#1Static and dynamic code analysis, SAST, DAST, and code review tools.
Kitploit recommended
rahulreddykarne/cve-2026-65320-fastcoreDocuments CVE-2026-65320, a tar-slip path traversal in fastcore's untar_dir(), with a harmless proof-of-concept demonstrating arbitrary file write…
oscerd/cve-2026-83531Runnable Spring Boot proof-of-concept for CVE-2026-83531, demonstrating expression-language injection in Apache Camel's dynamic-router-control…
sdodson/cve-2026-46595-proofGo proof-of-concept demonstrating CVE-2026-46595 in golang.org/x/crypto/ssh, using symbol inspection of stripped binaries and image scans to verify…
fser/ghost-checkerTest wether you're exposed to ghost (CVE-2015-0235). All kudos go to Qualys Security
overgrowncarrot1/instatic-stored-xss-cve-2026-103931Proof-of-concept and analysis of a stored XSS in Instatic's isSafeUrl() URL filter, where leading C0 control characters bypass javascript: scheme…
oscerd/cve-2026-95629Runnable proof-of-concept reproducer for CVE-2026-95629, a path-traversal flaw in Apache Camel camel-docling where the output-path header reaches…
9pings/fad-checkerBuildless dependency auditor that scans 10 ecosystems offline, reporting CVEs prioritized by CISA KEV and EPSS, EOL packages, licenses, committed…
myblackmanba/cve-2021-29505对CVE-2021-29505进行复现，并分析学了下Xstream反序列化过程
hienkiet/cve-2022-21445-for-12.2.1.3.0-weblogicPre-authentication remote code execution exploit for Oracle WebLogic ADF Faces (CVE-2022-21445, CVSS 9.8). Includes detailed environment setup,…
abraxas/sqlite-fj-using-authSQLite 3.53.4 - High - Local - Privilege leftover - FULL JOIN USING skips sqlite3AuthRead
abraxas/vbox-guestctrl-copyfrom-dotdotVirtualBox 7.2.20 - High - Local - File write - Guest Control copy-from DOTDOT
nccgroup/android_demystification_toolboxADT is a toolset designed to help model application behavior, research and test security vulnerabilities, and facilitate reversing hostile code.
abraxas/opnsense-firmware-mirror-sedOPNsense 26.7.6 - High - Remote - Privilege leftover - custom firmware mirror sed-skips pkg fingerprints
abraxas/vbox-ovf-href-dest-escapeVirtualBox 7.2.20 - High - Local - File write - OVF href dest escape
al1ex/cve-2020-10673CVE-2020-10673:jackson-databind RCE
abraxas/sqlite-xfer-authSQLite 3.53.4 - High - Local - Privilege leftover - INSERT SELECT xfer skips source READ
prophetcraft/jarhunterJAR analysis tool for exploring, searching, and extracting specific classes from large JAR files with bytecode search, multi-selection extraction,…
abraxas/spark-history-store-pathApache Spark 4.2.0 - High - Remote - File write - History appStorePath unsanitized App ID
