Tools

piecar21/cve-2026-0303

Proof-of-concept and Docker lab for CVE-2026-0303, demonstrating arbitrary code execution in Checkov via an auto-loaded .checkov.yml pointing to an…

github/advisory-database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

apaonum/brotli-cve-check

Agent skill + script to scan projects for CVE-2026-111497 (Brotli), rate criticality and suggest fixes

trailofbits/brotli-checker

Claude Code and Codex skill for finding potentially vulnerable Brotli copies and guiding updates for CVE-2026-111497.

leonlai-tw/php-eol-cve-2026-109618-109619

Unofficial patches for PHP CVE-2026-109618 / CVE-2026-109619 (RCE, CVSS 9.2) on EOL platforms: PHP 7.3 on CentOS/RHEL 7 (Remi), PHP 5.4 on Amazon…

alvm/php2shell-eol-backport

Unofficial fix for CVE-2026-109618 / CVE-2026-109619 (php2shell) for the end-of-life PHP 5.4 / 5.3 packages of RHEL, CentOS and Oracle Linux 7 / 6

tencentcloud/cubesandbox

Instant, Concurrent, Secure & Lightweight Sandbox for AI Agents.

sigstore/root-signing

Maintains the TUF repository that securely delivers the Sigstore trust root (trusted_root.json) to clients, using keyholder threshold signing, KMS…

legit-labs/gh-legitify

GitHub CLI extension for running "legitify"

mongodb/kingfisher

Detect secrets + live validation. Map blast radius. Revoke fast. Use the CLI or embed in Rust and Python.

vighnesh91/-logicsentry-ai

Offline SAST/DAST triage engine that parses source code and replays HAR traffic to detect business-logic flaws, BOLA, race conditions, and privilege…

githubsecuritylab/seclab-taskflows

Example AI-agent taskflows and MCP servers for auditing source code, triaging issues, and detecting vulnerabilities across web, Android, and iOS…

g0dse11/detecttrace

Open-source detection engineering tool that traces security detections end to end and identifies the first failing stage.

safedep/gryph

Security layer for AI coding agents. Works with Claude Code, Cursor, Windsurf, Gemini CLI, OpenCode, Pi Agent and more.

praetorian-inc/capability-sdk

Shared Go SDK defining a standard capability interface for security scanners, with multi-format finding output (terminal, JSON, NDJSON, Markdown,…

usebruno/bruno

Opensource IDE For Exploring and Testing API's (lightweight alternative to Postman/Insomnia)

viralmaniar/vulnvault

Developer-focused knowledge base of application security vulnerabilities with insecure vs secure code examples, prevention guidance, and OWASP/CWE…

0sec-labs/0

Open-source AI security harness. Includes a web UI for code analysis, pentesting, vulnerability research, reverse engineering, verification, and…