Vulnerability news
Official RSS only. We keep the title, source, date, and link. No scraped article bodies.
Reading
External pages, listed with the hunt or skill they belong to. The article stays on the original site.
- Access control labs - PortSwigger Web Security Academy. The lab path for a two-account object check. Read it, then use the access-control skill for the stop condition.
- OAuth labs - PortSwigger Web Security Academy. Authorization-code and redirect labs. The vulns.co skill adds DPoP, mix-up, and the rule that you do not reuse a code.
- Web cache deception - PortSwigger Web Security Academy. Private response stored at a URL the cache treats as static. File it separately from poisoning.
- Web cache poisoning - PortSwigger Web Security Academy. Unkeyed input that changes what other users receive. Not the same bug as deception.
- Cross-site scripting labs - PortSwigger Web Security Academy. Use the labs for the class. On a real target, start from the saved bundle and the line number, not from a payload list.
- Server-side request forgery labs - PortSwigger Web Security Academy. SSRF labs for the request boundary. Pair them with /hunt/ssrf/.
- JWT attacks - PortSwigger Web Security Academy. Token parsing labs. Pair with the session skill when the cookie or the token is the session.
- Race conditions - PortSwigger Web Security Academy. Limit-overrun and single-use token labs. Pair them with /hunt/race/.
- GraphQL labs - PortSwigger Web Security Academy. Introspection is inventory. The finding is an operation on an object the caller does not own.
- Disclosed reports - HackerOne Hacktivity. The public stream of real reports. Read the proof shape, then match it to a vulns.co skill. Do not copy a payload into a test.
Vulnerability news
Headlines from official RSS (CISA, vendor PSIRTs, security outlets). We keep title, source, date, and link. No scraped article bodies.
Machine feed: /data/news.live.json.
The live list loads from the Worker overlay. The reading list above is in the page.