Tools

plutosecurity/mcpwnfluence

Information about CVE-2026-27825 & CVE-2026-27826 discovered by Pluto Security and a bash script for identifying vulnerable mcp-atlassian instances…

ransomleak/training-application-security

Interactive secure coding training with hands-on SCORM exercises covering OWASP Top 10 web and API vulnerabilities, Git/secrets exposure, and…

tindersec/gh-workflow-auditor

Script to audit GitHub Action Workflow files for potential vulnerabilities.

mubix/find-wsus

Helps defenders find their WSUS configurations in the wake of CVE-2025-59287

george0papasotiriou/cve-2026-22018-jenkins-pipeline-shared-library-code-execution-via-grab-

PoC for CVE-2026-22018, a critical Jenkins Pipeline Shared Library RCE via Groovy @Grab, demonstrating supply-chain code injection and mitigation…

pantheon-security/medusa

AI-first security scanner. NEW in v2026.7: Claude Code compromise detection — vet .claude/ hooks, permissions & skills before you clone — plus an…

aquasecurity/secfixes-tracker

Forked from https://gitlab.alpinelinux.org/kaniini/secfixes-tracker

snyk/snyk-scan

Automated Snyk vulnerability scanning for dependencies and Docker images in Bitbucket Pipelines, with severity thresholds and monitoring options.

ny1024/clawguard

Modular security toolkit for autonomous agents providing static analysis, configuration auditing, runtime monitoring, and supply chain verification…

owasp/fiasse

A Framework for Integrating Application Security into Software Engineering (FIASSE) using the Securable Software Engineering Model (SSEM)

seal-sec-demo-2/javascript-example

Seal Security example — vulnerable npm app (EJS CVE-2022-29078) remediated to sealed versions; GitHub Actions + Jenkins integration

seal-sec-demo-2/java-example

Seal Security example — vulnerable Maven app (SnakeYAML CVE-2022-1471) remediated to sealed versions; GitHub Actions + Jenkins integration

soliantconsulting/cve-2025-46295-fix-fms

Automated script suite to detect and remediate CVE-2025-46295 by replacing vulnerable Apache Commons JARs in FileMaker Server installations with…

robertdfrench/ifuncd-up

GNU IFUNC is the real culprit behind CVE-2024-3094

kaminaduck/ansible-cve-2024-3094

Ansible playbooks designed to check and remediate CVE-2024-3094 (XZ Backdoor)

dpomnean/log4j_scanner_wrapper

log4j vulnerability wrapper scanner for CVE-2021-44228

chef-cft/inspec_cve_2019_15224

Example InSpec profile to detect presence of a malicious rest-client gem (CVE-2019-15224)

bkhablenko/cve-2017-8046

Demonstrates exploitation of CVE-2017-8046 in a Spring Boot application, including a SpEL injection payload and dependency-check verification for…