DC3 VDP

Official X account of the U.S. DoD Vulnerability Disclosure Program (VDP).

[DC3 VDP @DC3VDP]

APR 2026 Critical Server-Side Template Injection (SSTI) vulnerabilities have been observed within the DIB space. SSTI affects web applications that use template engines for dynamic content rendering. SSTI occurs when user input is embedded without proper sanitization.

[DC3 VDP @DC3VDP]

APR 2026 @DeptofDefense Vulnerability Disclosure Program #VDP @Hacker0x01 #Hackers reported a critical severity vulnerability identifying a weakness in the sqlExpressions feature of select Grafana instances, CVE-2026-27876. Read all about it in the #Knowledgebyte.

[DC3 VDP @DC3VDP]

Big thanks to @dmDUSTBIN for the excellent discovery of an Open Redirect via Encoded Path Injection.Findings like this highlight how small URL handling flaws can lead to serious security exposure/potential phishing risk. Security research like this helps strengthen the entire DIB

[DC3 VDP @DC3VDP]

Huge congratulations to @CISOluke for being named Researcher of the Month. @CISOluke is being recognized for discovering an unsecured API which allowed them to obtain username/password hash combinations, including users with administrative privileges. Well deserved #CyberSecurity

[DC3 VDP @DC3VDP]

MAR 2026-A critical vulnerability impacting Cisco Catalyst SD-WAN systems has been identified across the DIB. CVE-2026-20127 is an authentication bypass exploited by nation-state actors since 2023. Per CISA ED 26-03 & NSA advisory, patch & hunt now. #KnowledgeByte #DIB

[DC3 VDP @DC3VDP]

MAR 2026 @DeptofDefense Vulnerability Disclosure Program #VDP @Hacker0x01 #Hackers reported a critical severity access control vulnerability that led to the capture of authentications tokens within the Strapi CMS framework. Read all about it in the #Knowledgebyte

[DC3 VDP @DC3VDP]

Big thanks to @mdjab3r for identifying a missing DMARC record. Without DMARC, domains are far more vulnerable to email spoofing, phishing, and brand impersonation—putting users and organizations at serious risk. #DIBVDP #CyberSecurity #InfoSec #WebSecurity #EthicalHacking

[DC3 VDP @DC3VDP]

Huge congratulations 2 @Daniel_Farinax 4 being named Researcher of the Month. They are being recognized 4 finding a way 2 obtain unauthenticated CRUD access 2 DoD training articles. This vulnerability was made possible through use of an open user registration API. Well deserved!

[DC3 VDP @DC3VDP]

Congrats to @kaenne__ on winning Researcher of the Year! 🏆 His Authentication Bypass via Response Manipulation showed how altering a server's 200 OK response could grant unauthorized admin panel access, a critical flaw that can lead to full system compromise. #DIBVDP #Infosec

[DC3 VDP @DC3VDP]

DC3 VDP is happy 2 award Researcher of the Year to Jared Hrabak (H1 user Badlifeguard). Jared discovered a GraphQL vulnerability which would've allowed an actor 2 harvest VAST amounts of highly sensitive PII associated w/military personnel across multiple branches. Amazing work!

[DC3 VDP @DC3VDP]

Feb 2026: @DeptofDefense #DIBVDP identified a critical vuln affecting web apps using template engines. Improper input sanitization in server-side templates can allow arbitrary command execution. Learn more in the #Knowledgebyte

[DC3 VDP @DC3VDP]

FEB 2026 @DeptofDefense Vulnerability Disclosure Program #VDP @Hacker0x01 #Hackers reported a critical vulnerability identifying remnant database files that could be used to reconstruct sensitive data. Read all about it in the #Knowledgebyte

[DC3 VDP @DC3VDP]

Huge congratulations to https://t.co/bXPlyQQqOb
for being named Researcher of the Month. Jansson
is being recognized for finding a way to achieve privilege escalation on the target website via use of an exposed email verification token. 🔥📷 Well deserved! #CyberSecurity #VDP

[DC3 VDP @DC3VDP]

Shoutout 2 @kaanmert9 4 uncovering an SSTI vulnerability on /contact-us/ where user input could trigger arbitrary code execution. Exploits like this can lead 2 server takeover, data theft/lateral movement. Great catch protecting the ecosystem! #DIBVDP #CyberSecurity #InfoSec

[DC3 VDP @DC3VDP]

JAN 2026, @DeptofDefense #DIBVDP – uncovered an authentication bypass vulnerability that could let attackers gain unauthorized access and escalate privileges. Critical reminder of the importance of robust access controls. Read all about it in the #Knowledgebyte

[DC3 VDP @DC3VDP]

JAN 2026 @DeptofDefense Vulnerability Disclosure Program #VDP @Hacker0x01 #Hackers reported a critical severity submission for a permission issue that would allow for the retrieval of unauthorized files with a known file identifier. Read all about it in the #Knowledgebyte

[DC3 VDP @DC3VDP]

Milestone unlocked! The DIB Vulnerability Disclosure Program has surpassed 1,000 valid vulnerability submissions; huge win 4 crowdsourced cybersecurity/a major step in protecting our national security infrastructure. Massive thanx 2 the talented researchers who made it possible!

[DC3 VDP @DC3VDP]

Shoutout to @kaenne__ for identifying a dangerous auth bypass vector. Real world impact here is massive — from compromised user sessions to full application abuse if left unpatched. Research like this keeps the ecosystem resilient. #DIBVDP #CyberSecurity #Infosec #WebSecurity

[DC3 VDP @DC3VDP]

Big shoutout 2 @ItsKenshin04 4 snagging Researcher of the Month with the DoD Vulnerability Disclosure Program! @ItsKenshin04 found an IDOR vulnerability allowing them 2 view/download vast quantities of sensitive PII, i.e. finance related details in connection 2 military personnel

[DC3 VDP @DC3VDP]

DEC 2025 @DeptofDefense #DIBVDP observed industry reporting on React2Shell-critical remote code execution vulnerability impacting applications using React Server Components. The vulnerability stems from improper validation/handling of server-side component requests.#Knowledgebyte