llm-agent-testbed
pie-script/llm-agent-testbedAn empirical security testbed evaluating prompt injection, confused-deputy vulnerabilities, and tool-calling defenses in LLM agents.
ai-securityapi-securityeducation+4
9
pie-script/llm-agent-testbedAn empirical security testbed evaluating prompt injection, confused-deputy vulnerabilities, and tool-calling defenses in LLM agents.
juanlunaia/aegis-latent-coreAI governance and evidence gateway for multi-provider LLM applications. FastAPI + optional Rust core for policy, WAF, egress, rate limits, sessions,…
keraattin/cve-2026-33032One missing function call on the route registration was enough to turn the MCP interface into an unauthenticated RCE gateway.
wa6n3r/cve-2026-35616Exploit script for CVE-2026-35616 that bypasses certificate chain verification in Fortinet API by discovering valid CNs, generating a forged client…
filipegaudard/cve-2026-30945-pocProof-of-concept exploit for CVE-2026-30945, an IDOR in StudioCMS allowing arbitrary API token revocation and denial of service. Includes manual and…
arian-gogani/enforcement-coverageFinds API routes carrying weaker authorization than their siblings. Recovered CVE-2026-45316 from source. Includes the negative results.
ransomleak/training-application-securityInteractive secure coding training with hands-on SCORM exercises covering OWASP Top 10 web and API vulnerabilities, Git/secrets exposure, and…
bsdrip/cve-2026-40179-pocMinimal Python PoC for CVE-2026-40179: injects a malicious metric name via unauthenticated Prometheus remote_write to trigger stored XSS in the web…
hereticl1nk/eits-portal-exploit-cve-2026-31367-pocPoC exploit for unauthenticated RCE in EITS Admin Dashboard v2.4.0 via command injection in /api/v1/debug, allowing arbitrary OS command execution on…
nel-droid/cve-2026-71203-pocPoC: changedetection.io unauthenticated OpenAPI schema disclosure (CVE-2026-71203, Medium 5.3)
h33tlit/secret-regex-listList of regex for scraping secret API keys and juicy information.
ronamosa/cve-2026-18953PoC for CVE-2026-18953 — arbitrary file write (CWE-22) in awslabs.aws-transform-mcp-server's get_resource tool via the savePath parameter
sunandm/poc-h2-cve-2026-71554PoC for CVE-2026-71554 - h2 duplicate Host header request smuggling primitive (fixed in 4.4.1)
george0papasotiriou/cve-2026-11102-oauth2-implicit-grant-fragment-hijackingProof-of-concept exploit for CVE-2026-11102 demonstrating OAuth2 implicit grant fragment hijacking via unvalidated redirect_uri, leading to access…
george0papasotiriou/cve-2026-11103-graphql-batching-alias-rate-limit-bypassProof-of-concept exploit for CVE-2026-11103 demonstrating GraphQL rate-limit bypass through batching and field aliases; includes vulnerable Node.js…
george0papasotiriou/cve-2026-21003-jwt-none-algorithm-bypass-via-kid-header-omissionProof-of-concept exploit for CVE-2026-21003 demonstrating JWT authentication bypass by omitting the kid header and using the 'none' algorithm to…
dz-y/azure-apim-dev-portal-signup-bypassPython script to bypass Azure APIM signup when UI is disabled, this is different from the CVE-2025-66390 as it does not require you to setup anything…
sowarma/wp2shell-pocCVE-2026-63030 & CVE-2026-60137 RCE chain proof-of-concept