Daily Writeups
@Daily_Writeups
3.54K subscribers
2 photos
130K links
Daily Bug Bounty / Cybersecurity Writeups
Source Code : https://github.com/Spix0r/writeup-miner
Download Telegram
About
Blog
Apps
Platform
Join
Daily Writeups
3.54K subscribers
Daily Writeups
⤷ Title: No Patch Available: The CVSS 10 Flaw Turning AVideo into an Attacker’s Playground
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 15 Apr 2026 12:40:39 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Account Takeover #AVideo #CVSS 10 #cybersecurity #infosec #JavaScript Injection #rce #WebSocket Vulnerability #YPTSocket #zero_day
Daily CyberSecurity
No Patch Available: The CVSS 10 Flaw Turning AVideo into an Attacker’s Playground
AVideo’s YPTSocket plugin faces a critical CVSS 10 vulnerability. Unauthenticated attackers can hijack every active session at once. No patch is available.
18 views
Daily Writeups
⤷ Title: Critical 9.8 CVSS RCE Hijacks Pipecat Voice Agents
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 27 Apr 2026 08:06:03 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #CVE_2025_62373 #cybersecurity #Deserialization #infosec #LiveKit #Patch Alert #Pickle #Pipecat #Python #rce #Voice AI #WebSocket Security
Daily CyberSecurity
Critical 9.8 CVSS RCE Hijacks Pipecat Voice Agents
Critical 9.8 CVSS RCE in Pipecat (CVE-2025-62373)! Unsafe pickle deserialization allows remote code execution. Patch to v0.0.94 immediately to secure agents.
42 views
Daily Writeups
⤷ Title: 9.6 Severity: Critical “Cline” AI Agent Flaw Allows Stealthy RCE via Your Browser
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 12 May 2026 01:20:48 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #AI security #Cline AI #CVE_2026_44211 #DevSecOps #infosec #Localhost Vulnerability #npm Security #rce #Remote Code Execution #Web Security #WebSocket Hijacking
Daily CyberSecurity
9.6 Severity: Critical "Cline" AI Agent Flaw Allows Stealthy RCE via Your Browser
Critical Alert: CVE-2026-44211 (CVSS 9.6) in Cline AI allows malicious sites to hijack your terminal and steal data via WebSockets. Update your CLI tools now.
12 views
Daily Writeups
⤷ Title: CVE-2026-44578 Next.js SSRF Vulnerability
════════════════════════
𐀪 Author: Nisal Renuja Palliyaguru
════════════════════════
ⴵ Time: Sat, 16 May 2026 04:09:14 GMT
════════════════════════
⌗ Tags: #nextjs #ssrf #vulnerability #websocket
Medium
CVE-2026-44578 Next.js SSRF Vulnerability
A high severity Server Side Request Forgery (SSRF) vulnerability has been disclosed in Next.js one of the most widely used React frameworks…
53 views
Daily Writeups
⤷ Title: Open Proxy Risk: High-Severity Next.js SSRF Flaw Exposes Cloud Metadata Endpoints
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Mon, 18 May 2026 06:56:21 +0000
════════════════════════
⌗ Tags: #Vulnerability #Cloud Metadata Exploit #CVE_2026_44578 #CWE_918 #Next.js #Security Patch 2026 #Self_Hosted Node.js #Server_Side Request Forgery #SSRF #Vercel #WebSocket Upgrade
Penetration Testing Tools
Open Proxy Risk: High-Severity Next.js SSRF Flaw Exposes Cloud Metadata Endpoints
The development framework Next.js has remediated a critical security vulnerability, designated as CVE-2026-44578, which afflicts applications deployed on
28 views
Daily Writeups
⤷ Title: The Zero-Detection Shadow: Unit 42 Exposes Advanced Gremlin Stealer Hijacking Live Browser WebSockets
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Wed, 20 May 2026 07:42:37 +0000
════════════════════════
⌗ Tags: #Malware #.NET Resource Obfuscation #Chromium Identity Theft #Code Virtualization Bytecode #Cookie Protection Bypass #Cryptojacking Clipboard Hijacker #Gremlin Stealer Malware #Unit 42 Palo Alto Networks #WebSocket Session Hijacking #XOR Encoded Payload #Zero Detection C2 Infrastructure
Information Security News
The Zero-Detection Shadow: Unit 42 Exposes Advanced Gremlin Stealer Hijacking Live Browser WebSockets - Information Security News
The exfiltration of administrative credentials and volatile session tokens increasingly manifests not as a rudimentary brute-force incursion, but as a meticulously obfuscated mechanism engineered to maintain absolute silence until the definitive moment of…
11 views
Daily Writeups
⤷ Title: Four undici Vulnerabilities Affect a Package With 133M Weekly Downloads
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Mon, 22 Jun 2026 02:00:04 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #CVE_2026_6734 #CVE_2026_9697 #nodejs #npm #SOCKS5 #TLS Bypass #undici #WebSocket
Daily CyberSecurity
Four undici Vulnerabilities Affect a Package With 133M Weekly Downloads
Four undici vulnerabilities (CVE-2026-6734, CVE-2026-9697) affect the Node.js HTTP client, which sees 133M weekly downloads. Update undici now.
28 views
Daily Writeups
⤷ Title: Critical Event-Driven Ansible Flaw Leaks Stored Credentials
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Fri, 26 Jun 2026 00:01:43 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #Ansible Automation Platform #Credential Disclosure #CVE_2026_11807 #Event_Driven Ansible #Missing Authorization #red hat #websocket API
Daily CyberSecurity
Critical Event-Driven Ansible Flaw Leaks Stored Credentials
A missing authorization flaw in Event-Driven Ansible (CVE-2026-11807, CVSS 9.6) leaks credentials like OAuth tokens, vault passwords, and SSH keys.
13 views
Daily Writeups
⤷ Title: The Problem With Testing WebSockets: Why I Built a Scanner That Treats the Connection as the Unit…
════════════════════════
𐀪 Author: Regaan
════════════════════════
ⴵ Time: Sat, 11 Jul 2026 09:44:01 GMT
════════════════════════
⌗ Tags: #cybersecurity #python #websocket #penetration_testing
Medium
The Problem With Testing WebSockets: Why I Built a Scanner That Treats the Connection as the Unit…
There’s a quiet assumption baked into almost every web security scanner: you send a request, you get a response, you inspect the response…
29 views
Daily Writeups
⤷ Title: Why You Should ALWAYS Test WebSockets (And Why Most Hunters Never Do)
════════════════════════
𐀪 Author: CypherNova1337
════════════════════════
ⴵ Time: Sat, 25 Jul 2026 03:34:00 GMT
════════════════════════
⌗ Tags: #ethical_hacking #websocket #graphql #bug_bounty #penetration_testing
Medium
Why You Should ALWAYS Test WebSockets And Why Most Hunters Never Do
A real-world bug bounty walkthrough on how skipping WebSocket recon is leaving money on the table — and how I found a P1 by going where…
27 views
Daily Writeups
⤷ Title: I Found an Unauthenticated WebSocket Leaking Live Customer Data
════════════════════════
𐀪 Author: 0xJad
════════════════════════
ⴵ Time: Tue, 04 Aug 2026 10:27:25 GMT
════════════════════════
⌗ Tags: #cybersecurity #bug_bounty_writeup #bug_bounty #ethical_hacking #websocket
Medium
I Found an Unauthenticated WebSocket Leaking Live Customer Data
I found an unauthenticated WebSocket endpoint on a major company infrastructure that was streaming live customer check-in data, full names…
13 views