Bug Bounty

A critical vulnerability, identified as CVE-2024-46982, has been discovered in the popular Next.js framework, widely used for building full-stack web applications.  This flaw exposes websites to cache poisoning and stored cross-site scripting (XSS) attacks, posing significant risks to both user...

Facebook has awarded a $100,000 bug bounty to security researcher Ben Sadeghipour for discovering a critical vulnerability in the company's ad platform. The flaw, identified in October 2024, allowed Sadeghipour to execute commands on Facebook's internal server, effectively granting him...

GitLab has released new patch versions 17.5.1, 17.4.3, and 17.3.6 for both its Community Edition (CE) and Enterprise Edition (EE). These updates address a critical HTML injection vulnerability that could lead to cross-site scripting (XSS) attacks, alongside other security...

Since the initial disclosure of 15 vulnerabilities in November 2023, a 220% increase in vulnerabilities impacting AI systems has been discovered, bringing the total to 48 vulnerabilities. The world's first AI/ML bug bounty program, Protect AI, analyzes the whole OSS...

This year, Crowdfense is expanding its scope to encompass additional major research fields like Enterprise Software, WiFi/Baseband, and Messengers and is proposing a larger 30 million USD acquisition program. Crowdfense is the world's premier research and acquisition platform for high-quality...

Google fixed three vulnerabilities in the Chrome browser on Tuesday, along with another zero-day exploit that was exploited during the Pwn2Own Vancouver 2024 hacking contest. Google recently fixed two more zero-day vulnerabilities that were exploited during the Pwn2Own hacking competition. Palo Alto Networks'...

Google patched seven vulnerabilities in the Chrome browser on Tuesday, including two zero-day exploits that were exploited at the Pwn2Own Vancouver 2024 hacking contest. Researchers at Pwn2Own challenge exploited the zero-days tagged as Type Confusion in WebAssembly (CVE-2024-2887) and Use...

The Pwn2Own Vancouver 2024 has come to an end, with researchers receiving a total of $1,132,500 for uncovering 29 distinct zero-day vulnerabilities.  Manfred Paul has been granted the title of Pwn Master. In all, he earned $202,500 and 25 points....

The Department of Defense (DoD) Cyber Crime Center (DC3) recently announced a significant milestone in its cybersecurity efforts. The processing of over 50,000 vulnerability reports since the inception of its Vulnerability Disclosure Program (VDP) in November 2016.  This program, a pioneering...

Pwn2Own 2024 Automotive is a unique event aimed at identifying and fixing flaws in connected automotive technologies. Tokyo, Japan, hosts the Pwn2Own 2024 Automotive from January 24–26, 2024. Tesla is the title sponsor, and VicOne and Trend Micro's Zero Day...