kaandemir993/nwh-stealer-analysis-fileless-bun-runtime-execution-clipboard-image-theft-cloud-c2-aws-r2-Static analysis and payload extraction of NWH Stealer. Features deep dive into fileless execution via Bun JavaScript Runtime, in-memory clipboard…
ght657/work1-secure-apiHDU IS Work 1 - Secure REST API (Flask) with CI/CD (pytest + bandit + pip-audit) and CVE-2018-17246 analysis
0xade1a1de/mastikC toolkit implementing micro-architectural side-channel attacks on Intel x86-64, including Prime+Probe, Flush+Reload, Flush+Flush, CacheBleed and…
secprbench/secprbenchBenchmark of 265 real vulnerability-introducing code changes across nine C, C++, and Rust projects, with paired review tasks, Docker sandbox, judge,…
project-oak/oakMeaningful control of data in distributed systems.
lzh0082-cloud/code-detectionReplication package studying how LLM vulnerability auditors defer to static-analysis evidence, with a tree-sitter C/C++ front end, controlled…
kaandemir993/vidar-stealer-chrome-injection-malicious-js-targeting-google-reddit-sessions-analysisReverse engineering Vidar Stealer: From obfuscated memory strings to Chrome process injection, malicious JS execution, and active session hijacking…
inquest/yara-rulesCollection of YARA rules for hunting malware, malicious Office documents, and exploit artifacts, with references to samples and research write-ups.
eset/malware-researchCode written as part of our various malware investigations
xuehuolll/cve-2026-109618-109619-auditCVE-2026-109618/109619 — PHP session.upload_progress pre-auth RCE. Exploit research: remote ASLR chain, PoC & patch analysis.
nextronsystems/iocsIndicators of compromise from to analysis and research by Nextron Threat Research team
yasindce1998/barzakhRing -4 to Ring 0: offense-defense firmware research platform. We build the bootkits, then we catch them. Closed-loop. Zero trust in silicon.
c8dhjp4tyv-bit/jbl-wave-buds2-firmware-researchReverse-engineering notes and Python tooling for JBL Wave Buds 2 (BES1306) firmware: OTA container format, flash layout, BLE/GATT protocol, and…
abraxas/qemu-xhci-complete-uafQEMU 11.1.2 - High - Local - UAF - xhci_complete leftover of CVE-2026-17588 doorbell DMA
0xblackash/cve-2026-110912Python/scapy proof-of-concept for CVE-2026-110912 (ARPBleed), an ARP ar_hln/ar_pln out-of-bounds read in DragonFly BSD that leaks kernel heap and…
gmh5225/malwaredbCurated collection of 961 malware families (1.36 GB) in password-protected ZIP archives, organized by family and type for analysis and research.
newbe3e/pwn2own-automotive-2026-alpine-ilx-f511-0-click-rce-exploit-writeupWriteup of a 0-click remote code execution exploit chain developed for the Alpine iLX-F511 automotive head unit at Pwn2Own Automotive 2026.
abraxas/sqlite-wal-pagesizeSQLite 3.53.4 - High - Local - Info leak - WAL/DB page-size mismatch uninitialized page tail
