Curated security research, vulnerabilities, advisories and tools for practitioners.

#vulnerability-research

Security coverage tagged vulnerability-research.

1.

Google Bug Hunters

blog | 2026-09-11 00:00 | bughunters.google.com | original ↗ | #bug-bounty | #vulnerability-research | #access-control

2.

Flounder: Autonomous AI White-Hat Security Auditor with Execution-Grounded Verification

tool | 2026-09-06 22:13 | github.com | original ↗ | #ai-security | #bug-bounty | #web3

3.

How to use Codex for Bug Bounty research: explore broadly, validate rigorously

blog | 2026-09-03 07:04 | yeswehack.com | original ↗ | #bug-bounty | #vulnerability-research | #codex

4.

Project Glasswing: What We Learned Running a Frontier Model on Our Own Codebase

blog | 2026-09-01 14:53 | hackerone.com | original ↗ | #ai-security | #rce | #vulnerability-research

5.

Scaling Memory Safety: AI-Assisted Rewrites of C/C++ Dependencies to Rust

blog | 2026-08-24 00:00 | bughunters.google.com | original ↗ | #ai-security | #vulnerability-research | #memory-safety

6.

Blackhat 2026: Hacking the Past. Hacking the Future.

blog | 2026-08-14 12:00 | xbow.com | original ↗ | #ai-security | #zero-day | #vulnerability-research

7.

Introducing dfs-large1: A New Frontier for Cybersecurity

research | 2026-07-30 12:00 | depthfirst.com | original ↗ | #ai-security | #featured | #agentic-ai

8.

Can AI do novel security research? Meet the HTTP Terminator

research | 2026-08-06 14:59 | portswigger.net | original ↗ | #ai-security | #agentic-ai | #vulnerability-research

9.

CRLF-Powered Desync Attacks: Beheading HTTP Streams

research | 2026-08-05 23:30 | portswigger.net | original ↗ | #vulnerability-research | #attack-chains | #web-security

10.

Write Once, Shell Everywhere: Turning Arbitrary File Writes into RCE

research | 2026-08-07 00:00 | ethiack.com | original ↗ | #rce | #vulnerability-research | #attack-chains

11.

How we use /goal to find bugs in Patch the Planet

blog | 2026-07-28 11:00 | blog.trailofbits.com | original ↗ | #ai-security | #featured | #agentic-ai

12.

A Millisecond of Predictability: Why CVE-2026-11374 Is Hard to Exploit

vulnerability | Critical | 2026-07-21 00:00 | CVE-2026-11374 | bishopfox.com | original ↗ | #featured | #vulnerability-research | #account-takeover

13.

Going depthfirst: Achieving GitLab RCE via Two Ruby Memory Corruption Vulnerabilities

research | 2026-07-24 12:00 | depthfirst.com | original ↗ | #rce | #featured | #vulnerability-research

14.

A Shell Is Worth a Thousand Images: Bing Images RCEs

research | 2026-07-23 12:00 | xbow.com | original ↗ | #ai-security | #rce | #featured

15.

Finding eight high-severity vulnerabilities in NodeBB in six hours

research | 2026-07-22 00:00 | aikido.dev | original ↗ | #ai-security | #featured | #vulnerability-research

16.

Unauthenticated RCE in WordPress core (wp2shell), via SQL injection

vulnerability | Critical | 2026-07-17 00:00 | CVE-2026-63030 | aikido.dev | original ↗ | #rce | #featured | #vulnerability-research

17.

IonStack part III: Rooting Android 17 with GhostLock

vulnerability | High | 2026-07-15 00:00 | CVE-2026-43499 | nebusec.ai | original ↗ | #public-poc | #featured | #vulnerability-research

18.

Atlas: Wiz's autonomous AI Agent for vulnerability research, ranked #1 on CyberGym

blog | 2026-07-27 14:00 | wiz.io | original ↗ | #ai-security | #vulnerability-research | #open-source

19.

CrowdStrike Joins the Open Secure AI Alliance to Advance AI Safety and Security

blog | 2026-07-27 00:00 | crowdstrike.com | original ↗ | #ai-security | #vulnerability-research | #open-source

20.

CVE-2026-14077: Select Your Own Origin - Spoofing Chrome's Address Bar

vulnerability | Medium | 2026-07-20 11:22 | CVE-2026-14077 | pwn.ai | original ↗ | #ai-security | #vulnerability-research | #browser-security

21.

IonStack Part I: Unsound IonBanana Peel in Ion Compiler, Slipping Through Firefox's SpiderMonkey JIT

vulnerability | High | 2026-07-10 00:00 | CVE-2026-10702 | nebusec.ai | original ↗ | #rce | #featured | #vulnerability-research

22.

Nextcloud CVE-2026-45281 Cross-Account Calendar Takeover

vulnerability | High | 2026-07-17 00:00 | CVE-2026-45281 | ethiack.com | original ↗ | #vulnerability-research | #access-control | #calendar-security

23.

Rickrolling the World Cup, unleashing AI across Google, 0-click stored XSS on Next.js – ethical hacker roundup

blog | 2026-07-21 08:36 | yeswehack.com | original ↗ | #ai-security | #vulnerability-research | #github

24.

Beyond the Model: Harnessing Frontier AI for Stronger Cyber Defense

research | 2026-07-20 00:00 | crowdstrike.com | original ↗ | #ai-security | #zero-day | #agentic-ai

25.

How Two WordPress Core Bugs Chained into Pre-Auth RCE

research | 2026-07-18 00:00 | bugbunny.ai | original ↗ | #rce | #vulnerability-research | #attack-chains

26.

Chaining an Apache ActiveMQ RCE on a Fully Patched 6.2.5 (CVE-2026-34197)

vulnerability | High | 2026-07-02 10:18 | CVE-2026-34197 | crowdfense.com | original ↗ | #rce | #public-poc | #featured

27.

Benchmarking 13 AI models on rediscovering known CVEs

blog | 2026-07-16 00:00 | aikido.dev | original ↗ | #ai-security | #vulnerability-research | #benchmark

28.

Don’t eat the ChocoPoCs! How vulnerability researchers were repeatedly targeted by trojanised exploits

incident | 2026-07-01 11:35 | yeswehack.com | original ↗ | #supply-chain | #featured | #vulnerability-research

29.

Web2 Bugs Hiding in Web3: The Smart Contract Security Blind Spot

blog | 2026-07-10 09:55 | hackenproof.com | original ↗ | #supply-chain | #web3 | #vulnerability-research

30.

Hack the Elephant One Bite at a Time: NUL byte SQL Injection in pdo_firebird and NULL Pointer Dereference in PDO via pdo_pgsql

research | 2026-07-06 11:06 | swarm.ptsecurity.com | original ↗ | #vulnerability-research | #memory-safety | #denial-of-service