Tools

nxploited/cve-2026-114509

Laravel TokenGuard authentication bypass through non-string API credentials

thebadinteger/p2pwn

Dahua cameras security scanner via P2P

aix567/c-a-s

C.A.S-Exploit — Python-based security research and proof-of-concept toolkit for CVE-2017-5689 (Intel AMT authentication bypass), featuring Shodan…

trhhubsd/artex

Multi-agent LLM system for autonomous penetration testing in isolated labs: planner/worker agents share asset and exploration graphs, with MITM…

abraxas/openmeetings-calendar-save-idor

Apache OpenMeetings 9.1.0 - High - Remote - IDOR - LOGIN calendar save overwrites appointment and closes public room

abraxas/jellyfin-svg-gzip

Jellyfin Server 12.2 - High - Remote - SSRF - gzip data:image/png leftover of GHSA-cf3c still fetches http and file

abraxas/pfsense-api-snort-file-join

pfSense Plus MIM API toolkit b4acd7ca - High - Remote - File read - Snort rules {file} decode-then-join

abraxas/pfsense-api-unix-sock-noauth

pfSense Plus MIM API toolkit b4acd7ca - High - Local - Privilege leftover - unix sock enroll no JWT

abraxas/gitea-follow-existence

Demonstrates a Gitea account-enumeration oracle: authenticated PUT /api/v1/user/following/{username} returns 204 for hidden accounts and 404 for…

abraxas/gitea-user-keys-idor

Proof-of-concept and lab for a Gitea IDOR (CWE-639) in GET /api/v1/user/keys/{id}, letting an authenticated read:user token enumerate other users'…

abraxas/nextcloud-calendar-sharee-publish

Nextcloud 35.0.0 — a calendar edit-sharee can publish the owner's calendar to an unauthenticated URL

abraxas/nextcloud-federated-ocm-token

Nextcloud 35.0.0 — federated share secret is an unscoped app password for the sharer's whole Files tree

abraxas/mysql-mysqldump-tab-path

MySQL Community Server 26.7.0 - High - mysqldump --tab path leftover - client file write

abraxas/sqlite-wal-pagesize

SQLite 3.53.4 - High - Local - Info leak - WAL/DB page-size mismatch uninitialized page tail

vulncheck-oss/go-exploit-cache

A utility for producing an HTTP cache database to use with go-exploit

watchtowrlabs/watchtowr-vs-atlassian-cve-2026-21589

Python detection artifact that checks Atlassian Jira, Confluence, and Bitbucket instances for the CVE-2026-21589 arbitrary file read vulnerability.

qyvora/qyvora-anansi

Terminal-first attack surface intelligence engine. Built for speed, portability, and raw technical signal.