CVE-2026-80343
oscerd/cve-2026-80343Runnable proof-of-concept for CVE-2026-80343, a camel-netty-http security-constraint case-sensitivity bypass, with Spring Boot and Quarkus…
authentication-authorizationexploitationvulnerability-analysis+2
oscerd/cve-2026-80343Runnable proof-of-concept for CVE-2026-80343, a camel-netty-http security-constraint case-sensitivity bypass, with Spring Boot and Quarkus…
abraxas/gitea-public-only-pat-orgProof-of-concept lab for a Gitea authorization bypass where a public-only PAT with write:organization creates a private organization via POST…
andresriancho/enumerate-iamEnumerate the permissions associated with AWS credential set
hakaioffsec/cve-2026-16764Python exploit for CVE-2026-16764, a privilege escalation in OWASP DefectDojo where an is_staff REST API bypass lets a low-privileged user gain…
tuskira/ai-agent-gatewayOpen-source gateway that secures, governs, and observes AI agents' MCP tool calls and LLM traffic, with API-key authentication and an admin console…
anthonyk2923/cve-2026-94609Write-up and proof-of-concept for CVE-2026-94609, an authentik privilege-escalation flaw letting users with add_user_to_group join superuser groups…
gmh5225/gatekeeperSelf-hosted SSH access gateway in Go with OIDC/LDAP auth, RBAC, MFA, session recording, audit export, encryption at rest, IP rules, and policy…
les-k/wp-secure-mcpA WordPress plugin exposing an MCP server over the REST API, with the security model as the point -- closes the CVE-2026-15015 OAuth-bypass shape by…
nvidia/openshellSandboxed runtime for autonomous AI agents with declarative YAML policies enforcing filesystem, network, and process constraints, plus endpoint-bound…
isaca0315/cve-2026-65013-bola-idorReproducible BOLA/IDOR PoC against Onlook's tRPC API (CVE-2026-65013), with a 12-step exploit chain, vulnerable and patched Docker targets, and…
adarsh14734/aegis-releasesSandbox and MCP proxy that blocks AI coding agents from reading SSH keys, AWS credentials, and .env files, with deny-by-default policy and…
xrzmodz444/cve-2026-41940-poc-linuxProof-of-concept exploit for CVE-2026-41940, an authentication bypass in cPanel/WHM. Supports custom payloads and verbose logging, compatible with…
bombobombone/cve-2026-73309Proof-of-concept and technical write-up for CVE-2026-73309, an OAuth2 authentication bypass in XenForo before 2.3.13. Demonstrates empty…
bombobombone/cve-2026-73318Proof-of-concept exploit for XenForo CVE-2026-73318, an authorization bypass allowing ACP administrators to trigger site-wide policy re-agreement.…
htrxuan/hdwebmobile-booking-appointmentsSell bookable services and appointments through WooCommerce -- closes CVE-2026-2931 by construction.
pigeonlabshq/pigeonEnforce least-privilege delegation for AI agents with signed, scoped credentials. Grant sub-agents narrow capabilities and resources, verify actions…
0xcyp1337/cve-2026-82329Mass exploit for CVE-2026-82329, an unauthenticated authentication bypass in JFrog Artifactory. Supports single-target and batch scanning with…
blackhatexploitation/buk_ts_killerExploit for BUK-TS authentication bypass and remote code execution, with steps to intercept responses and manipulate userid to gain unauthorized…