Multi-language static analysis and Code vulnerability scanner. Modular engines for Python (AST-based security and correctness analysis) and C/C++ (memory safety and data-flow analysis), with CWE ma...

Containerized differential PoC for CVE-2026-76954: pre-auth SQL injection in the Synology DSM Auth API. DBEscapeStrings truncates a %q-escaped field to 4095 bytes, splitting a doubled quote and tur...

CVE-2026-128014 PoC: a two-chunk request body drives the Brotli 1.2.0 bundled in FrankenPHP 1.13.1 into a non-terminating decode loop that pins the request worker (DoS); FrankenPHP 1.13.2 (Brotli 1...

Claude Code skill: read-only check whether your ComfyUI is affected by CVE-2026-123790 (Easy-Use path traversal to RCE): version, fix commit, --listen exposure, signs of compromise - lng255639-cpu/...

Claude Code skill：唯讀檢查電腦上的 ComfyUI 是否受 CVE-2026-123790（Easy-Use 路徑穿越 → RCE）影響，含版本、修補 commit、--listen 對外開放與入侵跡象 - lng255639-cpu/comfyui-easyuse-cve-check

CVE-2026-126274 PoC: NocoDB's table-deletion dialog renders Creator-authored table/column titles through an unescaped innerHTML binding, executing markup when a victim confirms deleting a l...

CVE-2026-126269 PoC: a substring MIME allow-list plus an unvalidated records-API write let an Editor store text/html;image/png on a NocoDB attachment cell; the unauthenticated /dltemp signed URL se...

Contribute to codemath3000/mechanize-takehome-rce-poc development by creating an account on GitHub.

CVE-2026-126473 PoC: OpenEMR 8.3.0 OAuth flaw chain - a colon-form system scope bypasses administrator approval and the faulty legacy containment check grants the unregistered system/Patient.write ...

CVE-2026-126173: AutomatorWP Pro Webhooks add-on <= 1.4.4 unauthenticated arbitrary user password reset -> account takeover (CWE-862 -> CWE-640). PoC + Docker lab + analysis. -...

HTTPS-only Helm values policy bypass via redirects permits internal HTTP fetches (Argo CD) - iota31/argo-cd-helm-ssrf

Defensive, evidence-first web reconnaissance scanner (DNS, HTTP, TCP, TLS) with SSRF-safe networking and schema-validated reports - MounibAhmedAggoun/Sentinel

AI-Powered PE Malware Detection System using Machine Learning, YARA Signatures, Static PE Header Analysis, and SHAP Explainable AI. - Joyunto111/ai-malware-detector

ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.9 — unauthenticated PHP Object Injection to RCE (CVE-2026-125855 == CVE-2026-119077). PoC, lab, and full analysis. - im0xfa...

POC for CVE-2026-114713 - IRCv3 label-tag injection in UnrealIRCd escalating an unprivileged client message to server-to-server command authority on linked-server networks. Vulnerable 6.2.7 vs fixe...

CVE-2026-68982 — Apache Airflow CeleryExecutor unauthenticated callback RCE (poC + lab + analysis) - im0xfay/CVE-2026-68982

Contribute to bhtemp/mechanize-takehome-rce-poc development by creating an account on GitHub.

Full incident report + static teardown: HOME-role hijacking 'Roblox skins' adware launcher and fake 'Delete Apps' cleaner on an OPPO A79 5G (CPH2553). IOCs, YARA, ev...

Root RCE in Tenda HG21 via /boaform/formImportOMCIShell — uploaded file written to /tmp/omcishell and executed by /bin/sh as root. CVE-2026-37643. - umair9747/CVE-2026-37643-tenda-hg21-omcishell-rce

CVE-2026-126937 PoC: Zipline 4.6.4 POST /api/setup checks firstSetup, hashes with argon2 and resets the flag non-atomically - 20 barrier-synced requests with spoofed X-Forwarded-For created 15 SUPE...