TL;DR A high-severity authentication bypass affects the Neo4j GraphQL Library before versions 7.5.6 and 5.12.14. Tracked as CVE-2026-5423 (CVSS 8.2), it lets an unauthenticated attacker forge JWT …

TL;DR A Linux kernel eventpoll flaw lets a local user climb to root. Tracked as CVE-2026-43074, it scores 7.3 on CVSS. Researchers confirmed a working root shell on a Pixel 10 Pro. The full detail…

Forget about the exploit payload, the Blog class, or writing code. Right now, our only goal is to find a place on the website that lets us…

Hey, My name is Omri Baso I am a 28 years old Security Researcher from Israel — I like researching about Windows, Active Directory, Malware…

Maybe, it is listening now?

A beginner’s approach to learning information security, sharing knowledge, and building digital resilience.

A field note on OSINT, cloud misconfigurations, and the very boring way most breaches actually start.

1 · The Begins

The setup

Broken Authentication is a vulnerability that can happen when an application does not properly handle the different parts of…

How Fortune 100 Companies Really Secure Their APIs

What Happened

I spent years ignoring XML parsers. Then I found an XXE vulnerability that exposed an entire company’s internal network. Here’s how to find…

Every bug hunter knows the unwritten rule of public programs: if a target looks picked clean, you’re usually wasting your time.

One curl-worthy array in a password reset request, and the researcher was logging in as anyone.

By Meznah

I responsibly reported an algorithmic-complexity issue in the extract_table function of py-pdf-parser to the maintainer. The report was…

The setup

Vulnerability Assessment and Penetration Testing, commonly called VAPT, helps organizations find security weaknesses and determine which…