zappzarapp-php-security
marcstraube/zappzarapp-php-securityPHP 8.4+ security library (mirror)
api-securityauthentication-authorizationcode-analysis+6
marcstraube/zappzarapp-php-securityPHP 8.4+ security library (mirror)
al1ex/alibab-nacos-unauthorized-reset-pwdAlibab-Nacos-Unauthorized-Reset PWD
k3ystr0k3r/cve-2026-31816CVE-2026-31816 - Budibase Authentication Bypass to RCE
george0papasotiriou/cve-2026-21003-jwt-none-algorithm-bypass-via-kid-header-omissionProof-of-concept exploit for CVE-2026-21003 demonstrating JWT authentication bypass by omitting the kid header and using the 'none' algorithm to…
george0papasotiriou/cve-2026-4444-jwt-algorithm-confusion-via-kid-injectionPOC for CVE-2026-4444 demonstrating JWT algorithm confusion via untrusted kid injection, including vulnerable Node.js server and Python exploit for…
george0papasotiriou/cve-2026-3456-oauth2-pkce-race-condition-account-takeover-Python PoC for CVE-2026-3456 demonstrating OAuth2 PKCE race-condition account takeover, with a vulnerable auth server and concurrent code-verifier…
0xdak/cve-2026-59243_exploitExploit for Apache Airflow FAB OAuth authentication bypass (CVE-2026-59243) that achieves admin access and remote code execution by triggering a…
nel-droid/cve-2026-71204-pocPoC: changedetection.io settings blind-merge mass assignment (CVE-2026-71204, Medium 6.3)
malhyuk/cve-2026-59243Proof-of-concept for CVE-2026-59243 demonstrating JWT signature bypass in Apache Airflow FAB Auth Manager's Azure AD OAuth callback due to insecure…
teteco/cve-2026-52217-vtex-checkout-crosstenant-idorThe VTEX Checkout Service exposes OrderForm data through the endpoints `/api/checkout/pub/orderForm/{orderFormId}` and `/attachments/*`. These…
george0papasotiriou/cve-2026-11102-oauth2-implicit-grant-fragment-hijackingProof-of-concept exploit for CVE-2026-11102 demonstrating OAuth2 implicit grant fragment hijacking via unvalidated redirect_uri, leading to access…
nel-droid/cve-2026-72585-pocPoC: Grafana Editor role deletes protected contact points (CVE-2026-72585, Medium 6.5)
0xmrma/cve-2026-34048Admin-only terminal bootstrap routes checked only for login state, which let a normal team member drive Coolify's realtime terminal backend and…
dz-y/azure-apim-dev-portal-signup-bypassPython script to bypass Azure APIM signup when UI is disabled, this is different from the CVE-2025-66390 as it does not require you to setup anything…
ac8999/cve-2026-27344Missing Authorization in inseriswiss inseri core inseri-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue…
huzjie/aegisagentRuntime security gateway for AI agents: cryptographically attests tool calls, enforces policies, sandboxes execution, and logs tamper-evident audit…
roxanne_ardary/securecivicSecureCivic is a citizen-built, open source identity verification platform designed for SSA adoption. It replaces private data brokers with a secure,…
skelersecurity/wordpress-skelersecurity-core-security-cve-2026-63030Temporary WordPress plugin requiring authentication for the Core REST Batch API endpoint to mitigate the wp2shell vulnerability chain…