Stay informed with the latest cybersecurity insights, penetration testing best practices, and security tips from our team.
With Bisheng Pro enabled, one unauthenticated request to /user/sso returns a super-admin token, because the only gate is an environment flag rather than a credential. CVSS 9.8, still unpatched — plus two cross-user disclosure flaws. Coordinated via CERT/CC as VU#166125.
Read MoreTrilium's share renderer sanitized the URL in a note's iframe but never HTML-escaped it, so a quote character in the label closed the attribute and added an onload handler. Fixed same-day by the maintainer, shipped in v0.105.0.
Read More
ISO 27001 never says "penetration test" by name, but three Annex A controls make it a practical necessity, and auditors expect a report dated within the last 12 months. What auditors actually check, how findings should feed your risk register, and the scope gaps that turn into nonconformities.
Read MoreLeantime's edit-my-own-profile method was safe in the browser and wide open over JSON-RPC, because the only thing pinning it to your account lived in a controller the API never called. Any logged-in user could reset the instance owner's password in one request. Fixed in v3.9.0.
Read MoreWe scored an Ente account takeover 9.9. The CVE record says 6.5, with no confidentiality impact, for a bug that hands over encrypted photos and 2FA seeds. Both numbers are defensible under the spec. The gap is why a base score alone sorts this class of authorization bug into the wrong pile.
Read MoreAkaunting applies whatever roles you submit when you save your own profile, with no check on whether you may assign them. Any employee or accountant login can add the admin role to itself and take over the company's books. The API path checks; the web self-update path does not. CVSS 8.1 High, fixed in 3.2.0.
Read More
The Security Rule never says "penetration test," but OCR expects testing evidence, and the proposed update would mandate annual pentests and six-month vulnerability scans for covered entities and business associates alike. What's required today, what's coming, and how to scope a HIPAA-aligned test.
Read MorePenpot's import API checks the project you own and never checks the file id you supplied. One request overwrites any file on the instance and re-parents it into the attacker's project, so the victim's design is destroyed, owned by someone else, and unreachable. CVSS 7.5 High, no patch available.
Read MoreEnte's emergency-recovery approval endpoint never checked the recovery session belonged to the caller. A former emergency contact could skip the 30-day waiting period in one request and take over the account — encrypted photos, 2FA seeds, and secrets — in under a minute. CVSS 6.5. Fixed in PR #11311.
Read MoreCal.com's webhook-create API never checks you belong to the team you name. Any authenticated user can attach a webhook to any team by its numeric id and copy every booking — attendee PII and video-call credentials — to their own URL. CVSS 9.6 Critical, no patch available.
Read MoreCasdoor's authorization filter checks the URL ?id= while the controllers act on the JSON body. One request that names a victim in another tenant lets any organization admin delete users, plant a backdoor admin, and escalate to global admin of the whole instance. CVSS 9.9 Critical, no patch available.
Read MoreA single null byte hidden inside an event handler slipped a live XSS payload past HTMLPurifier at sign-up. An unescaped admin user list did the rest. An unauthenticated attacker could register an account and take over the platform administrator's session. CVSS 9.3 Critical.
Read MoreEvery app/Policies/ file in Coolify had the same comment: "Authorization temporarily disabled." That comment was live in production. Any authenticated user on a shared Coolify instance could access, modify, and redeploy services belonging to other teams — including container image swaps that led to code execution. CVSS 8.8 High.
Read MoreAny team member can implant a persistent XSS payload in a HeyForm rich-text field. It fires silently in the team owner's browser and enables full team ownership takeover. Fixed in a commit with no public advisory and no Dependabot alert; the CVE reached NVD four months later.
Read MoreA CVE we recently published. A low-privilege user could lock every admin out of Snipe-IT through bulk user editing. How we found it, why scanners miss this class of bug, and how disclosure played out.
Read MoreA CVE we recently published. An authorization bypass in GLPI let a technician-level user delete any object in the instance — how we found it, why scanners miss this class of bug, and how disclosure played out.
Read More
PCI DSS 4.0 changed how organizations must approach penetration testing. Requirement 11.4 methodology rules, segmentation testing every six months, and what to ask your QSA — all laid out for organizations still operating on 3.2.1 habits.
Read More
The August 2, 2026 deadline for high-risk AI systems has arrived. Here's what Article 15 actually requires, who's in scope (including non-EU companies), and what changes now that it is in force.
Read More
Learn how penetration testing fits into SOC 2 compliance. Understand what auditors expect, which type of pentest satisfies SOC 2 requirements, and how to time it for your audit.
Read More
From the Brightspeed breach to a 44% surge in ransomware, North Carolina is under attack. Here's why Charlotte businesses face elevated risk.
Read More
Real pricing ranges by test type, the factors that drive cost up or down, and practical budgeting guidance for small and mid-sized businesses.
Read More
A clear, jargon-free guide explaining how penetration testing works, what to expect, and how it protects your organization.
Read More
Understand the key differences between penetration testing and vulnerability assessments. Learn which approach is right for your organization.
Read MoreTalk to the tester who would run your engagement — not a salesperson. Fifteen minutes is usually enough to scope it.