security-harness
dmdhrumilmistry/security-harnessMulti-agent static application-security review harness for AI coding agents: maps codebases, hunts vulnerability classes, chains and verifies…
ai-securitycode-analysisdevsecops+9
43
dmdhrumilmistry/security-harnessMulti-agent static application-security review harness for AI coding agents: maps codebases, hunts vulnerability classes, chains and verifies…
sdodson/cve-2026-46595-proofGo proof-of-concept demonstrating CVE-2026-46595 in golang.org/x/crypto/ssh, using symbol inspection of stripped binaries and image scans to verify…
yonliud/cve-2026-0303Checkov PoC: arbitrary code execution through auto-loaded configuration and unsigned external Python checks.
xiaoqimikko/spring-cvss-checkScans Java artifacts and source for Spring/Tomcat CVEs, compares vendor vs NVD CVSS scores, verifies exploitability conditions, and checks if fix…
astaruf/cve-2026-44590Proof-of-concept exploit for CVE-2026-44590, a command injection in Sherlock's GitHub Actions workflow enabling RCE and GITHUB_TOKEN exfiltration via…
open-flaw/cve-2026-2395Proof-of-concept demonstrating a race condition in the tar npm package (v7.5.3) causing file collisions during parallel extraction, leading to data…
gouldnicholas/cve-2026-4660-pocPoC for CVE-2026-4660: arbitrary file read via git checkout in hashicorp/go-getter
boroeurnprach/cve-2026-23947-pocProof-of-concept demonstrating arbitrary code execution in Orval via malicious OpenAPI fields, with setup, exploit steps, and remediation guidance.
rohitberiwala/nodejs-tar-symlink-exploit-cve-2026-29786Technical analysis and Proof-of-Concept (PoC) for a critical Path Traversal vulnerability via Symlink manipulation in the Node.js 'tar' package…
jvr2022/cve-2026-31802Proof of concept and technical write-up for CVE-2026-31802, a symlink path traversal in npm tar allowing arbitrary file overwrite outside extraction…
jvr2022/cve-2026-29786Proof-of-concept demonstrating a hardlink path traversal in the tar npm package, allowing overwrite of files outside the extraction directory via…
3pplus/loguccinoScan and patch tool for CVE-2021-44228 and related log4j concerns.
s1ko/cve-2026-52617Advisory and proof-of-concept for OS command injection in an MCP ffmpeg helper, with root-cause analysis, detector guidance, and mitigations for an…
dependency-check/dependencycheckOWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.
appsec-forge/appsec-forgeStructured security knowledge base with production-inspired cases: vulnerability analysis, exploit explanation, remediation, and DevSecOps for…
aaravmaloo/reveraThe credit score for npm packages. Analyze package reputation, maintenance, security, publisher trust, and ecosystem health before you install any…
jvr2022/cve-2026-40345Reproduces a stack-exhaustion denial-of-service in deepmerge-ts before 8.0.0, documents exploitation, and includes a scanner for vulnerable…
gouldnicholas/cve-2026-5817-pocDocker Model Runner container-to-host RCE / Escape: A critical vulnerability that allows for container-to-host code execution in the Docker Model…