#1Dependency scanning, SBOM generation, package integrity, and supply chain risk tools.
Kitploit recommended
rahulreddykarne/cve-2026-63720-datamodel-code-generatorCode injection (RCE) in datamodel-code-generator via unvalidated customBasePath (CVE-2026-63720)
saku0512/cve-2026-84361-pocProof-of-concept for CVE-2026-84361, demonstrating command injection in Composer's Perforce driver via malicious P4PORT, with Docker-based…
thedevappsecguy/log4j-mitigation-cve-2021-44228--cve-2021-45046--cve-2021-45105--cve-2021-44832Log4J CVE-2021-44228 : Mitigation Cheat Sheet
pqcworld/pqauditScan codebases for quantum-vulnerable cryptography. Detect RSA, ECDSA, Ed25519, ECDH before Q-Day. CycloneDX CBOM + SARIF output.
grassplatypus/cve-2026-45033-classCVE-2026-45033 PoC for Claude Code, not Github Copilot. Worked for Haiku 4.5.
squeeze440/terrapod-pocPoC — missing authorization on the platform-wide GPG trust-anchor store in Terrapod (GHSA-6qrc-597p-mrp9, CVE-2026-87006, CVSS 6.5).
eris-ths/supply-chain-guardDetect, assess, and respond to supply chain attacks across npm/yarn and Python (pip/poetry/uv). Claude Code skill + standalone scripts. Built during…
saku0512/cve-2026-71557-pocLocal proof-of-concept for CVE-2026-71557 demonstrating path traversal in go-git filesystem reference storage, including exploit logic and…
pvharmo2/gha-lab-83342297e0Authorized security-research lab reproducing CVE-2024-41127 (GHSA-wcjf-5464-4wq9): poisoned pipeline execution via artifact-controlled code injection…
vorburger/log4j_cve-2021-44228Curated resource hub for Log4j CVE-2021-44228, covering detection, mitigation, exploitation, and dependency management strategies for the critical…
pvharmo2/gha-lab-232af4821fSecurity-research lab reproducing CVE-2021-4281 (GHSA-3796-3f93-cfvx): shell command injection via PR head-branch name in…
pathakabhi24/llm-mcp-security-field-guideThe most comprehensive LLM + MCP security guide i.e. OWASP aligned, real CVEs, actionable checklists
j4ck3lsyn-gen2/cve-2026-13768Azure IoT Hub where exposure of an owner-level Shared Access Key enables unauthenticated remote code execution (RCE) against connected IoT devices.…
george0papasotiriou/cve-2026-8888-printer-firmware-unsigned-update-via-httpDemonstrates CVE-2026-8888, an unsigned printer firmware update over HTTP, including a malicious update server and vulnerable printer emulator for…
sourcegraph/log4j-cve-code-search-resourcesUsing code search to help fix/mitigate log4j CVE-2021-44228
pvharmo2/gha-lab-00d54c717dSecurity-research lab: CVE-2026-47172 (workflow_run pwn request in deploy.yaml) — flattened snapshot of duck-organization/questbot at 1903b2f
bakos-sandor-nx/teamcity-cve-2026-63077-remediationJetBrains TeamCity On-Premises CVE-2026-63077 Emergency Hardening & Patch Runbook Package
pvharmo2/gha-lab-5bce203f66Security-research lab: reproduction of CVE-2026-41249 (GHSA-q58j-g3f4-h26h) — pull_request_target pwn request in .github/workflows/static.yml,…
