Working cryptographers on real protocol and implementation flaws.

Conference archive; the year's significant offensive research.

Deep vulnerability research writeups; the reference standard for the genre.

Novel web attack classes, often defining the technique everyone later uses.

Rapid7's vulnerability research and product security blog.

Fast, blunt writeups on edge-device and enterprise software vulnerabilities.

Authoritative US advisories on exploited vulnerabilities and ICS issues.

The KEV catalog — what is actually being exploited, not just scored.

Archive of public exploits and vulnerable software, maintained by Offensive Security.