alibi
owasp-noir/alibiCross-check the views of your attack surface and find the endpoints that cannot corroborate each other.
api-securitycode-analysisconfiguration-auditing+7
10
owasp-noir/alibiCross-check the views of your attack surface and find the endpoints that cannot corroborate each other.
faceless0x7/cve-2026-89012Python exploit for CVE-2026-89012, a Dolibarr SQL filter denylist bypass that uses a blind-boolean oracle to extract password hashes and API keys via…
squeeze440/inference-gateway-pocPoC — cross-origin requests reuse the configured provider API key in inference-gateway (GHSA-5293-fcm6-fh8v, CVE-2026-87009, CVSS 5.4).
pigeonlabshq/pigeonEnforce least-privilege delegation for AI agents with signed, scoped credentials. Grant sub-agents narrow capabilities and resources, verify actions…
hunt-benito/the-token-was-a-row-number-cve-2026-67602-phpipam-rest-api-authentication-bypassExploit and PoC for CVE-2026-67602, an authentication bypass in phpIPAM REST API via object-cache key collision, including a logic-level PoC and…
pie-script/llm-agent-testbedAn empirical security testbed evaluating prompt injection, confused-deputy vulnerabilities, and tool-calling defenses in LLM agents.
juanlunaia/aegis-latent-coreAI governance and evidence gateway for multi-provider LLM applications. FastAPI + optional Rust core for policy, WAF, egress, rate limits, sessions,…
htrxuan/hdwebmobile-photo-video-reviewsWooCommerce plugin: photo & video product reviews, closing CVE-2026-12684's unauthenticated-upload vulnerability class by construction
tibrn/cve-2026-5724Proof-of-concept exploit for CVE-2026-5724, an authentication bypass in Temporal's frontend gRPC service allowing unauthenticated access to workflow…
saykino/cve-2025-56219Detailed advisory for CVE-2025-56219, a rate-limiting flaw in Ascertia SigningHub's Add User API, enabling automated user creation and denial of…
keraattin/cve-2026-33032One missing function call on the route registration was enough to turn the MCP interface into an unauthenticated RCE gateway.
ch4n3-yoon/cve-2025-62727-demoProof of concept of CVE-2025-62727 that can cause denial-of-service in FastAPI (based Starlette <= 0.48.0)
filipegaudard/cve-2026-30945-pocProof-of-concept exploit for CVE-2026-30945, an IDOR in StudioCMS allowing arbitrary API token revocation and denial of service. Includes manual and…
leekanghyun/axios-security-guideAxios CRLF Injection (CVE-2026-40175) 취약점 대응 가이드 및 fetch 기반 마이그레이션 분석
novem13th/cve-2026-23745-via-graphql-demoProof-of-concept exploit for CVE-2026-23745 targeting GraphQL endpoints, demonstrating the vulnerability and potential impact for security testing…
0x0w1z/cve-2025-61777CVE on FlagForgeCTF on versions v2.0.0 to v2.3.1. Upgraded to version 2.3.2 to fix the issue.
wildandeveloper/cve-2026-58231Non-destructive detection and precondition-verification tool for CVE-2026-58231, probing SAP Commerce Cloud Data Hub endpoints, default OAuth…
arian-gogani/enforcement-coverageFinds API routes carrying weaker authorization than their siblings. Recovered CVE-2026-45316 from source. Includes the negative results.