A command injection that fires before any sandbox exists, a V8 isolate that protects the wrong half of your module, and an XSS in the OAuth…

There’s no shortage of options for building an API in 2026. Node.js, Go, FastAPI, Kotlin, Rust — all of these show up in production, all of…

PART 2 — WHEN THE LOGIN API REVEALS TOO MUCH. Excessive Data Exposure and Rate-Limiting Weaknesses in VulnBank’s Authentication Endpoint

Your ORM will happily hand an attacker another customer’s row. It’s doing exactly what you asked.

By Chingunjav Gankhuu (CJ)

How an “out of scope” edge case in Vikunja’s previous privilege-escalation patch became a new authorization vulnerability three months…

“Jordan, look at that company. It’d be awesome if you work for them someday,” my mom said to me as she pointed at a CrowdStrike ad at our…

Application security companies help organizations identify vulnerabilities in source code, dependencies, APIs, and running applications…

Key Takeaways

In many organisations, cybersecurity teams invest significant effort in identifying vulnerabilities through Static Application Security…