Vesamuni is an AI-assisted security platform for vulnerability scanning, attack surface mapping, CVE monitoring, and security reporting.

Where is Vesamuni based?

Vesamuni operates from Melbourne, Australia and Colombo, Sri Lanka.

How can I subscribe to Vesamuni?

Review the available plans on the pricing page or contact Vesamuni for a custom software plan.

Cyber Intelligence Platform

See what
others can't.

AI-assisted vulnerability scanning, attack surface discovery, and CVE monitoring for teams that need clear, repeatable security checks.

Vulnerabilities reported to

Works natively with

Accepted into

Products

One team. Two ways
we keep you safe.

Takedowns takedowns.vesamuni.com ↗

Find the leaks.
Take them down.

Leak removal for creators and survivors. Scans find copies across Google, Reddit, Telegram and file hosts, and Vesamuni files the takedowns as your agent, so the people posting your content never see your name.

Anonymous DMCA filing
Google & Bing delisting
Scheduled re-checks

380,000+pirate links removed

Run a free leak scan →

Vesamuni Platform Early access

See what
others can't.

Vulnerability scanning, attack surface discovery and CVE monitoring for teams that need clear, repeatable security checks.

Attack surface mapping
CVE intelligence, synced every 15 min
Rescans that confirm the fix

Explore the platform →

Capabilities

Built for the threats that haven't happened yet.

001

Threat Cartography

Continuous mapping of your attack surface across every layer — from exposed APIs to shadow infrastructure nobody told you about.

002

Risk Prioritisation

Correlates scan findings with CVE intelligence and severity data so teams can focus on the exposures most likely to matter.

003

Automated Validation

Runs repeatable security checks and rescans to help confirm findings and verify whether remediation changed the exposed attack surface.

004

Protocol & Configuration Checks

Reviews exposed services, TLS configuration, DNS, headers, and detected technologies for common weaknesses and outdated components.

Real-Time Intelligence

The network never sleeps.

0

NVD Sync Interval

0

Scans Executed Daily

0

CVEs in Coverage Database

0

Threat Intel Feeds Integrated

Data from NIST NVD, Vulners and Tavily search.

Latest Research

Fresh from our research desk.

Recent vulnerability analysis and defensive notes from the Vesamuni research desk.

Latest research is loading.

View all research →

Ready to see
everything?

Join the organisations that refuse to be reactive. Get early access to the Vesamuni intelligence platform.

Documentation

Platform Documentation

Overview

Vesamuni is an early-stage cyber security platform that brings vulnerability scanning, CVE intelligence, attack surface discovery, and security reporting into a single dashboard.

Account access uses server-side sessions, Argon2 password hashing, CSRF protection, secure cookies, and optional authenticator-based two-factor authentication.

Getting Started

Vesamuni is currently in early access. Approved clients receive an account from the team.

Step 1
Receive and accept your client invitation.

Step 2
Sign in and add the public URL you want to monitor.

Step 3
Enable two-factor authentication from the security dashboard.

Step 4
Contact the team to confirm scan scope during early access.

Authentication

The current client dashboard uses secure server-side sessions. Public API credentials are not generally available during early access.

API Reference

A public scanning API is planned but not yet released. Current HTTP endpoints support the website, account management, billing, and internal administration.

Integrations

Stripe billing is available now. Additional workflow integrations and public SDKs are roadmap items and will be documented only when released.

About

We build what defenders need.

Vesamuni was founded with a singular conviction: the asymmetry between attackers and defenders is a design problem, not an inevitability.

What we build

Takedowns finds leaked and non-consensual content across Google, Reddit, Telegram and file hosts, and files the removal notices as the owner's agent, so creators and survivors never have to put their own name on them. More than 380,000 pirate links have been removed so far.

The Vesamuni Platform brings vulnerability scanning, CVE intelligence and attack surface discovery into one dashboard for teams that need clear, repeatable security checks.

Our research desk publishes analysis of new CVEs every day, and the team has found and reported vulnerabilities through the bug bounty programs of companies including Xiaomi, Polygon, Anduril and KOHO.

Our Philosophy

We don't believe in security theatre. Every feature should help teams discover, understand, or remediate a real exposure. Vesamuni is being built iteratively with feedback from security-minded operators and developers.

Melbourne & Colombo

We work from Melbourne, Australia and Colombo, Sri Lanka: one close to Australia's security market, one in South Asia's fast-growing tech scene.

The Name

Vesamuni (වෙසමුනි) — In Sri Lankan folklore, Vesamuni is the fearsome king of demons. He rules the Yakkas with an iron fist, commanding spirits that once spread chaos across the land. Yet he chose to protect rather than destroy — forbidding his demons from killing, transforming them into instruments of order.

Armed with a magical golden sword that flies from his hand to strike down enemies before they see it coming, Vesamuni embodies power turned to protection.

We do the same. The tools of attackers, wielded by defenders.

Careers

Join us.

We're a small team building something meaningful. If you're passionate about security and want to make an impact, we'd love to hear from you.

founders@vesamuni.com

Melbourne, Australia · Colombo, Sri Lanka · Remote

Research

Coming soon.

We're working on publishing our security research. Follow us to get notified when we release new findings.

research@vesamuni.com

Research

Security notes and threat intelligence.

New CVEs analysed every day by the Vesamuni research desk: what is affected, how severe it is, and what defenders should do. 801 posts

CVE-2026-82596: A vulnerability was determined in LatencyUtils up to 2

01/09/2026 / CVE, CWE-119, Security Research

A vulnerability was determined in LatencyUtils up to 2.0.3

ApplicationLatencyUtils

TypeSoftware weakness

Read post

CVE-2026-77956: Improper Control of Generation of Code (Code Injection

01/09/2026 / CVE, CWE-94, Security Research

Improper Control of Generation of Code (Code Injection) vulnerability in ash-project ash_ai allows a remote…

Applicationash-project ash_ai

TypeSoftware weakness

Read post

CVE-2026-82417: ### Summary

`qs.stringify` throws a `TypeError` whe

31/08/2026 / CVE, CWE-248, Security Research

#

Application### Summary `qs

TypeSoftware weakness

Read post

CVE-2026-75847: Cleartext Storage of Sensitive Information vulnerabili

31/08/2026 / CVE, CWE-312, Security Research

Cleartext Storage of Sensitive Information vulnerability in ash-project ash_paper_trail allows an attacker with read…

Applicationash-project ash_paper_trail

TypeSoftware weakness

Read post

CVE-2026-77831: Inefficient Algorithmic Complexity vulnerability in as

31/08/2026 / CVE, CWE-407, Security Research

Inefficient Algorithmic Complexity vulnerability in ash-project ash_paper_trail allows a user who can submit a large…

ApplicationInefficient Algorithmic Complexity vulnerability in ash-project ash_paper_trail

TypeSoftware weakness

Read post

CVE-2026-77970: Cleartext Storage of Sensitive Information vulnerabili

31/08/2026 / CVE, CWE-312, Security Research

Cleartext Storage of Sensitive Information vulnerability in ash-project ash_paper_trail allows an attacker with read…

Applicationash-project ash_paper_trail

TypeSoftware weakness

Read post

CVE-2026-82562: ### Summary

When `qs.parse` is called with `comma:

31/08/2026 / CVE, CWE-770, Security Research

#

Application### Summary When `qs

TypeSoftware weakness

Read post

CVE-2026-41012: Traffic interception vulnerability in BOSH Director vC

30/08/2026 / CVE, CWE-295, Security Research

Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and…

ApplicationTraffic interception vulnerability in BOSH Director vCenter CPI

TypeSoftware weakness

Read post

CVE-2026-10522: MemberHero WordPress plugin through 6.9 does not rest

30/08/2026 / CVE, Vulnerability Management, Security Research

The MemberHero WordPress plugin through 6.9 does not restrict which account fields can be supplied during its frontend…

ApplicationThe MemberHero WordPress plugin

TypeVulnerability Management

Read post

CVE-2026-16061: Rest Routes WordPress plugin through 5.5.5 does not s

30/08/2026 / CVE, CWE-89, Security Research

The Rest Routes WordPress plugin through 5.5.5 does not sanitize and validate a value taken from the URL of one of its…

ApplicationThe Rest Routes WordPress plugin

TypeSQL injection

Read post

CVE-2026-16259: Uix UserCenter WordPress plugin through 1.0.3 does not

30/08/2026 / CVE, CWE-269, Security Research

The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified through an…

ApplicationThe Uix UserCenter WordPress plugin

TypeSoftware weakness

Read post

CVE-2026-16600: SmartAIPress WordPress plugin through 1.2.0 does not p

30/08/2026 / CVE, CWE-918, Security Research

The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does…

ApplicationThe SmartAIPress WordPress plugin

TypeServer-side request forgery

Read post

CVE-2025-30156: Ceph is an open-source distributed storage platform pr

29/08/2026 / CVE, CWE-327, Security Research

Ceph is an open-source distributed storage platform providing object, block, and file storage

ApplicationCeph

TypeWeak cryptography

Read post

CVE-2026-17610: In SiSDK v2026.6.0 and earlier, high network traffic l

29/08/2026 / CVE, CWE-404, Security Research

In SiSDK v2026.6.0 and earlier, high network traffic loads can cause a dropped ACK leading to a denial of service

ApplicationIn SiSDK

TypeSoftware weakness

Read post

CVE-2026-18717: ASE2000 2.35 through 2.37 is vulnerable to an improper

29/08/2026 / CVE, CWE-295, Security Research

ASE2000 2.35 through 2.37 is vulnerable to an improper certificate validation vulnerability, which may allow an…

ApplicationASE2000

TypeSoftware weakness

Read post

CVE-2026-18965: PayRange API is missing proper authorization on manage

29/08/2026 / CVE, CWE-862, Security Research

PayRange API is missing proper authorization on management endpoints, which allows verbose details of every device on…

ApplicationPayRange API

TypeSoftware weakness

Read post

CVE-2026-38343: An integer overflow in the libavfilter/vf_scale.c comp

29/08/2026 / CVE, Vulnerability Management, Security Research

An integer overflow in the libavfilter/vf_scale.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a…

ApplicationAn integer overflow in the libavfilter/vf_scale

TypeVulnerability Management

Read post

CVE-2026-47845: In specific scenarios, Reactor Netty HTTP Server may i

28/08/2026 / CVE, CWE-290, Security Research

In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol…

ApplicationIn specific scenarios

TypeSoftware weakness

Read post

CVE-2026-47850: Spring Data REST does not preserve the persisted versi

28/08/2026 / CVE, CWE-915, Security Research

Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP…

ApplicationSpring Data REST does not preserve the persisted

TypeSoftware weakness

Read post

CVE-2026-47851: Analyzing a PDF with a deeply nested or cyclic table o

28/08/2026 / CVE, CWE-674, Security Research

Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread

Applicationthe ingestion thread

TypeSoftware weakness

Read post

CVE-2026-47852: A local attacker on a multi-user host can pre-create t

28/08/2026 / CVE, CWE-377, Security Research

A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file

ApplicationApplication not specified

TypeSoftware weakness

Read post

CVE-2026-47856: Spring Integration's JSON to object conversion uses th

28/08/2026 / CVE, CWE-502, Security Research

Spring Integration's JSON to object conversion uses the jsonTypeId header to choose the deserialization target…

ApplicationApplication not specified

TypeSoftware weakness

Read post

CVE-2026-19632: TranslatePress – Translate Multilingual sites with AI

27/08/2026 / CVE, CWE-640, Security Research

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive…

Applicationall

TypeSoftware weakness

Read post

CVE-2026-29988: A cleartext transmission of sensitive information vuln

27/08/2026 / CVE, CWE-319, Security Research

A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device…

ApplicationApplication not specified

TypeSoftware weakness

Read post

Contact

Let's talk.

Whether you're evaluating the platform, exploring a partnership, or have a security research inquiry, we'd love to hear from you.

hello@vesamuni.com

Melbourne, VIC, Australia

Colombo, Sri Lanka

Response within 24 hours

System Status

Operational Status

Website and client dashboard online

Checked when this page loaded. For anything urgent, email hello@vesamuni.com.

WebsiteOnline

Client sign-in & dashboardOnline

CVE research feed no posts yet Delayed

Takedowns separate servicetakedowns.vesamuni.com ↗

AI Guided Pentesting Platform

AI Guided Pentesting
that never stops.

Continuous security testing priced by protected asset, not by scan. Run unlimited rescans, monitor new CVEs, and use monthly AI pentest credits for deeper validation.

Monthly subscriptions. Cancel or change plan from the billing portal.

Network Security

Scout

$79/mo

per month

Network vulnerability assessment, attack surface discovery, cloud checks, and continuous CVE monitoring for small security teams.

Scanning & Testing

5 protected assets with unlimited scans and rescans during each monthly cycle
1 AI pentest scan / month — AI-guided penetration test targeting your highest-risk external asset
Full NVD database access — real-time CVE matching against your installed plugins, themes & core version
OWASP Top 10 coverage with severity scoring (Critical → Info)

Intelligence & Monitoring

NVD-backed plugin & theme vulnerability detection
WordPress core version security tracking
SSL/TLS certificate monitoring
Outdated software & end-of-life component alerts

Reporting

Basic reports — scan summary with findings, severity, and remediation steps
PDF export of scan results
Dashboard access — single-site view

Support

Email support
Vesamuni knowledge base access

Side-by-side comparison
across all tiers.

	Scout	Sentinel	Vanguard	Enterprise
Price	$79/mo	$149/mo	$249/mo	Custom
Protected Assets	5 assets	5 assets	5 assets	Unlimited
Scans & Rescans	Unlimited	Unlimited	Unlimited	Unlimited
AI Pentest Scans / mo	1	3	10	Unlimited
NVD Database Access	✓	✓	✓	✓
NVD/CVE Monitoring	—	✓	Real-time	Real-time
Reports	Basic	Weekly	Custom	Custom + Board-ready
Email Alerts	—	✓	Real-time	Real-time
API Access	—	—	Planned	Planned
Remediation Guidance	Basic	Prioritised	Priority + Context	Priority + Context
Attack Surface Discovery	—	✓	Continuous	Full ASM
Web App Scanning	WordPress	Any web asset	Full stack	Full stack + API + Cloud
Compliance Mapping	—	—	Planned	Planned
Custom Report Templates	—	—	✓	✓

Pricing Notes

Transparent Monthly Billing

Pay month to month in USD. Change or cancel through Stripe's secure billing portal.

Asset-based Allowances

Plans limit unique protected assets, not scans. Rescan covered assets as often as needed.

Researchers & Non-profits

Introductory rates for independent security researchers, academic institutions, and registered non-profits. Reach out and mention your organisation type.

Upgrades

Start on any tier and upgrade at any time. Your scan history, configurations, and discovered assets carry over seamlessly.

Enterprise

Custom software plan for larger asset allowances, additional testing credits, tailored scan schedules, onboarding, and priority product support.

Ready to see
everything?

Not sure which plan fits? Tell us what you need to protect and we will recommend one, or scope a custom plan.

Protected Workspace

Security Dashboard

Monitor your subscription, protected perimeter, and account security.

Plan Checking... Loading billing status

Protected Assets 0 / 0 No perimeter configured

Account Security Checking... Reviewing controls

Subscription Renewal Not scheduled Managed securely by Stripe

Protected Perimeter

Primary monitored asset

Pending setup

Credentials

Too Many Attempts

See whatothers can't.

One team. Two wayswe keep you safe.

Find the leaks.Take them down.

See whatothers can't.

Built for the threats that haven't happened yet.

Threat Cartography

Risk Prioritisation

Automated Validation

Protocol & Configuration Checks

The network never sleeps.

Fresh from our research desk.

Ready to seeeverything?

Platform Documentation

Contents

Overview

Getting Started

Authentication

API Reference

Integrations

We build what defenders need.

What we build

Our Philosophy

Melbourne & Colombo

The Name

Join us.

Coming soon.

Security notes and threat intelligence.

A vulnerability was determined in LatencyUtils up to 2.0.3

Improper Control of Generation of Code (Code Injection) vulnerability in ash-project ash_ai allows a remote…

#

Cleartext Storage of Sensitive Information vulnerability in ash-project ash_paper_trail allows an attacker with read…

Inefficient Algorithmic Complexity vulnerability in ash-project ash_paper_trail allows a user who can submit a large…

Cleartext Storage of Sensitive Information vulnerability in ash-project ash_paper_trail allows an attacker with read…

#

Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and…

The MemberHero WordPress plugin through 6.9 does not restrict which account fields can be supplied during its frontend…

The Rest Routes WordPress plugin through 5.5.5 does not sanitize and validate a value taken from the URL of one of its…

The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified through an…

The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does…

Ceph is an open-source distributed storage platform providing object, block, and file storage

In SiSDK v2026.6.0 and earlier, high network traffic loads can cause a dropped ACK leading to a denial of service

ASE2000 2.35 through 2.37 is vulnerable to an improper certificate validation vulnerability, which may allow an…

PayRange API is missing proper authorization on management endpoints, which allows verbose details of every device on…

An integer overflow in the libavfilter/vf_scale.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a…

In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol…

Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP…

Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread

A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file

Spring Integration's JSON to object conversion uses the json__TypeId__ header to choose the deserialization target…

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive…

A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device…

Let's talk.

Operational Status

AI Guided Pentestingthat never stops.

Side-by-side comparisonacross all tiers.

Ready to seeeverything?

Welcome back

Primary monitored asset

Change password

See what
others can't.

One team. Two ways
we keep you safe.

Find the leaks.
Take them down.

See what
others can't.

Ready to see
everything?

Spring Integration's JSON to object conversion uses the jsonTypeId header to choose the deserialization target…

AI Guided Pentesting
that never stops.

Side-by-side comparison
across all tiers.

Ready to see
everything?