n8n used a user-supplied schema name as a key on a plain object. Setting it to __proto__ polluted the prototype and led to RCE through the Git node.

A critical unauthenticated Remote Code Execution (RCE) vulnerability in CircleCI’s Model Context Protocol (MCP) server allowed attackers to spoof client headers and execute arbitrary pipeline code without credentials.

Hello Everybody, Today in this writeup I am going to explain my findings of a Microsoft’s Important Severity bug which ultimately leads to…

SQL injection + root command injection + CVSS 10.0 nginx bypass + unauthenticated JWT minting = one request to root on any UniFi OS device. Full technical writeup.

After many years of complaining about how insecure SAML is, I decided to try to prove it by using Claude Code to hack every SAML implementation I could find.

Cycode research: NASA/JPL's AMMOS AIT-GUI ground console ships with no auth, no CSRF, and a 0.0.0.0 bind, enabling unauthenticated command execution. Fixed in 2.5.2.

Hello Hackers,

How I chained three public V8 bugs against Google's v8CTF, escaped the V8 sandbox, printed a real flag, and still received no bounty.

Multiple critical vulnerabilities at Plausible Analytics: pre-auth Storybook RCE, registration bypass with cross-tenant IDORs and stored XSS, and SSO verification SSRF to PostgreSQL RCE.

Introduction

Root on a $20,000 humanoid robot from Bluetooth range. One chain crossing Bluetooth, Unitree’s cloud, mobile, and the firmware running the G1 itself. Here’s the complete technical breakdown of the $6,700 bounty and two CVEs it produced: CVE-2026-76639 / CVE…

Writeups and notes from a bug bounty hunter.

See how Codex tackles blind vulnerability labs, plus lessons from HashKitten’s 10-hour WordPress zero-day research with GPT-5.6 Sol.

We found a second delayed RCE in MECCHA CHAMELEON: a malicious custom map could write files anywhere on your system and run code after a restart. Now patched in 4.0.0.

How a missing @PreAuthorize line in GeoNetwork led to unauthenticated Remote Code Execution across government geospatial infrastructure in 39 countries.

Sansec discovered StyleSmuggler, a Magento and Adobe Commerce zero-day that gives unauthenticated attackers remote code execution. Attacks started September ...

A Real Estate Web App Bug Bounty Story

The Door Was Already Open

A pre-deployment scan of an open source URL shortener surfaced cross-tenant link takeover, SSRF, and custom-domain takeover chains that AI code review did not flag.