Too Many Attempts

Please wait before trying again

30
Cyber Intelligence Platform

See what
others can't.

AI-assisted vulnerability scanning, attack surface discovery, and CVE monitoring for teams that need clear, repeatable security checks.

All Systems Operational · Threat Level Nominal
Threat IntelligenceAttack Surface MappingAutonomous ResponseZero-Day DetectionNetwork ForensicsAdversary SimulationVulnerability OrchestrationContinuous MonitoringThreat IntelligenceAttack Surface MappingAutonomous ResponseZero-Day DetectionNetwork ForensicsAdversary SimulationVulnerability OrchestrationContinuous Monitoring
Collaborating with global innovators
Working natively with leading platforms
Accepted into global startup programs
NVIDIA
Inception Program
Zendesk
for Startups
Capabilities

Built for the threats that haven't happened yet.

001

Threat Cartography

Continuous mapping of your attack surface across every layer — from exposed APIs to shadow infrastructure nobody told you about.

002

Risk Prioritisation

Correlates scan findings with CVE intelligence and severity data so teams can focus on the exposures most likely to matter.

003

Automated Validation

Runs repeatable security checks and rescans to help confirm findings and verify whether remediation changed the exposed attack surface.

004

Protocol & Configuration Checks

Reviews exposed services, TLS configuration, DNS, headers, and detected technologies for common weaknesses and outdated components.

005

Adversary Emulation

Continuous red-team operations powered by threat actor profiles. We think like them so you don't have to.

006

Sentinel Protocol

Distributed sensor mesh across your infrastructure. Silent watchers that leap into action the moment anomalies surface.

Real-Time Intelligence

The network never sleeps.

0
NVD Sync Interval
0
Scans Executed Daily
0
CVEs in Coverage Database
0
Threat Intel Feeds Integrated
Latest Research

Fresh from our research desk.

Recent vulnerability analysis and defensive notes from the Vesamuni research desk.

Latest research is loading.
View all research →
Our Approach

Defence in depth,
by design.

01

Map

Comprehensive reconnaissance of your digital terrain. We discover assets, dependencies, and exposures across cloud, on-prem, and hybrid environments.

02

Analyse

Contextual risk scoring powered by threat intelligence feeds, adversary TTPs, and your unique business logic. Not just CVEs — real-world exploitability.

03

Fortify

Automated hardening recommendations deployed through your existing CI/CD pipeline. Security becomes part of the build, not an afterthought.

04

Evolve

Continuous learning from global threat landscapes. The platform adapts its defensive posture as adversary capabilities shift and new vectors emerge.

Ready to see
everything?

Join the organisations that refuse to be reactive. Get early access to the Vesamuni intelligence platform.

Powered By

Built on industry-leading intelligence.

We integrate with the world's most trusted security data sources and infrastructure providers to deliver comprehensive threat intelligence.

Tavily

AI-native search API powering real-time threat research and exploit discovery across the web.

tavily.com

NVD

NIST National Vulnerability Database providing authoritative CVE data, CVSS scores, and security advisories.

nvd.nist.gov

Vulners

Comprehensive vulnerability intelligence with exploit databases, patch tracking, and threat correlation.

vulners.com

ngrok

Secure tunneling infrastructure enabling real-time webhook delivery and agent connectivity.

ngrok.com
Documentation

Platform Documentation

Contents

OverviewGetting StartedAuthenticationAPI ReferenceIntegrations

Overview

Vesamuni is an early-stage cyber security platform that brings vulnerability scanning, CVE intelligence, attack surface discovery, and security reporting into a single dashboard.

Account access uses server-side sessions, Argon2 password hashing, CSRF protection, secure cookies, and optional authenticator-based two-factor authentication.

Getting Started

Vesamuni is currently in early access. Approved clients receive an account from the team.

Step 1
Receive and accept your client invitation.

Step 2
Sign in and add the public URL you want to monitor.

Step 3
Enable two-factor authentication from the security dashboard.

Step 4
Contact the team to confirm scan scope during early access.

Authentication

The current client dashboard uses secure server-side sessions. Public API credentials are not generally available during early access.

API Reference

A public scanning API is planned but not yet released. Current HTTP endpoints support the website, account management, billing, and internal administration.

Integrations

Stripe billing is available now. Additional workflow integrations and public SDKs are roadmap items and will be documented only when released.

About

We build what defenders need.

Vesamuni was founded with a singular conviction: the asymmetry between attackers and defenders is a design problem, not an inevitability.

Our Philosophy

We don't believe in security theatre. Every feature should help teams discover, understand, or remediate a real exposure. Vesamuni is being built iteratively with feedback from security-minded operators and developers.

Global Presence

We operate from Melbourne, Australia and Colombo, Sri Lanka. Our distributed startup team combines product development with security research across the APAC region.

Why Two Continents?

Melbourne connects us to Australia's security market. Colombo connects us to South Asia's rapidly growing tech ecosystem. The two locations give the team access to different customers, talent pools, and perspectives.

The Name

Vesamuni (වෙසමුනි) — In Sri Lankan folklore, Vesamuni is the fearsome king of demons. He rules the Yakkas with an iron fist, commanding spirits that once spread chaos across the land. Yet he chose to protect rather than destroy — forbidding his demons from killing, transforming them into instruments of order.

Armed with a magical golden sword that flies from his hand to strike down enemies before they see it coming, Vesamuni embodies power turned to protection.

We do the same. The tools of attackers, wielded by defenders.

Careers

Join us.

We're a small team building something meaningful. If you're passionate about security and want to make an impact, we'd love to hear from you.

founders@vesamuni.com

Melbourne, Australia · Colombo, Sri Lanka · Remote

Research

Coming soon.

We're working on publishing our security research. Follow us to get notified when we release new findings.

research@vesamuni.com
24/08/2026 / CVE, CWE-22, Security Research

CVE-2026-18027: WebToffee WooCommerce PDF Invoices, Packing Slips, Del

By Vesamuni Research / Updated 24/08/2026
CVE-2026-18027: WebToffee WooCommerce PDF Invoices, Packing Slips, Del

CVE-2026-18027 analysis covering impact, affected products, versions, remediation, and cross-checked defender guidance.

CVE-2026-18027 is a vulnerability published by NVD on 8/23/2026.

What happened

The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.9.8 via the get_image_src_in_base64 function. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The base64-encoded file contents are embedded into the cached invoice HTML and served directly to the attacker via the plugin's own Print/Download invoice endpoints, which require only a valid nonce and access key.

Affected products and versions

  • NVD has not published a normalized affected-product configuration yet.

Severity and weakness

CVSS: MEDIUM 6.5. Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Weaknesses: CWE-22.

Known exploitation

No CISA KEV entry is currently attached to the NVD record.

What defenders should do

  1. Identify whether the affected product and version range exists in production.
  2. Review vendor advisories and release notes before change windows.
  3. Patch, upgrade, disable the vulnerable component, or apply vendor mitigations.
  4. Verify the running version after deployment, not only the package inventory.

Official and supporting references

  • No vendor advisory tagged by NVD at draft time.

Source record

CVECWE-22Security Research
Back to blog
Contact

Let's talk.

Whether you're evaluating the platform, exploring a partnership, or have a security research inquiry, we'd love to hear from you.

hello@vesamuni.com
Melbourne, VIC, Australia
Colombo, Sri Lanka
Response within 24 hours
Required.
Valid email required.
Required.
System Status

Operational Status

All Systems Operational
Threat Intelligence APIOperational
Scan EngineOperational
DashboardOperational
Webhook DeliveryOperational
AuthenticationOperational
CLI / SDKOperational
AI Guided Pentesting Platform

AI Guided Pentesting
that never Stops.

Continuous security testing priced by protected asset, not by scan. Run unlimited rescans, monitor new CVEs, and use monthly AI pentest credits for deeper validation.

Monthly subscriptions. Cancel or change plan from the billing portal.

Network Security
Scout
$79/mo
per month

Network vulnerability assessment, attack surface discovery, cloud checks, and continuous CVE monitoring for small security teams.

Scanning & Testing
  • 5 protected assets with unlimited scans and rescans during each monthly cycle
  • 1 AI pentest scan / month — AI-guided penetration test targeting your highest-risk external asset
  • Full NVD database access — real-time CVE matching against your installed plugins, themes & core version
  • OWASP Top 10 coverage with severity scoring (Critical → Info)
Intelligence & Monitoring
  • NVD-backed plugin & theme vulnerability detection
  • WordPress core version security tracking
  • SSL/TLS certificate monitoring
  • Outdated software & end-of-life component alerts
Reporting
  • Basic reports — scan summary with findings, severity, and remediation steps
  • PDF export of scan results
  • Dashboard access — single-site view
Support
  • Email support
  • Vesamuni knowledge base access
Most Popular
Web, API & Network
Sentinel
$149/mo
per month

AI-guided security with unlimited automated scans. Broader coverage across your full web presence with weekly reporting and real-time CVE alerting.

Scanning & Testing
  • 5 protected assets with unlimited vulnerability scans and rescans
  • 3 AI pentest scans / month — AI-guided penetration testing with intelligent attack path discovery
  • Full NVD/CVE monitoring — real-time matching against your tech stack
  • Web application scanning — beyond WordPress, covers any web-facing asset
  • OWASP Top 10 + CWE coverage with AI-validated findings
Intelligence & Monitoring
  • NVD/CVE monitoring — continuous tracking of new vulnerabilities affecting your stack
  • Real-time CVE alerting via email alerts
  • Attack surface enumeration — subdomain & exposed service discovery
  • SSL/TLS, DNS & domain expiry monitoring
  • Technology fingerprinting & version detection
Reporting
  • Weekly reports — executive summary with risk trends, new findings & remediation progress
  • Severity-prioritised remediation guidance
  • PDF & dashboard export
  • Multi-asset dashboard view
Support
  • Email alerts — instant notification on critical & high findings
  • Priority email support
  • Vesamuni knowledge base access
Full-cycle Pentesting
Vanguard
$249/mo
per month

Deep vulnerability testing and reporting with the highest self-service AI pentest allowance, continuous asset monitoring, API access, and configurable exports.

Scanning & Testing
  • 5 protected assets with unlimited vulnerability scans and rescans
  • 10 AI pentest scans / month — deep AI-guided penetration testing with multi-vector attack simulation
  • Real-time NVD/CVE alerts — instant notification when new vulnerabilities affect your environment
  • Full web application, API & infrastructure scanning
  • AI-driven false positive elimination with proof-of-exploit validation
  • On-demand re-scans after remediation (unlimited)
Intelligence & Monitoring
  • Continuous dashboard visibility into monitored assets and findings
  • Continuous attack surface discovery & asset enumeration
  • Threat intelligence feed — CVE tracking + emerging threat advisories
  • Technology stack fingerprinting & change detection
  • SSL/TLS, DNS, domain & certificate transparency monitoring
Reporting & API
  • Custom reports — configurable report templates with branding, scope & audience controls
  • API access — full REST API for scan orchestration, results retrieval & webhook integration
  • Priority remediation guidance — risk-ranked action items with context & fix recommendations
  • Compliance alignment mapping (ISO 27001, SOC 2, PCI-DSS indicators)
  • Risk trend dashboards with historical comparison
  • PDF, CSV & JSON export
Support
  • Priority email + chat support
  • Dedicated onboarding & configuration assistance
  • Vesamuni Threat Advisory bulletins
  • Early access to new platform features
Custom Platform Plan
Enterprise
Custom
tailored to your environment

A custom software plan for larger asset inventories, additional testing capacity, tailored scan schedules, and product onboarding. Scope and limits are agreed before activation.

Scanning & Testing
  • Custom protected asset allowance based on your scope
  • Unlimited automated rescans across included assets
  • Custom monthly AI pentest credit allowance
  • Web application, API, infrastructure, WordPress, SSL/TLS, and cloud checks
  • Configurable scheduled scans and finding notifications
  • AI-assisted finding review and remediation guidance
  • Custom scan profiles for industry-specific threat models
Monitoring & Workflow
  • Continuous attack surface discovery and risk scoring
  • Email alerts for new critical and high-severity findings
  • Scan history and risk trend comparison
  • Webhook-based workflow integration
Reporting & API
  • Custom reports & API access — full REST API, configurable templates and structured output
  • Compliance control mapping indicators for supported frameworks
  • Executive risk summaries and historical trend reporting
  • PDF, CSV, and JSON exports
Product Support
  • Priority email support during published business hours
  • Remote onboarding and configuration assistance
  • Product feedback and roadmap sessions
  • Early access to all new Vesamuni modules & features
At a glance

Side-by-side comparison
across all tiers.

Scout Sentinel Vanguard Enterprise
Price $79/mo $149/mo $249/mo Custom
Protected Assets 5 assets 5 assets 5 assets Unlimited
Scans & Rescans Unlimited Unlimited Unlimited Unlimited
AI Pentest Scans / mo 1 3 10 Unlimited
NVD Database Access ✓ ✓ ✓ ✓
NVD/CVE Monitoring — ✓ Real-time Real-time
Reports Basic Weekly Custom Custom + Board-ready
Email Alerts — ✓ Real-time Real-time
API Access — — ✓ Full + Webhooks
Remediation Guidance Basic Prioritised Priority + Context Priority + Context
Attack Surface Discovery — ✓ Continuous Full ASM
Web App Scanning WordPress Any web asset Full stack Full stack + API + Cloud
Compliance Mapping — — ✓ Control indicators
Custom Report Templates — — ✓ ✓
Pricing Notes
Transparent Monthly Billing

Pay month to month in USD. Change or cancel through Stripe's secure billing portal.

Asset-based Allowances

Plans limit unique protected assets, not scans. Rescan covered assets as often as needed.

Researchers & Non-profits

Introductory rates for independent security researchers, academic institutions, and registered non-profits. Reach out and mention your organisation type.

Upgrades

Start on any tier and upgrade at any time. Your scan history, configurations, and discovered assets carry over seamlessly.

Enterprise

Custom software plan for larger asset allowances, additional testing credits, tailored scan schedules, onboarding, and priority product support.

Ready to see
everything?

Join the organisations that refuse to be reactive. Get early access to the Vesamuni intelligence platform.

Protected Workspace

Security Dashboard

Monitor your subscription, protected perimeter, and account security.

Plan Checking... Loading billing status
Protected Assets 0 / 0 No perimeter configured
Account Security Checking... Reviewing controls
Subscription Renewal Not scheduled Managed securely by Stripe
Protected Perimeter

Primary monitored asset

Pending setup

HTTPS is recommended. Private network and local addresses are rejected.

Credentials

Change password

At least 12 characters Passwords match Different from current password

Changing your password invalidates every other active session.

🐸