LIVE: 4,812 reports triaged ✦ $2.1M paid out via partner programs ✦ new: Tallis Mail Gateway program open ✦ reminder: only test what you are authorised to test  ✦  LIVE: 4,812 reports triaged ✦ $2.1M paid out via partner programs ✦ new: Tallis Mail Gateway program open ✦ reminder: only test what you are authorised to test  ✦  LIVE: 4,812 reports triaged ✦ $2.1M paid out via partner programs ✦ new: Tallis Mail Gateway program open ✦ reminder: only test what you are authorised to test  ✦  LIVE: 4,812 reports triaged ✦ $2.1M paid out via partner programs ✦ new: Tallis Mail Gateway program open ✦ reminder: only test what you are authorised to test  ✦  LIVE: 4,812 reports triaged ✦ $2.1M paid out via partner programs ✦ new: Tallis Mail Gateway program open ✦ reminder: only test what you are authorised to test  ✦  LIVE: 4,812 reports triaged ✦ $2.1M paid out via partner programs ✦ new: Tallis Mail Gateway program open ✦ reminder: only test what you are authorised to test  ✦  LIVE: 4,812 reports triaged ✦ $2.1M paid out via partner programs ✦ new: Tallis Mail Gateway program open ✦ reminder: only test what you are authorised to test  ✦  LIVE: 4,812 reports triaged ✦ $2.1M paid out via partner programs ✦ new: Tallis Mail Gateway program open ✦ reminder: only test what you are authorised to test  ✦ 
φPHI CoMMφ — the vulnerability research community

Disclosures

Community reports and write-ups. Members can attach proof-of-concept code for triage. Please follow coordinated-disclosure rules and only test systems you are authorised to test.

Please log in or create an account to post.

Recent

Pinegrove CMS: stored XSS in gallery plugin (fixed in 4.2.1)

nullbyte_nick 2026-10-16

Write-up for the gallery XSS I reported in August. Vendor patched in 4.2.1 and approved publication.

Timeline: report 08-02, ack 08-03, fix 09-10.

Tallis Mail Gateway: pre-auth path traversal (coordinating)

hexa_dec 2026-10-07

Reproduced on 3.1.x. Vendor is working on a patch. Details withheld until the embargo ends; PoC is with the triage team.

Tips for writing a good reproducer

r3dsun 2026-09-23

Keep PoCs minimal, deterministic and safe to run in a VM. Include a README with exact versions and expected output. Triagers love a Dockerfile.

Northwind: IDOR on shared-link endpoint

quietpacket 2026-09-10

Sequential share IDs let you enumerate other users' links. Accepted as medium, $750 awarded.

Question: how do you handle duplicates?

0xfade 2026-08-16

Reported something that turned out to be a duplicate of a report from last year. Is there a way to search closed reports first?

Monthly roundup: September 2026

heapwalker 2026-08-02

Eleven reports triaged, seven forwarded, three paid. Thanks to everyone who helped with triage!