• Finding six NGINX vulnerabilities with open models

    Author: Mufeed VH (Co-founder & CEO, Winfunc) Published: July 23, 2026 Source: https://winfunc.com/research/endginx Summary Winfunc ran its autonomous vulnerability-research agent, driven by the open models GLM-5.1 and GLM-5.2 (from Z.AI), against the NGINX source tree. The scan produced six security findings carrying five CVE identifiers: two heap overflows in the HTTP/2 upstream request builders, one…

  • Cloudflare Zero-day: Accessing Any Host Globally

    Author: FearsOff (@k_firsov / @FearsOff; no individual byline stated in the article metadata) Published: October 28, 2025 Source: https://fearsoff.org/research/cloudflare-acme Summary FearsOff disclosed a global Cloudflare WAF bypass in which requests to the certificate-validation path /.well-known/acme-challenge/{token} were served by the customer’s origin even when customer and account-level WAF rules were configured to block all traffic. Because…

  • FastJson 1.2.83 Remote Code Execution

    Author: FearsOff (research team; no individual author bylined) Published: July 21, 2026 (last updated July 26, 2026) Source: https://fearsoff.org/research/fastjson-1-2-83-rce Summary FearsOff disclosed CVE-2026-16723, a remote code execution vulnerability affecting fastjson 1.2.68 through 1.2.83 — including 1.2.83, the final 1.x release long considered the “safe” version because it ships with AutoType disabled by default. The researchers…

  • Palo Alto Firewall Has an Unpatched Critical RCE Today (CVE-2026-0300)

    Palo Alto Firewall Has an Unpatched Critical RCE Today (CVE-2026-0300)

    Author: VulnTracker Published: May 6, 2026 Source: https://vulntracker.io/blog/palo-alto-pan-os-cve-2026-0300-unauth-rce-active-exploitation/ Summary VulnTracker reports on CVE-2026-0300, a critical unauthenticated remote code execution flaw in Palo Alto Networks PAN-OS firewalls that, at the time of writing (May 6, 2026), was under active exploitation with no patch available until May 13, 2026. An unauthenticated attacker can obtain full root control…

  • Critical and Already Being Exploited: PAN-OS GlobalProtect Auth Bypass (CVE-2026-0257)

    Critical and Already Being Exploited: PAN-OS GlobalProtect Auth Bypass (CVE-2026-0257)

    Author: VulnTracker Published: June 2, 2026 Source: https://vulntracker.io/blog/palo-alto-globalprotect-auth-bypass-cve-2026-0257-actively-exploited Summary VulnTracker reports on CVE-2026-0257, a CVSS 9.1 critical authentication bypass in Palo Alto Networks PAN-OS GlobalProtect that is being actively exploited in the wild and was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on May 29, 2026. A remote, unauthenticated attacker can bypass authentication…

  • When Your VPN Opens Your Private Network to the Public

    Author: rootxharsh Published: May 20, 2026 Source: https://www.hacktron.ai/blog/cve-2026-0265-panos-globalprotect-cas-auth-bypass Summary Hacktron’s writeup describes CVE-2026-0265, a JWT algorithm-confusion vulnerability in the Cloud Authentication Service (CAS) used by Palo Alto Networks PAN-OS with GlobalProtect. Because the token-verification code selects the signature algorithm purely from the attacker-supplied alg field and never cross-checks it against the expected key type, an…

  • The Art of 403 Bypass: From Understanding to Exploitation

    Press enter or click to view image in full size N0aziXss Feb 3, 2026 https://medium.com/@N0aziXss/the-art-of-403-bypass-from-understanding-to-exploitation-8903118a074d Subtitle: A Systematic Methodology for Identifying and Circumventing Access Control Barriers in Web Applications Byline: By N0aziXss | Security Researcher | HackerOne & BugCrowd Validated Introduction: Deep Dive into HTTP 403🔐 What is Error 403? 403 Forbidden — The server…

  • From Default IIS Page to Critical SQL Injection

    Ahmad Mugh33ra Dec 9, 2025 https://mugh33ra.medium.com/from-default-iis-page-to-critical-sql-injection-d0e9950c66fc Why “boring” infrastructure often hides the most dangerous secrets Sometimes the most dangerous vulnerabilities hide in plain sight, waiting for someone who refuses to give up. Assalam-O-Alikum My name is Ahmad Mugheera an Indivisual Security Researcher, Ethical Hacker and bug bounty hunter from Pakistan. Let’s Start The Setup: Another…

  • A Journey of Limited Path Traversal To RCE With $40,000 Bounty!

    HX007 Jan 16, 2025 Link: https://medium.com/@HX007/a-journey-of-limited-path-traversal-to-rce-with-40-000-bounty-fc63c89576ea My Name is Abdullah Nawaf, Full Time Bug Bounty Hunter, Working actively in BugCrowd with a Top 50 Rank, Rank 11 for P1 Bugs With 226 P1 , Hunting For P1, and P2 Bugs. In this write-up, I will detail how I& Orwa Atyat successfully escalated a limited path traversal into an RCE, earning us a $40,000 bounty. #Description: While conducting reconnaissance and port scanning…

  • Cottou – dyld Rebase Opcode Out-of-Bounds Segment Index Leads to ACE

    Author: impost0r Published: June 29, 2026 Source: https://ret2p.lt/2026/06/29/cottou.html Summary “Cottou” is a writeup by impost0r describing an out-of-bounds segment-index flaw in Apple’s dyld dynamic linker that can be turned into arbitrary code execution when a malicious dynamic library is loaded. The bug lies in how dyld processes rebase opcodes while binding a Mach-O image: a…