Code Analysis

veridiff/veridiff

Dynamic branch-divergence finder for native code -- traces two Frida executions and finds the exact instruction where they diverge.

zr0n/react2shell

A complete framework for exploiting the vulnerability CVE-2025-55182

owasp-noir/alibi

Cross-check the views of your attack surface and find the endpoints that cannot corroborate each other.

hackinglz/cve-2025-27237

CVE 2025 27237 Zabbix LPE proof of concept.

xv4l3x/hermit

Inspects, decompiles and structurally patches Hermes bytecode (HBC) from React Native apps, with a GDB-style REPL, CFG, decompiler and re-serializing…

al1ex/cve-2020-36184

CVE-2020-36184 && Jackson-databind RCE

seanpesce/cve-2024-22243

Example exploitable scenarios for CVE-2024-22243 affecting the Spring framework (open redirect & SSRF).

evm-sec/high-pcode

Output high level Pcode (PcodeAST) in Ghidra

dor-tumarkin/cve-2019-17564-fastjson-gadget

Basic code for creating the Alibaba FastJson + Spring gadget chain, as used to exploit Apache Dubbo in CVE-2019-17564 - more information available at…

whenx/cve-2026-0776

Security research and proof-of-concept for CVE-2026-0776 affecting Discord Desktop Client.

giovannigatti/cve-bench

A benchmark for evaluating AI agents on fixing real-world security vulnerabilities.

theori-io/reactguard

ReactGuard provides framework- and vulnerability-detection tooling for CVE-2025-55182 (React2Shell)

bankkroll/quickcheck-cve-2025-55182-react-and-cve-2025-66478-next.js

Script to quick check CVE-2025-55182 (React) and CVE-2025-66478 (Next.js) - Critical unauthenticated RCE vulnerabilities in the React Server…

jweny/cve-2022-22980

Proof-of-concept exploit for CVE-2022-22980, a remote code execution vulnerability in Spring Data MongoDB via SpEL injection in the username…

sunghoojung/reverse-engineering-browser

Local-first macOS research browser built on a custom Brave build that captures network traffic, fingerprints, scripts, and runtime evidence for…

nccgroup/lightweight_static_analysis

Create useful, lightweight static analyses using open source tools + a tiny bit of your code

openbreach/canop

Static analysis CLI that scans AI-generated code for vulnerabilities like SQL injection, unsafe reflection, and hardcoded secrets, with SARIF export…