N45HT

$337 Basecamp Bug Bounty 🤑 Stored XSS on Trix Editor version latest (2.1.16) - Sanitizer Bypass by jeeva 🤯🔥 👨‍💻 jeeva (h1/newbiefromcoma) 🔗 hackerone.com/reports/3581911 🔗 t.me/ZeroToBug 🔗 whatsapp.com/channel/0029Vb…

OAuth Client ID Spoofing Lets Attackers Validate Stolen Microsoft Entra Credentials 👾⚠️ 🔗 thehackernews.com/2026/07/oauth-…

Hacking Apple - SQL Injection to Remote Code Execution by Jaiswal & Rahul 🤯🔥 👨‍💻 Harsh Jaiswal & Rahul Maini (ProjectDiscovery) 🔗 projectdiscovery.io/blog/hacking-a… 🔗 cve.org/CVERecord?id=C… 🔗 t.me/ZeroToBug 🔗 whatsapp.com/channel/0029Vb…

One Misconfigured Server, Three Active Campaigns: Full exposure of three AiTM Phishing Operators 🤯🔥 👨‍💻 Lexfo Team 🔗 blog.lexfo.fr/opendir-to-phi…

NVIDIA GEN3C: Unauthenticated RCE via Pickle Deserialization in Inference API by Lobstein 🤯🔥 👨‍💻 Valentin Lobstein (ʞʞıdɐɔoɥƆ) 🔗 chocapikk.com/posts/2026/gen…

Hardcoded Bearer Token in Client-Side JavaScript Enables Critical Broken Access Control (All Chats Exposed) by Elnwasani 🤯🔥 👨‍💻 Hamed Elnwasani (x/0xhamdoon) 🔗 0xhamdoon.medium.com/hardcoded-bear… 🔗 t.me/ZeroToBug 🔗 whatsapp.com/channel/0029Vb…

$100 Tor Project Bug Bounty 🤑 Malicious Conflux Endpoint Can Leave Stale Global OOO Queue Accounting After Teardown by aptupdate 🤯🔥 👨‍💻 aptupdate (h1/aptupdate) 🔗 hackerone.com/reports/3701692 🔗 t.me/ZeroToBug 🔗 whatsapp.com/channel/0029Vb…

$3,700 Anthropic Bug Bounty 🤑 [CVE-2026-55607] Claude Code: unsandboxed code execution from prompt injection via .git worktree confusion by Metnew 🤯🔥 👨‍💻 Metnew (x/v_metnew) 🔗 github.com/Metnew/write-u… 🔗 nvd.nist.gov/vuln/detail/CV… 🔗 github.com/anthropics/cla…

Content-Type Override to Stored XSS on Public Objects by Amirmohammad 🤯🔥 👨‍💻 Amirmohammad Safari (Voorivex Team) 🔗 blog.voorivex.team/content-type-o…

$287 Basecamp Bug Bounty 🤑 Any installed app can force immediate logout and persistent DOS of authenticated Basecamp sessions via unprotected exported StartActivity by Z 🤯🔥 👨‍💻 Z (x/zer0day_sec) 🔗 hackerone.com/reports/3764217

Authentication Bypass in the default configuration phpBB by Aikido Security 🤯🔥​ 👨‍💻 Aikido Security (x/AikidoSecurity) 🔗 aikido.dev/blog/authentic…

Local AI for Penetration Testing & Research by Zhang 🤯🔥​ 👨‍💻 Eddie Zhang 🔗 projectblack.io/blog/local-ai-… 🔗 t.me/ZeroToBug 🔗 whatsapp.com/channel/0029Vb…

[CVE-2026-43456] How a Linux kernel zero-day vulnerability went unnoticed for over 19 years before finally being reported 🤯🔥​ 👨‍💻 rona (x/rqda_A) 🔗 nvd.nist.gov/vuln/detail/cv… 🔗 gmo-cybersecurity.com/blog/19-year-o…

XSSR Pro is now available for everyone 🚀 100% FREE. Features: - Parameter Mining - Reflected XSS - POST-based XSS - Path-based XSS - Header-based XSS - DOM XSS - and more... Happy hunting! 🫡 🔗 xssr.n45ht.or.id 🔗 n45ht.or.id/blog/xssr-pro-…

DOM-based XSS on Microsoft by Mahajan 🤯🔥 👨‍💻 Niraj Mahajan (x/niraj1mahajan) 🔗 @niraj1mahajan/dom-based-xss-on-microsoft-com-f704227230a7" target="_blank" rel="nofollow noopener">medium.com/@niraj1mahajan… 🔗 t.me/ZeroToBug 🔗 whatsapp.com/channel/0029Vb…

GitHub private repository metadata leak by Marina 🤯🔥 👨‍💻 Marina (x/marinaiced) 🔗 x.com/marinaiced/sta…

Unpatched NTLM Leakage in Windows search: URI Handler 🤯🔥 👨‍💻 Andrew Schwartz 🔗 huntress.com/blog/unpatched…

[CVE-2026-6307] Longinus: 2 Boundaries in One Bug, Piercing Chrome’s Renderer and V8 Sandbox with a Single Vulnerability by Nebula Security 🤯🔥 👨‍💻 Nebula Security (x/nebusecurity) 🔗 nebusec.ai/research/v8-cv… 🔗 nvd.nist.gov/vuln/detail/CV… 🔗 t.me/ZeroToBug

Vigolium 🔥 High-fidelity vulnerability scanner fusing agentic AI with native speed, modularity, and precision. 👨‍💻 j3ssie (x/j3ssie) 🔗 github.com/vigolium/vigol… 🔗 vigolium.com

$1,024 Discourse Bug Bounty 🤑 Denial of Service (DoS) Vulnerability in Drafts Creation Endpoint by dpaysm 🤯🔥 👨‍💻 dpaysm (x/dpaysm) 🔗 hackerone.com/reports/3400140 🔗 t.me/ZeroToBug 🔗 whatsapp.com/channel/0029Vb…