alibi
owasp-noir/alibiCross-check the views of your attack surface and find the endpoints that cannot corroborate each other.
api-securitycode-analysisconfiguration-auditing+7
10
owasp-noir/alibiCross-check the views of your attack surface and find the endpoints that cannot corroborate each other.
qruiqai/leakishBrowser privacy-leak detector — eight detection modules, risk scoring, and per-account history, all in your browser.
faceless0x7/cve-2026-89012Python exploit for CVE-2026-89012, a Dolibarr SQL filter denylist bypass that uses a blind-boolean oracle to extract password hashes and API keys via…
hunt-benito/the-token-was-a-row-number-cve-2026-67602-phpipam-rest-api-authentication-bypassExploit and PoC for CVE-2026-67602, an authentication bypass in phpIPAM REST API via object-cache key collision, including a logic-level PoC and…
jricramc/aigateAI Prompt Secret Scanner: local proxy and Claude Code hook that blocks secrets before they reach AI APIs
marcstraube/zappzarapp-php-securityPHP 8.4+ security library (mirror)
dozermx/argusMulti-phase reconnaissance and attack-surface scanner that maps domains, IPs, ASNs, cloud assets, and CVEs into a knowledge graph with CVSS scoring…
ageofalgorithms/mahoraga-webapp-defenderAI-powered reactive website defense system that detects attacks, analyzes them, and autonomously patches source code in real-time using LLM agents.
reverseclabs/azuredevops-enumRead-only Azure DevOps enumeration tool that queries the REST API to surface projects, repositories, service connections, builds, pipeline secrets,…
george0papasotiriou/cve-2026-11103-graphql-batching-alias-rate-limit-bypassProof-of-concept exploit for CVE-2026-11103 demonstrating GraphQL rate-limit bypass through batching and field aliases; includes vulnerable Node.js…
0xdak/cve-2026-59243_exploitExploit for Apache Airflow FAB OAuth authentication bypass (CVE-2026-59243) that achieves admin access and remote code execution by triggering a…
george0papasotiriou/cve-2026-3456-oauth2-pkce-race-condition-account-takeover-Python PoC for CVE-2026-3456 demonstrating OAuth2 PKCE race-condition account takeover, with a vulnerable auth server and concurrent code-verifier…
george0papasotiriou/cve-2026-3030-prototype-pollution-in-json-merge-patchDemonstrates CVE-2026-3030 prototype pollution in a Node.js JSON merge patch REST API, including a vulnerable server and exploit script for privilege…
dz-y/azure-apim-dev-portal-signup-bypassPython script to bypass Azure APIM signup when UI is disabled, this is different from the CVE-2025-66390 as it does not require you to setup anything…
roxanne_ardary/securekitSecurekit is a protocol-agnostic security kernel that enforces zero-trust, sandboxed execution for AI tool use. It sits between any LLM or agent…
roxanne_ardary/securecivicSecureCivic is a citizen-built, open source identity verification platform designed for SSA adoption. It replaces private data brokers with a secure,…
x48ps/cve-2026-8181This vulnerability allows unauthenticated attackers who know a valid administrator username to impersonate that admin during REST API requests by…
fevar54/cve-2026-35616-detector.pyDetector de CVE-2026-35616: identifica servidores FortiClient EMS vulnerables (7.4.5-7.4.6).