Curated security research, vulnerabilities, advisories and tools for practitioners.

#web-security

Security coverage tagged web-security.

1.

Client-Side Path Traversal na Prática: De Stored XSS à Exclusão de Conta

research | 2026-10-15 20:10 | yokai.hakaisecurity.io | Original ↗ | .md | #bug-bounty | #vulnerability-research | #account-takeover

2.

Client-Side Path Traversal in the Wild: From Stored XSS to Account Deletion

research | 2026-10-15 20:09 | yokai.hakaisecurity.io | Original ↗ | .md | #bug-bounty | #vulnerability-research | #account-takeover

3.

From XSS to RCE: Two Exploit Chains in ConcreteCMS

vulnerability | 2026-10-04 00:00 | tenzai.com | Original ↗ | .md | #rce | #web-security | #xss

4.

How to secure and build trust in your APIs through Savant Probe

blog | 2026-10-06 11:45 | bugcrowd.com | Original ↗ | .md | #web-security | #security | #saml

5.

Two front doors: Module-level access in a Django GRC app

blog | 2026-10-05 00:00 | about.gitlab.com | Original ↗ | .md | #access-control | #web-security | #grc

6.

Dojo challenge #54 Highscore solution

blog | 2026-09-30 18:58 | yeswehack.com | Original ↗ | .md | #ctf | #web-security | #dojo

7.

[PT-BR] CVE-2026-16764: Uma validação faltando, acesso total

vulnerability | 2026-09-25 20:03 | CVE-2026-16764 | yokai.hakaisecurity.io | Original ↗ | .md | #vulnerability-research | #web-security | #research

8.

The Vercel Bug Bounty Program is now publicly available

vulnerability | 2026-09-24 07:00 | vercel.com | Original ↗ | .md | #bug-bounty | #cloud-security | #web-security

9.

Mitigating RCE Impact Like in OpenAI Hack with Defense-in-Depth

research | 2026-09-21 00:00 | idnsec.com | Original ↗ | .md | #ai-security | #rce | #vulnerability-research

10.

Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers

vulnerability | 2026-09-18 00:00 | vercel.com | Original ↗ | .md | #rce | #cloud-security | #vulnerability-research

11.

What's in a tag name? JavaScript, apparently

research | 2026-08-25 14:24 | portswigger.net | Original ↗ | .md | #browser-security | #web-security | #xss

12.

blog | 2026-08-24 00:00 | caido.io | Original ↗ | .md | #pentesting | #web-security | #caido

13.

$1 million hacker challenge for Vercel Sandbox

vulnerability | 2026-08-18 00:00 | vercel.com | Original ↗ | .md | #bug-bounty | #cloud-security | #web-security

14.

XSS2Shell: WordPress pre-auth XSS to RCE chain (CVE-2026-64638)

vulnerability | High | 2026-08-07 15:25 | CVE-2026-64638 | pwn.ai | Original ↗ | .md | #ai-security | #rce | #public-poc

15.

AppFlowy Authenticated SQL Injection

vulnerability | 2026-08-15 05:06 | CVE-2026-16007 | projectblack.io | Original ↗ | .md | #sql-injection | #web-security | #vulnerability

16.

Can AI invent new attack techniques? New research from James Kettle and PortSwigger Research

blog | 2026-08-12 09:04 | portswigger.net | Original ↗ | .md | #ai-security | #black-hat | #web-security

17.

Everything hackable will get hacked

research | 2026-08-11 07:00 | vercel.com | Original ↗ | .md | #ai-security | #cloud-security | #web-security

18.

CSS:the bomb inside your inbox

research | 2026-08-06 22:00 | portswigger.net | Original ↗ | .md | #ai-security | #browser-security | #data-exposure

19.

Can AI do novel security research? Meet the HTTP Terminator

research | 2026-08-06 14:59 | portswigger.net | Original ↗ | .md | #ai-security | #agentic-ai | #vulnerability-research

20.

CRLF-Powered Desync Attacks: Beheading HTTP Streams

research | 2026-08-05 23:30 | portswigger.net | Original ↗ | .md | #vulnerability-research | #attack-chains | #web-security

21.

PimpMyCaido #1: Hunt client-side vulnerabilities with DOMLogger++

blog | 2026-08-06 07:47 | yeswehack.com | Original ↗ | .md | #bug-bounty | #web-security | #xss

22.

[CVE-2009-2854] The WordPress Chain Massacre

research | 2026-08-05 00:00 | CVE-2009-2854 | calif.io | Original ↗ | .md | #vulnerability-research | #linux | #web-security

23.

Case study: How Burp AT helped expose whistleblower reports via a critical vulnerability that was overlooked for years

blog | 2026-08-04 14:45 | portswigger.net | Original ↗ | .md | #ai-security | #pentesting | #agentic-ai

24.

DeepsecBench: evaluating model performance in finding cybersecurity vulnerabilities

research | 2026-07-27 04:00 | vercel.com | Original ↗ | .md | #ai-security | #cloud-security | #vulnerability-research

25.

Rickrolling the World Cup, unleashing AI across Google, 0-click stored XSS on Next.js – ethical hacker roundup

blog | 2026-07-21 08:36 | yeswehack.com | Original ↗ | .md | #ai-security | #vulnerability-research | #github

26.

SQL injection isn't dead

blog | 2026-07-22 00:00 | aikido.dev | Original ↗ | .md | #ai-security | #rce | #appsec

27.

Authentication Bypass in the default configuration phpBB

vulnerability | Critical | 2026-07-04 00:00 | CVE-2026-48611 | aikido.dev | Original ↗ | .md | #ai-security | #featured | #account-takeover

28.

Dojo challenge #52 Streamcore solution

blog | 2026-07-15 11:45 | yeswehack.com | Original ↗ | .md | #appsec | #ctf | #web-security

29.

How to Use BugBunny

blog | 2026-07-13 14:00 | bugbunny.ai | Original ↗ | .md | #ai-security | #pentesting | #agentic-ai

30.

Web2 Bugs Hiding in Web3: The Smart Contract Security Blind Spot

blog | 2026-07-10 09:55 | hackenproof.com | Original ↗ | .md | #supply-chain | #web3 | #vulnerability-research