By combining CISA KEV (active weaponization signal), OSV.dev (ecosystem package-version boundary mapping), and deps.dev (reverse-dependency topological reach), this repository acts as an Action Dis...

Phishing awareness demo: fake QQ login page that reveals itself right after submit; records nothing. 钓鱼安全教育演示 - Principia-rain/phishing-demo

Research lab reproducing a target-specific Python Brotli 1.2.0 decoder RCE chain in Docker - ninj4c0d3r/python2shell

Contribute to Xiangmin-Li/my-poc-cve development by creating an account on GitHub.

Independent verification of CVE-2026-109618 / CVE-2026-109619 (private review copy) - JoshRob297/php2shell-research

CVE-2026-109618 & CVE-2026-109619 — PHP Pre-Auth RCE Exploit & Detection Toolkit - DARKSTUFF-LAB/php2shell-poc

Herramienta de diagnóstico de seguridad web en Python (checks pasivos OWASP y pruebas activas opt-in de XSS/SQLi/SSTI), con CLI e interfaz web, diseño anti-SSRF y 29 pruebas automatizadas. - MauExp...

Four months of MITRE rejections, retroactive SECURITY.md/CVE changes, CISA acknowledging CVE eligibility but refusing to act, and CERT/CC closing the case unresolved. The result: a second independe...

A Python-based automated vulnerability scanner for auditing defensive HTTP security headers and CORS misconfigurations against OWASP baselines. - Dhruv-9147/Web-Security-Auditor-Project-

CVE-2026-39987 POC Marimo. Contribute to lunacysoft/CVE-2026-39987-POC-Marimo development by creating an account on GitHub.

Modular Command & Control (C2) architecture implementing AES-256-GCM authenticated framing, multi-session management, and anti-sandbox heuristics. (Archived reference) - nhutnhd/modular-c2-...

This example demonstrates the core concept of a 'Pre-Authentication Remote Code Execution' (Pre-Auth RCE) vulnerability. It simulates a simple web server with an unauthenticated end...

Scalpel is a Burp extension for intercepting and rewriting HTTP traffic, either on the fly or in the Repeater using Python 3 scripts. - ambionics/scalpel

Standalone defensive checker project for CVE-2026-104286: Fortinet FortiMail: Path traversal / NULL-byte arbitrary file write. One exploit per repository; implementation pending. - completetech-sec...

PoC, Docker lab, and technical report for CVE-2026-111497 (Node2Shell) — Node.js Brotli decoder invalid block-switch OOB write; validated errno differential and weaponized remote DoS, RCE analysis ...

PoC, reproducible labs, live evidence, Nuclei fingerprint, and technical report for CVE-2026-110264 — GitLab Org-mode/Onigmo unauthenticated RCE (CVSS 10.0); render oracle validated on GitLab CE 19...

AttackPilot 是一个基于多智能体的链上攻击复盘平台。从交易哈希出发，系统能够关联分析多笔交易中的准备、触发和获利步骤，定位漏洞根因、生成修复补丁，并通过原版与补丁版回放对比验证修复效果。同时，平台接入 Chainlink 历史价格数据，为资金变化提供可追溯的估值参考，帮助开发者和安全研究员减少重复取证、验证与报告整理的人工投入。 - dy-iy/AttackPilot

Standalone defensive checker project for CVE-2026-104935: Ivanti Connect Secure: Authentication bypass by spoofing. One exploit per repository; implementation pending. - completetech-security/ivant...

Gitea LFI to RCE exploit (CVE-2026-59774) — arbitrary file read via Org-mode #+INCLUDE, chained to remote code execution through git hook injection - Ly0kha/CVE-2026-59774

A Python-based mini vulnerability scanner that checks for open ports and HTTP security headers. - Solai-26/Vulnerability-Scanner