#1Dependency scanning, SBOM generation, package integrity, and supply chain risk tools.
Kitploit recommended
pvharmo2/gha-lab-232af4821fSecurity-research lab reproducing CVE-2021-4281 (GHSA-3796-3f93-cfvx): shell command injection via PR head-branch name in…
pvharmo2/gha-lab-83342297e0Authorized security-research lab reproducing CVE-2024-41127 (GHSA-wcjf-5464-4wq9): poisoned pipeline execution via artifact-controlled code injection…
renich/pyriteHardware-bound & Cloud-gated binary execution, cryptographic provenance, and anti-tamper envelope sealing for Crystal.
jwa7470/2025-oracle-sso-ldap-attack-post-incident-written-reportPost-incident report analyzing the Oracle Cloud SSO/LDAP supply chain attack (CVE-2021-35587). Details the exploitation of legacy server…
owasp/owasp-top-10-ai-infrastructure-security-risksA practical framework identifying and prioritizing the top security risks in AI datacenter infrastructure, covering hardware, networking, management…
gouldnicholas/cve-2026-7669-pocPoC for CVE-2026-7669: SGLang silent trust_remote_code override -> RCE
joshuaasmith/reproducer-okio-cve-2023-3635Reproducer for CVE-2023-3635 in Okio 2.9.0, demonstrating how React Native's version catalog pins a vulnerable dependency, affecting Android apps.
astaruf/cve-2026-44590Proof-of-concept exploit for CVE-2026-44590, a command injection in Sherlock's GitHub Actions workflow enabling RCE and GITHUB_TOKEN exfiltration via…
surri/audit-axiosScan local repos for vulnerable axios versions (CVE-2026-40175) and patch interactively
plutosecurity/mcpwnfluenceInformation about CVE-2026-27825 & CVE-2026-27826 discovered by Pluto Security and a bash script for identifying vulnerable mcp-atlassian instances…
open-flaw/cve-2026-2395Proof-of-concept demonstrating a race condition in the tar npm package (v7.5.3) causing file collisions during parallel extraction, leading to data…
open-aims/log4jPatched Log4j 1.2.17 library with the vulnerable JMSAppender class removed to mitigate CVE-2021-4104, intended as a drop-in replacement for affected…
moisei-dev/go-dbmigrateGo library and CLI for managing database schema migrations with support for PostgreSQL, MySQL, SQLite, and Cassandra, including up/down migration…
mebibite/log4jhoundCreated after the disclosure of CVE-2021-44228. Bash script that detects Log4j occurrences in your projects and systems, allowing you to get insight…
kriskimmerle/wheelauditPython Wheel File Security Scanner — scan .whl files for security issues before installation. Detects path traversal (CVE-2026-24049), RECORD…
gouldnicholas/cve-2026-4660-pocPoC for CVE-2026-4660: arbitrary file read via git checkout in hashicorp/go-getter
bx33661/cve-2026-30039Security advisory and bilingual write-up detailing CVE-2026-30039, a symlink traversal vulnerability in rarfile affecting versions up to 4.2, leading…
boroeurnprach/cve-2026-23947-pocProof-of-concept demonstrating arbitrary code execution in Orval via malicious OpenAPI fields, with setup, exploit steps, and remediation guidance.
