Tools

dbzoo/log4j_scanner

Filesystem scanner for Log4Shell (CVE-2021-44228) and related CVEs. Detects vulnerable JAR files via hash matching and class presence. Runs…

titanous/rocacheck

Go package that checks if RSA keys are vulnerable to ROCA / CVE-2017-15361

jithinodattu/cve-2007-4559-lab

Self-contained Docker lab demonstrating CVE-2007-4559 (TarSlip) directory traversal via Python's tarfile module. Includes vulnerable and fixed APIs,…

haxatron/cve-2022-0219

Proof-of-concept exploit for CVE-2022-0219, an XXE vulnerability in Jadx that allows local file disclosure when exporting malicious APK files via the…

ridhinva/npm-tar-path-traversal-scanner

Scanner: CVE-2026-31802 npm tar path traversal — Python checker for arbitrary file write via npm pack

tophat-cloud/cumulus

Real-time web application weakness monitoring SDK and scanner. Detects XSS, SQL injection, sensitive payloads, and code vulnerabilities via dynamic…

farhadalimohammadi-dir/vulnrepro-benchmark

Benchmark measuring AI models' ability to detect vulnerabilities in source code via real bug bounty cases with balanced recall and false-positive…

loic-houchi/django-faille-cve-2025-57833_test

Educational proof-of-concept demonstrating SQL injection via dynamic aliases in Django's annotate() and alias() methods (CVE-2025-57833). Includes…

galaxy-sc/cve-2026-47423-dompurify-xss-detector

Go-based scanner that detects DOMPurify sanitizer bypass (CVE-2026-47423) via logic fingerprinting on minified production JavaScript bundles,…

friparia/nginx_rift_scan_cve_2026_42945

Nginx Rewrite CVE Scan(CVE-2026-42945 nginx-rift CVE-2026-9256)

vercel-labs/deepsec

Agent-powered vulnerability scanner for large-scale codebases. Uses LLMs to find hard-to-detect security issues via regex matchers and AI…

indalok/rzweb

A complete browser-based reverse engineering platform built on Rizin, running entirely client-side via WebAssembly.

keensecuritylab/binabsinspector

Static binary vulnerability scanner using abstract interpretation on Ghidra Pcode. Detects CWE classes like buffer overflows, use-after-free, and…

nac-l/mergen

Deobfuscation via optimization with usage of LLVM IR and parsing assembly.

cryptax/droidlysis

Automated pre-analysis tool for Android apps that disassembles samples, extracts properties via configurable pattern matching, and organizes output…

allthingsida/idasql

Vibe Reverse Engineer with IDA Pro: An interface for IDA in SQL via live virtual tables. Don't let appearances deceive you! :)

dinosn/fastjson-jsontype-rce-lab

Docker labs + defensive scanner for fastjson remote-class-load RCE. fastjson 1.2.66-1.2.83: @JSONType resource probe (CVE-2026-16723). fastjson2…