Independent reconstruction, lab validation, and PoC for CVE-2026-72898 — Metabase unauthenticated SQLi (patched in 0.63.5) - Riftweld/metabase-cve-2026-72898

Static unpacker, config extractor, YARA rules and IOCs for a Lumma Stealer chain delivered by a Go process-hollowing loader - ArtfulDodger10/lumma-stealer-campaign

🛡️ Security Researcher · Web Pentester · Founder of 2MNY Security — building the largest open-source web vulnerability scanner (200 modules) - RanaKhan77/RanaKhan77

OWASP Top 10 web application vulnerability scanner - Korir555/webapp-security-scanner

Automated HackerOne Hacktivity report-link collector - pull every disclosed report for a vulnerability class (XSS, SSRF, RCE…) via the official API. Completeness-guaranteed, resumable, multi-engine...

📈 Technical-analysis agent for stocks & crypto: ~24 indicators, market structure, confluence scoring and risk-managed trade plans. FastAPI · 240 tests - rehan-123/technical-analysis-agent

CVE-2026-91136 Divi Plus <= 2.4.0 unauthenticated arbitrary file read (mass scanner + exploit) - fl0ydsec/CVE-2026-91136

Independent reconstruction, lab validation, and PoC for CVE-2026-9198, the Langflow unauthenticated RCE (fixed in 1.10.1) - Riftweld/langflow-cve-2026-9198

A Python-based Government Website Vulnerability Scanner that checks security headers and cookie protections, identifies missing configurations, recommends fixes, and generates HTML and JSON reports...

Proof of concept and isolated Docker lab for CVE-2026-103889, an unauthenticated RCE vulnerability in Expivi 3D Product Configurator for WooCommerce ≤ 2.16.2. - kayes817/CVE-2026-103889

Prometheus v3.15.0 - High - Remote - SSRF - http_sd __unix_socket__ unsanitized Dial leftover of UDS scrape - abraxas/prometheus-unix-socket-dial

Detects SQLi, XSS, CSRF, SSRF and directory traversal, then emits PDF and JSON reports with remediation guidance. Benchmarked against Burp Suite and OWASP ZAP. - ATHARVASAIL/WebGaurd

For new CVEs without existing/working/non-mangled POCs - fromABUV/CVE-2026-9586_POC_EXPLOIT

初步学习AI安全项目：检测URL是否为钓鱼网站. Contribute to van0821/Initial-Phishing-URL-detection development by creating an account on GitHub.

Hephaestus 是集资产收集、攻击面评估、漏洞验证与 AI 渗透对话于一体的安全测试平台。提供 Web 服务、桌面客户端及独立扫描 Agent，支持本机扫描、组合任务和分布式节点执行。 - qiwentaidi/Hephaestus

Raw TCP toolkit: loopback SOCKS5 relay engine + Burp Suite extension (intercept, history, repeater) - siberfaqih/burp-tcp

Open-source AI-powered web security testing proxy — a free Burp Suite alternative with a built-in Claude security agent. Intercept, repeat, fuzz and audit HTTP/HTTPS & WebSocket traffic. - ...

OWASP Top10 Web漏洞复现项目，包含Pikachu、Upload-labs靶场实验报告. Contribute to yuechu-123/Web-Vuln-Lab development by creating an account on GitHub.

Scan, clean, harden, back up and monitor hacked WordPress sites with wp-cli: signature/YARA/behavior scanning, reversible quarantine, encrypted backups, file-integrity watch - arian24b/wpguard

Contribute to nullkitsunedev/Lfi-Nuclei-Temp development by creating an account on GitHub.

Automated static triage for malware analysis — hashes, strings, IOC extraction, PE parsing and YARA scanning. Static only; never executes samples. - malwarelens/malware-triage-toolkit