Single static-binary recon orchestrator in Go: chains subfinder, httpx, nmap, nuclei, ffuf, katana + injection testing (dalfox/crlfuzz/sqlmap), with dedup, diff-based webhook alerts, an interactive...

A deliberately vulnerable web app for practicing OWASP attack patterns, built with Node.js, Express, and SQLite. It ships with real SQL injection and stored XSS bugs you can exploit, then flip a ru...

【Java计算机毕业设计分享】基于Django的防漏洞人事管理系统，MySQL Java开发 毕业设计 实战项目【附源码、文档报告、代码讲解】 - jahnfrens/nlVtrqiCow

Dependency-free Python vulnerability scanner: port scan, outdated-software & weak-config detection, JSON/HTML reports - Ak5hat-Gupta/vulnerability-scanner

Defensive CTI teardown of a June-2026 Mustang Panda (Earth Preta / TA416) operation against India's government and hydropower sectors: independent RE of SHARDLOADER, MINIRECON, and the ZOHO...

A comprehensive, multi-OS Adversary Simulation Framework. (BETA) - julianmoodie/Cosmos-Orbit-C2

Pre-auth arbitrary file upload RCE exploit for iCagenda Joomla extension < 4.0.8 (CVSS 10.0) - shinthink/CVE-2026-48939

Pre-auth RCE scanner for Langflow < 1.8.0 — Route Injection + Vertex Injection → Code Execution (CVSS 9.8) - shinthink/CVE-2026-27966

AI-powered network scanner & vulnerability scanner — nmap + Python + Flask + React. CLI, Web UI, API & PDF reports for pentesting & recon. - frangelbarrera/Network-Scanner

PoC for a Critical stack-based buffer overflow in GNU libextractor ≤ 1.14. A malicious .doc file triggers an unbounded VLA allocation causing unconditional DoS. In multi-threaded environments, it b...

A full-stack, distributed online judge platform. Features a secure, multi-language Remote Code Execution (RCE) sandbox using Docker, asynchronous task queues with Redis/BullMQ, and a responsive Nex...

Proof of Concept (PoC) for CVE-2026-49975 – HTTP/2 server memory exhaustion attack leveraging HPACK amplification and connection retention (HTTP/2 Slowloris). - Manisso/http2-bomb

A vulnerable Boot-to-Root CTF lab machine simulating a hospital environment. Features a realistic 17-step attack chain including SQL Injection, XSS, Session Hijacking, SSH access, password cracking...

Pre-auth path traversal to arbitrary file delete in Avada (Fusion) Builder <= 3.15.3 leading to RCE (CVSS 9.1) - shinthink/CVE-2026-8713

A Software-in-the-Loop (SITL) simulation framework for autonomous satellite self-healing. Features local-first Flight Software (FSW) with ML-based anomaly detection to autonomously recover from adv...

A self-hosted AI image generation platform with multi-provider failover, user management, and admin panel. Deploy with Docker. - salnart/imagens

Pre-auth Local File Inclusion in WP User Manager <= 2.9.17 via path traversal in tab parameter (CVSS 7.5) - shinthink/CVE-2026-9290

Post-incident remediation of SQL injection, reflected XSS, weak hashing, and unauthenticated encryption in a PHP/MySQL EHR case study (SECR4483 Secure Programming). - danialnur/SECR4483-medichain-r...

YARA 4.5.7 with in-tree holloman fingerprinting module - wessorh/yara-c-holloman3

Generic attack-simulation toolkit that validates FortiDeceptor and other deception/honeypot solutions by triggering decoys and correlating the alerts they raise. Purple-team PoC. - fatihpurtas/fort...

OpenBullet2 through version 0.3.2 contains an authentication bypass vulnerability in the API key authentication middleware that allows unauthenticated attackers to gain admin access by supplying an...