Tools

github/advisory-database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

owasp/xpsd

Reachability triage for vulnerability scans. Feeds scanner findings to an LLM agent that reads your source and decides which CVEs are actually…

dmdhrumilmistry/security-harness

Multi-agent static application-security review harness for AI coding agents: maps codebases, hunts vulnerability classes, chains and verifies…

sdodson/cve-2026-46595-proof

Go proof-of-concept demonstrating CVE-2026-46595 in golang.org/x/crypto/ssh, using symbol inspection of stripped binaries and image scans to verify…

gmh5225/disclosure-check

Tool to identify the best mechanisms for privately disclosing a security vulnerability for a package/project.

pypa/advisory-database

Community-owned database of security advisories for Python packages on PyPI, providing structured vulnerability data in OSV format for integration…

pvharmo2/gha-lab-ca4fa82ac5

Security-research lab: reproduction of CVE-2026-29075 (GHSA-3j55-5q6x-2h48) in mesa/mesa benchmarks.yml pull_request_target workflow — single-commit…

xiaoqimikko/spring-cvss-check

Scans Java artifacts and source for Spring/Tomcat CVEs, compares vendor vs NVD CVSS scores, verifies exploitability conditions, and checks if fix…

astaruf/cve-2026-44590

Proof-of-concept exploit for CVE-2026-44590, a command injection in Sherlock's GitHub Actions workflow enabling RCE and GITHUB_TOKEN exfiltration via…

open-flaw/cve-2026-2395

Proof-of-concept demonstrating a race condition in the tar npm package (v7.5.3) causing file collisions during parallel extraction, leading to data…

open-aims/log4j

Patched Log4j 1.2.17 library with the vulnerable JMSAppender class removed to mitigate CVE-2021-4104, intended as a drop-in replacement for affected…

gouldnicholas/cve-2026-4660-poc

PoC for CVE-2026-4660: arbitrary file read via git checkout in hashicorp/go-getter

bx33661/cve-2026-30039

Security advisory and bilingual write-up detailing CVE-2026-30039, a symlink traversal vulnerability in rarfile affecting versions up to 4.2, leading…

boroeurnprach/cve-2026-23947-poc

Proof-of-concept demonstrating arbitrary code execution in Orval via malicious OpenAPI fields, with setup, exploit steps, and remediation guidance.

barrersoftware/opencode-secure

Security-hardened fork of OpenCode - Fixes CVE-2026-22812 (CVSS 8.8 RCE) that upstream refuses to patch

rohitberiwala/nodejs-tar-symlink-exploit-cve-2026-29786

Technical analysis and Proof-of-Concept (PoC) for a critical Path Traversal vulnerability via Symlink manipulation in the Node.js 'tar' package…

jvr2022/cve-2026-31802

Proof of concept and technical write-up for CVE-2026-31802, a symlink path traversal in npm tar allowing arbitrary file overwrite outside extraction…