kavryxdev-group/enterprise-abac-gatewayZero-trust reverse proxy and ABAC authorization gateway in Go with embedded OPA policy evaluation and distributed token revocation.
peach-research-lab/authorizationbenchThe first benchmark to evaluate how well do LLM agents act in alignment with their assigned authorization scope.
abraxas/superset-g3-v0-import-sql-plantProof-of-concept lab for an Apache Superset 6.1.0 authorization flaw where a Gamma dashboard editor plants dataset SQL via unversioned v0 dashboard…
edtrackai/nextjs-supabase-stripe-security-checkerLocal static security scanner for Next.js, Supabase and Stripe apps: 24 AST-based checks for leaked keys, missing RLS and grants, unsafe webhooks.…
oscerd/cve-2026-80343Runnable proof-of-concept for CVE-2026-80343, a camel-netty-http security-constraint case-sensitivity bypass, with Spring Boot and Quarkus…
abraxas/openmeetings-soap-user-rightsApache OpenMeetings 9.1.0 - High - Remote - Privilege leftover - SOAP POST /user copies UserDTO.rights including ADMIN
abraxas/openmeetings-stale-install-adminApache OpenMeetings 9.1.0 - High - Remote - Privilege leftover - stale /install wizard inserts second ADMIN
abraxas/pfsense-ldap-name-collisionpfSense CE 2.9.0-DEVELOPMENT - High - Remote - Privilege leftover - LDAP admin name
abraxas/pfsense-api-export-key-getpfSense Plus MIM API toolkit b4acd7ca - High - Remote - Privilege leftover - GET export-key private keys
abraxas/pfsense-api-fleet-jwtpfSense Plus MIM API toolkit b4acd7ca - High - Remote - IDOR - one controller JWT is a fleet token
abraxas/opnsense-captive-lastseen-roamOPNsense 26.7.6 - High - Remote - Network-access bypass - captive lastseen roam
abraxas/opnsense-uidfield-system-uid0OPNsense 26.7.6 - High - Remote - Privilege leftover - UidField uid 0
zentinelproxy/zentinelA security-first reverse proxy built to guard the free web.
abraxas/bitwarden-cipher-create-aclBitwarden Server v2026.9.2 - High - IDOR - plant decryptable vault items into collections the caller cannot write
abraxas/gitea-public-only-pat-orgProof-of-concept lab for a Gitea authorization bypass where a public-only PAT with write:organization creates a private organization via POST…
abraxas/hyperswitch-payout-confirm-secretProof-of-concept and lab for a Hyperswitch payout confirm flaw: a dummy client_secret plus amount in POST /payouts/{id}/confirm raises the stored…
abraxas/lago-stripe-invoice-idorReproduces a CWE-639 IDOR in Lago v1.53.0 where the Stripe one-time webhook loads invoices without organization scoping, enabling cross-org payment…
abraxas/nextcloud-ldap-put-isadminNextcloud 35.0.0 — delegated Users admin can PUT-edit an LDAP-promoted admin that PATCH correctly refuses
