats

CVE-2025-53770: Unauthenticated RCE in SharePoint lets attackers drop web shells

CVE-2025-1220: Null byte trickery bypasses hostname allowlists in PHP

CVE-2025-5777: A New Memory Leak in Citrix Gateway Devices

From REDACTED to Administrator: Unmasking Hidden Credentials via SSRF and Caddy's Keen Eye

Exploiting CVE-2024-13346: Shortcode Abuse, Data Leaks, and XSS in WordPress

New critical Citrix ADC and Gateway zero-day vulnerability

Critical Citrix ADC and Gateway zero-day exploited

Exim-tremely Critical? Do you need to worry about CVE-2024-39929

Microsoft Patch Tuesday September 2024: Four Zero Days and More Patched

What you need to know: OpenSSH RegreSSHion CVE-2024-6387

Announcement: Hadrian raises €2.5 million pre-seed

ABN AMRO Ventures backs Hadrian in its mission to arm enterprises with real-time exposure management from the Hacker’s perspective

What AI penetration testing needs to run safely at speed

Six Months Later: Vulnerability Management Has a Verification Problem

Six Months Later: AI Offensive Capability Has Moved Into the Real World

Six Months Later: The Vulnerability Window Is Collapsing

Forget the Frontier Model: The Harness Is Where the Product Lives

Parallelization is the real AI threat not Mythos

You can't protect what you don't know you have

In their own words: the From noise to action webinar

Livewire to Livepyre - Exploitation Of An RCE In Mere Minutes