Complete bug bounty checklist for web, recon & Android – OAuth, 2FA, OTP, XSS, SQLi, cache, GraphQL, subdomain enumeration, SecLists usage with ready-to-use commands & payloads. - R...

An automated Bash script for streamlined reconnaissance and vulnerability scanning. It integrates Subfinder and Nuclei to find subdomains and scan for vulnerabilities, while sending real-time progr...

Python CLI and FastAPI tool that normalizes Burp, Nmap, Nuclei and Nessus output into OWASP/MITRE-mapped HTML, PDF, DOCX and JSON reports. - kailasshankarpr/vapt-report-generator

Predictable delete_code via rand() in PictShare < 3.7.1 (CWE-338). PoC + advisory writeup. - wvllxe/CVE-2026-104356-pictshare-weak-delete-code

Sensitive info disclosure via info API in PictShare < 3.7.1 (CWE-522). PoC + advisory writeup. - wvllxe/CVE-2026-104051-pictshare-info-disclosure

A Python-based vulnerability scanner that checks common ports on a target and provides basic security recommendations for detected services. - nishm5312-sudo/vulnerability-scanner

CVE-2026-63292. Contribute to 0xBlackash/CVE-2026-63292 development by creating an account on GitHub.

This is a PoC of the CVE-2026-44011 found by precicom-vincent-tl. For more details check: https://github.com/advisories/GHSA-qrgm-p9w5-rrfw - 0xyngtg/CraftCMS-CVE-2026-44011-PoC-RCE

A listener profile for the Mythic C2 framework that utilizes AI vendors file API's - kyle41111/AI-FILE

Multimodal AI web bug hunter: sees, hears and reads a website while hunting bugs. 43 non-destructive payloads, CVSS v3.1 scoring, offline demo, CLI, Kaggle kernel. - skamy64-ux/polyglot-bughunter-x

MCP server: SSRF-guarded web/JSON fetching for AI assistants. IP-class validation, 2MB cap, 20s timeout. - asd369932/web-fetch-mcp

CVE-2026-57973 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the Microsoft Windows Subsystem for Linux (WSL2) that allows an authorized local attacker to perform tamper...

Cross-platform pure-Rust toolchain for unlock-free temporary root and KernelSU late-loading on vivo/iQOO devices (CVE-2026-43499) - L-1124/RootMyVivo-rs

Reflected XSS scanner with reflection context classification. Python 3, zero dependencies. - mizazhaider-ceh/pentrix-xss

Deliberately vulnerable banking web app — a CTF / pentest lab. PHP + MySQL in Docker, admin session takeover via stored XSS, Puppeteer bot. - RataDarius/bank-app

Network penetration testing extension for Burp Suite - port scanning, service fingerprinting, vulnerability checks, credential testing - dotbiru/network-pentest

Contribute to cymetrics/burp-es-logger development by creating an account on GitHub.

A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines. - techupdate24/fortimail-zero-day-cve-2026-104286

A local-only OWASP Top 10 training lab with intentionally vulnerable exercises in SQL injection, cross-site scripting (XSS), broken access control, and 7 more vulnerabilities, featuring PHP, JavaSc...

AdaptixC2 Windows x64 agent focused on EDR evasion - position-independent beacon (C/NASM, no CRT, single .text section) with encrypted sleep, indirect syscalls, hardware-breakpoint hooking, and mal...

Contribute to kevenpanchal/CVE-2025-24801-GLPI-10.0.17-and-prior-Authenticated-RCE development by creating an account on GitHub.