Vulnerability Alerts
Citrix called CVE-2026-8452 a denial-of-service risk in June. In August, watchTowr proved it was a pre-auth heap overflow giving root on NetScaler ADC and Gateway. Exploitation followed within days. The flaw, the web shells,…
Vulnerability Alerts
CVE-2026-59310 is an unauthenticated CVSS 9.8 RCE in VMware vCenter's Syslog Server — already mass-exploited across 361 victims in 47…
Vulnerability Alerts
Adobe ColdFusion has an unauthenticated, CVSS 10.0 OS command injection (CVE-2026-48362) that hands attackers full server takeover with no login.…
Malware & Threats
Check Point uncovered Lazarus exploiting the afd.sys zero-day (CVE-2026-68820) in Operation Dream Job — fake LinkedIn recruiter lures, a trojanized…
Bug Bounty
How to write a bug bounty report that gets accepted quickly: a specific title, a tight summary, numbered reproducible steps,…
Bug Bounty
A safe, beginner-friendly methodology for finding your first IDOR: map object references, understand ID formats, and test authorization by swapping…
Tools & Tutorials
A hands-on ffuf cheat sheet: directory and file discovery, response filtering, hidden parameter and virtual-host enumeration, authenticated fuzzing, and rate…
Tools & Tutorials
A practical, repeatable recon pipeline for bug bounty: enumerate subdomains with subfinder, find live hosts with httpx, then categorize and…
Malware & Threats
The ChainDrop npm supply-chain attack infected 440 packages with 500M+ weekly downloads using a self-propagating worm that steals CI/CD credentials.…
Vulnerability Alerts
A CVSS 10.0 flaw in SAP Commerce Cloud (CVE-2026-58231) lets unauthenticated attackers run arbitrary code — and it was exploited…
Vulnerability Alerts
Citrix called CVE-2026-8452 a denial-of-service risk in June. In August, watchTowr proved it was a pre-auth heap overflow giving root…
Vulnerability Alerts
CVE-2026-73570 is an unauthenticated command-injection flaw in Zimbra Collaboration, exploitable by a crafted email via the optional zimbra-snmp package. At…
Vulnerability Alerts
CVE-2026-59310 is an unauthenticated CVSS 9.8 RCE in VMware vCenter's Syslog Server — already mass-exploited across 361 victims in 47…
Bug Bounty
A practical, evergreen guide to SSRF: what server-side request forgery is, where it hides, how to confirm blind SSRF with…
Bug Bounty
FortiWeb CVE-2026-26035 lets an unauthenticated attacker log in as admin with any username and password when the wildcard RADIUS setting…
Bug Bounty
How to write a bug bounty report that gets accepted quickly: a specific title, a tight summary, numbered reproducible steps,…
Our team at XitSec finds the vulnerabilities attackers exploit — before they do. Web apps, APIs, cloud, and network penetration testing with actionable reporting.