not-going-anywhere
trailofbits/not-going-anywhereIntentionally vulnerable Golang programs exposing web, gRPC, and database/sql flaws for security training, vulnerability discovery, and remediation…
api-securitydatabase-securityeducation+3
178
trailofbits/not-going-anywhereIntentionally vulnerable Golang programs exposing web, gRPC, and database/sql flaws for security training, vulnerability discovery, and remediation…
shoucheng3/kubernetes-client__java_cve-2020-8570_client-java-parent-9_0_2_fixedJava client library for the Kubernetes API, enabling programmatic management of clusters, pods, deployments, and other resources with support for…
open-policy-agent/opaDeclarative policy engine that enables authorization and policy enforcement across services, Kubernetes, Terraform, Docker, and APIs using the Rego…
george0papasotiriou/cve-2026-3456-oauth2-pkce-race-condition-account-takeover-Python PoC for CVE-2026-3456 demonstrating OAuth2 PKCE race-condition account takeover, with a vulnerable auth server and concurrent code-verifier…
vulnmachines/joomla_cve-2023-23752Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.
6mile/gimmepatzPersonal Access Token (PAT) recon tool for bug bounty hunters, pentesters & red teams
roxanne_ardary/securecivicSecureCivic is a citizen-built, open source identity verification platform designed for SSA adoption. It replaces private data brokers with a secure,…
saykino/cve-2026-31283Documentation of CVE-2026-31283: an email bombing vulnerability in Totara LMS's forgot password API due to missing rate limiting, allowing…
rocketchat/rocket.chatThe Secure CommsOS™ for mission-critical operations
symfony/symfonyThe Symfony PHP framework
george0papasotiriou/cve-2026-11102-oauth2-implicit-grant-fragment-hijackingProof-of-concept exploit for CVE-2026-11102 demonstrating OAuth2 implicit grant fragment hijacking via unvalidated redirect_uri, leading to access…
cosignet/sdkThin TypeScript + zero-dep Python client and recipes to gate high-risk actions behind a payload-bound passkey approval.
shoucheng3/esapi__esapi-java-legacy_cve-2022-23457_2-2-3-1Enterprise Security API library providing security controls for Java web applications, including authentication, access control, input validation,…
shoucheng3/esapi__esapi-java-legacy_cve-2022-24891_2-2-3-1OWASP Enterprise Security API library providing security controls for Java web applications, including authentication, access control, input…
shoucheng3/aws__aws-sdk-java_cve-2022-31159_1-12-2600Java SDK for integrating with Amazon Web Services, providing secure API access to S3, DynamoDB, EC2, and more, with built-in authentication,…
shoucheng3/fabric8io__kubernetes-client_cve-2021-4178_5-0-2Java client providing fluent DSL access to Kubernetes and OpenShift REST APIs for managing cloud-native infrastructure, pods, services, and…
lucksec/spring-cloud-gateway-cve-2022-22947Exploit for CVE-2022-22947: remote code execution in Spring Cloud Gateway via crafted requests to the Actuator endpoint. Includes Python script and…
blacksky-algorithms/atprotoFork of the AT Protocol reference implementation with performance-optimized AppView, Rust-based firehose indexer, Redis caching, and community…