Published file metadata, source observations, indicators, and research history in one bounded catalog.
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
2 sources: 0 stale, 0 needing attention, 0 paused, 0 unverified.
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
Over the past couple of years, we’ve seen multiple reports that Apple was working on a new smart home product, but now it seems the product has a name and a launch date.
First reported Oct 11, 2026 21:14 UTCCatalog metadata updated Oct 13, 2026 11:59 UTCOpen evidence recordThis Battlefield 200 startup has developed blood-purification tech to save children.
First reported Oct 11, 2026 15:00 UTCCatalog metadata updated Oct 13, 2026 11:59 UTCOpen evidence recordUltrahuman and Abu Dhabi will spend the next two years working on research and clinical validation of the model.
First reported Oct 12, 2026 14:09 UTCCatalog metadata updated Oct 13, 2026 11:59 UTCOpen evidence recordGoogle’s newest wearable costs $179.99 and has a sleek feel like the Fitbit Air but with an OLED display.
First reported Oct 12, 2026 15:11 UTCCatalog metadata updated Oct 13, 2026 11:59 UTCOpen evidence recordI'm delighted to introduce Alex, my fellow swigger who I've collaborated with in the past with tools like DOM Invader. He showed me that it's possible to exfiltrate larger tokens than demonstrated in
First reported Oct 05, 2026 15:04 UTCCatalog metadata updated Oct 13, 2026 11:57 UTCOpen evidence recordSome websites parse email addresses to extract the domain and infer which organisation the owner belongs to. This pattern makes email-address parser discrepancies critical. Predicting which domain an
First reported Aug 07, 2024 21:32 UTCCatalog metadata updated Oct 13, 2026 11:57 UTCOpen evidence recordHave you ever found an HTTP desync vulnerability that seemed impossible to exploit due to its complicated constraints? In this blogpost we will explore a new exploitation technique that can be used to
First reported Mar 19, 2024 14:00 UTCCatalog metadata updated Oct 13, 2026 11:57 UTCOpen evidence recordNominations are now open for the top 10 new web hacking techniques of 2024! Every year, security researchers from all over the world share their latest findings via blog posts, presentations, PoCs, an
First reported Jan 08, 2025 14:07 UTCCatalog metadata updated Oct 13, 2026 11:57 UTCOpen evidence recordI was on my laptop, as I often am when there's rubbish on telly, and found myself wondering what characters are allowed in a tag. I knew they had to begin with "a-zA-Z", but what about after that? I t
First reported Aug 25, 2026 14:24 UTCCatalog metadata updated Oct 13, 2026 11:57 UTCOpen evidence recordLast year Johan Carlsson discovered you could conceal payloads inside the credentials part of the URL . This was fascinating to me especially because the payload is not actually visible in the URL in
First reported Oct 23, 2024 12:59 UTCCatalog metadata updated Oct 13, 2026 11:57 UTCOpen evidence recordUpdate: nominations are now closed, and voting is live! Cast your vote here Over the last year, security researchers have shared a huge amount of work with the community through blog posts, presentati
First reported Jan 06, 2026 15:31 UTCCatalog metadata updated Oct 13, 2026 11:57 UTCOpen evidence recordThrough the years, we have seen many attacks exploiting web caches to hijack sensitive information or store malicious payloads. However, as CDNs became more popular, new discrepancies between propriet
First reported Aug 08, 2024 22:27 UTCCatalog metadata updated Oct 13, 2026 11:57 UTCOpen evidence recordMany testers and tools give up the moment a protocol upgrade to WebSocket occurs, or only perform shallow analysis. This is a huge blind spot, leaving many bugs like Broken Access Controls, Race condi
First reported Sep 17, 2025 12:40 UTCCatalog metadata updated Oct 13, 2026 11:57 UTCOpen evidence recordSigned web tokens are widely used for stateless authentication and authorization throughout the web. The most popular format is JSON Web Tokens (JWT) which we've already covered in depth, but beyond t
First reported May 22, 2024 12:37 UTCCatalog metadata updated Oct 13, 2026 11:57 UTCOpen evidence recordWelcome to the Top 10 Web Hacking Techniques of 2023, the 17th edition of our annual community-powered effort to identify the most innovative must-read web security research published in the last year
First reported Feb 19, 2024 14:31 UTCCatalog metadata updated Oct 13, 2026 11:57 UTCOpen evidence recordIn this post we'll show you how to bypass CSP by using an often overlooked technique that can enable password theft in a seemingly secure configuration. What is form hijacking? Form hijacking isn't re
First reported Mar 05, 2024 14:55 UTCCatalog metadata updated Oct 13, 2026 11:57 UTCOpen evidence recordAbstract We all know AI can find bugs. After a decade of research, I asked a harder question: can an autonomous system invent new attack techniques, and use them to hack live websites at scale? Buildi
First reported Aug 05, 2026 19:30 UTCCatalog metadata updated Oct 13, 2026 11:57 UTCOpen evidence recordHTTP Anomaly Rank If you've ever used Burp Intruder or Turbo Intruder, you'll be familiar with the ritual of manually digging through thousands of responses by repeatedly sorting the table via length,
First reported Nov 11, 2025 14:41 UTCCatalog metadata updated Oct 13, 2026 11:57 UTCOpen evidence recordGareth Heyes - gareth.heyes@portswigger.net - @garethheyes It's quite common for webmail clients to render untrusted CSS in a trusted UI. They attempt to make this safe using CSS sanitization. In this
First reported Aug 06, 2026 22:00 UTCCatalog metadata updated Oct 13, 2026 11:57 UTCOpen evidence recordTLDR This post shows how to achieve a full authentication bypass in the Ruby and PHP SAML ecosystem by exploiting several parser-level inconsistencies: including attribute pollution, namespace confusi
First reported Dec 10, 2025 12:32 UTCCatalog metadata updated Oct 13, 2026 11:57 UTCOpen evidence recordTired of repeating yourself? Automate your web security audit trail. In this post I'll introduce a new Burp AI extension that takes the boring bits out of your pen test. Web security testing can be a
First reported Apr 23, 2025 13:17 UTCCatalog metadata updated Oct 13, 2026 11:57 UTCOpen evidence recordWelcome to the Top 10 Web Hacking Techniques of 2024, the 18th edition of our annual community-powered effort to identify the most innovative must-read web security research published in the last year
First reported Feb 04, 2025 15:01 UTCCatalog metadata updated Oct 13, 2026 11:57 UTCOpen evidence recordAbstract In this paper we’ll show that HTTP Header Injection is severely underestimated. Forget open redirects or Cross-Site Scripting and instead, embrace the catastrophic potential of the CRLF-Power
First reported Aug 05, 2026 23:30 UTCCatalog metadata updated Oct 13, 2026 11:57 UTCOpen evidence recordAbstract Upstream HTTP/1.1 is inherently insecure and regularly exposes millions of websites to hostile takeover. Six years of attempted mitigations have hidden the issue, but failed to fix it. This p
First reported Aug 06, 2025 22:20 UTCCatalog metadata updated Oct 13, 2026 11:57 UTCOpen evidence recordThe public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.