So I was testing a web app where users can collaborate on a model.

How I went from Nmap and hidden web paths to SSH access and root

TL;DR NVIDIA patched a critical NVIDIA Triton vulnerability tracked as CVE-2026-47627. The flaw scores a CVSS base of 9.8 and can trigger denial of service. A remote, unauthenticated attacker need…

A room disguised as a chess puzzle the real vulnerability was CWE-602, mapped to OWASP Top 10:2025’s Broken Access Control.

AWS, IAM Misconfiguration, Cognito, Web, DynamoDB, Exposed Data

TL;DR Splunk fixed 60 vulnerabilities in Splunk Enterprise on August 19, 2026. Three critical flaws share a 9.4 score. Each lets an unauthenticated user with an embedded report token access data a…

TL;DR Red Hat disclosed three high-severity flaws in its Advanced Cluster Management and Multicluster Engine for Kubernetes. The worst, CVE-2026-70496, scores 9.9 and enables Kubernetes privilege …

TL;DR CERT Polska reports active exploitation of a Zimbra unauthenticated remote code execution flaw, tracked as CVE-2026-73570. The bug scores 8.9 and hits Zimbra Collaboration before 10.1.20. Zi…

TL;DR Cisco fixed a critical SQL injection flaw in Crosswork, tracked as CVE-2026-20030 at CVSS 10.0. The same hardening release patches three more critical bugs. Cisco separately fixed an XML ext…

TL;DR Splunk patched a critical OS command injection flaw in its AI Toolkit, tracked as CVE-2026-20266. The bug scores 9.1 and lets an admin-role user run arbitrary commands on the host. Splunk al…

TL;DR Cisco released hardening updates for Secure Workload on August 19, 2026. The Cisco Secure Workload authentication bypass and privilege escalation flaws include two vulnerabilities rated CVSS…

I didn’t start bug bounty because I knew exactly what I was doing.

By R4yz0x

Hardware does not want to talk to you. That is the whole point.

Ransomware attackers disrupted the engineering systems of Manitoba’s largest hospital, in the Canadian province. Following a cyberattack at the Health Sciences Centre in Winnipeg, problems e…

TL;DR Splunk fixed 17 vulnerabilities across its apps and add-ons on August 19, 2026. The worst, CVE-2026-76404, is a critical remote code execution flaw in the MCP Server app. It scores 9.1. Splu…

Google announced today that it is giving all eligible college students in the United States a full year of Google AI Pro at no cost. The service, which normally costs $19.99 per month, includes fo…

This week, numerous users discovered that executing quick or full scans with Microsoft Defender resulted in inexplicable failures, or upon launching the application, they were immediately greeted …

No exploit chain. No auth bypass. Just an 800,000-character comment box nobody thought to check.

30-Second Version: A near-blank report got CVSS 10, a fix inside 24 hours, and a $25,000 bounty. The impact section was one word: “SSRF.”…