Skip to content

Developments

Company announcements and posts from the past 30 days.

For xalgorix/xalgorix All projects

More filters
Reset

23 updates · By announcement or publication date

ProjectUpdateDate
xalgorix/xalgorixA signed token is not proof: verifying OpenID Connect relying-party flaws ↗Company post · xalgorix.comPublished
xalgorix/xalgorixA passed check is not proof: the SSRF filter that resolves DNS twice ↗Company post · xalgorix.comPublished
xalgorix/xalgorixWeekly AppSec Threat Digest: WordPress Upgrade RCE in KEV, Rails File Write, Ivanti Zero-Days ↗Company post · xalgorix.comPublished
xalgorix/xalgorixAn alert(1) is not proof: verifying an exploitable cross-site scripting vulnerability ↗Company post · xalgorix.comPublished
xalgorix/xalgorixAn error is not proof: verifying an exploitable SQL injection ↗Company post · xalgorix.comPublished
xalgorix/xalgorixA limit that broke once is not proof: verifying web race conditions ↗Company post · xalgorix.comPublished
xalgorix/xalgorixAn accepted upload is not proof: verifying an exploitable file upload ↗Company post · xalgorix.comPublished
xalgorix/xalgorixA 9.8 is not a priority: ranking vulnerabilities by exploitability, not CVSS ↗Company post · xalgorix.comPublished
xalgorix/xalgorixA missing token is not proof: verifying a CSRF vulnerability ↗Company post · xalgorix.comPublished
xalgorix/xalgorixA parsed entity is not proof: verifying XML external entity injection ↗Company post · xalgorix.comPublished
xalgorix/xalgorixWeekly AppSec Threat Digest: PHP2Shell Hits KEV, Cisco ASA Zero-Day, GitLab & Drupal Exploited ↗Company post · xalgorix.comPublished
xalgorix/xalgorixAn echoed instruction is not proof: verifying prompt injection in LLM applications ↗Company post · xalgorix.comPublished
xalgorix/xalgorixA reachable admin function is not proof: verifying broken function level authorization ↗Company post · xalgorix.comPublished
xalgorix/xalgorixA reflected Origin is not proof: verifying an exploitable CORS misconfiguration ↗Company post · xalgorix.comPublished
xalgorix/xalgorixA 302 is not proof: verifying an OAuth redirect_uri account takeover ↗Company post · xalgorix.comPublished
xalgorix/xalgorixA timing blip is not proof: safely confirming HTTP request smuggling ↗Company post · xalgorix.comPublished
xalgorix/xalgorix{{7*7}} is not RCE: how to actually prove server-side template injection ↗Company post · xalgorix.comPublished
xalgorix/xalgorixA 200 is not proof: verifying IDOR and broken object level authorization ↗Company post · xalgorix.comPublished
xalgorix/xalgorixWeekly AppSec Threat Digest: PHP2Shell RCE, VeloCloud Zero-Day, Plex2Shell & GitLab ↗Company post · xalgorix.comPublished
xalgorix/xalgorixGraphQL security beyond introspection: batching, aliasing, and limits that hold ↗Company post · xalgorix.comPublished
xalgorix/xalgorixFrom “possible SSRF” to proof: how to verify server-side request forgery ↗Company post · xalgorix.comPublished
xalgorix/xalgorixWeekly AppSec Threat Digest: Ivanti, Cisco & BeyondTrust Zero-Days, Next.js RCE ↗Company post · xalgorix.comPublished
xalgorix/xalgorixWeekly AppSec Threat Digest — Oct 2–9, 2026 ↗Company post · xalgorix.comPublished
About this feed

Dates use the announcement date when known, otherwise the source publication date. Company posts come from official sources. Other reporting is reviewed for a company match. Coverage depends on accessible public sources.