CVE-2026-33032
keraattin/cve-2026-33032One missing function call on the route registration was enough to turn the MCP interface into an unauthenticated RCE gateway.
api-securityexploitationnetwork-security+4
5
keraattin/cve-2026-33032One missing function call on the route registration was enough to turn the MCP interface into an unauthenticated RCE gateway.
minhhk68/cve-2026-13736Proof-of-concept exploit and technical advisory for an unauthenticated member PII disclosure in a WordPress REST API directory plugin, including…
wildandeveloper/cve-2026-58231Non-destructive detection and precondition-verification tool for CVE-2026-58231, probing SAP Commerce Cloud Data Hub endpoints, default OAuth…
dozermx/argusMulti-phase reconnaissance and attack-surface scanner that maps domains, IPs, ASNs, cloud assets, and CVEs into a knowledge graph with CVSS scoring…
wattocyber/lm-fingerprintFingerprint OpenAI-compatible LLMs from tokenizer and behavior signals.
trandonga3/poc-cve-2026-63030-cve-2026-60137-Exploit chain for WordPress Core using REST API route-confusion and SQL injection for unauthenticated RCE, privilege escalation, and full server…
anirbala98/cve-2026-539594gaBoards < 3.3.9 - User Information Disclosure
davkharrr/cve-2026-19478-pocProof-of-concept exploit for unauthenticated remote code injection in GitLab's GraphQL API, using crafted queries to modify or delete public projects…
nel-droid/cve-2026-71203-pocPoC: changedetection.io unauthenticated OpenAPI schema disclosure (CVE-2026-71203, Medium 5.3)
boxed-dev/vibe-coding-securityPre-launch security checklist for AI-generated apps (Lovable, v0, Bolt, Cursor). 69 checks covering Supabase RLS, exposed keys, and prompt injection.…
h33tlit/secret-regex-listList of regex for scraping secret API keys and juicy information.
dhiyaneshgeek/my-presentation-slidesCollection's of Tech Talk that are presented by me :)
oscerd/cve-2026-64640Reproducer for CVE-2026-64640 — Apache Polaris Iceberg REST register/register-view vends storage credentials and reads an attacker-chosen metadata…
jenish-sojitra/jsanalyzerBurp Suite extension for JavaScript static analysis: extracts API endpoints, URLs, secrets, and emails with noise filtering for web security testing.
coffinxp/gemini-api-key-hunterScans websites and JS files for exposed Gemini API keys, verifies them live, enumerates accessible services, and provides a browser client for direct…
blackfan/bfscanTool for finding URLs, paths, secrets and generating raw HTTP requests and OpenApi specifications from config files and annotations used in JAR / WAR…
cc1a2b/jshunterjshunter is a command-line tool designed for analyzing JavaScript files and extracting endpoints. This tool specializes in identifying sensitive…
george0papasotiriou/cve-2026-3456-oauth2-pkce-race-condition-account-takeover-Python PoC for CVE-2026-3456 demonstrating OAuth2 PKCE race-condition account takeover, with a vulnerable auth server and concurrent code-verifier…