Repository Index

Unauthenticated RCE toolkit for PHP 5.4–8.4.26 (CVE-2026-109619/109618) — pure-HTTP chain, JA3 impersonation, prpenetration-testingoof-of-access design

• exploit
• php
• php2shell
• php2shell-cve

A free, public vulnerability feed: CVE, GHSA, OSV, CISA KEV and EPSS merged into one entry per vulnerability. RSS, JSON API and MCP. Docs and issues only.

• cisa-kev
• cve
• mcp
• osv

Sym is a command line utility and a Ruby API that makes it trivial to encrypt and decrypt sensitive data. Unlike many other existing encryption tools, sym focuses on usability and streamlined interface (CLI), with the goal of making encryption easy and transparent. The result? There is no excuse for keeping your application secrets unencrypted :)

TranslatedCyclops is a browser with XSS detection capabilities

• security
• xss
• taint-tracking
• vulnerability

御枢 · AegisOps — AI 安全运营工作台：告警研判、应急响应、漏洞整改，连接 Atlas、模型、工具与工作流。

• ai-agents
• secops
• security-operations
• vulnerability-management

Non-destructive scanner for CVE-2026-109618 / CVE-2026-109619 (PHP core RCE). Subdomain recon via crt.sh + subfinder, robust banner grabbing, version-based detection.

• crtsh
• cve
• cve-2026-109618
• cve-2026-109619

Cake Fuzzer is a project that is meant to help automatically and continuously discover vulnerabilities in web applications created based on specific frameworks with very limited false positives.

• cybersecurity
• hacking
• iast
• dast

The opposite of Ruler, provides blue teams with the ability to detect Ruler usage against Exchange.

• blue-team
• security-tools
• security-audit

Go client for the GeoServer REST API — workspaces, datastores, layers, styles, security, ACL, GeoWebCache, Importer, plus OWS GetCapabilities/Describe. Tested against GeoServer 2.27 LTS and 2.28 stable.

• geoserver
• gis
• mapping
• golang

A honeypot for the Log4Shell vulnerability (CVE-2021-44228).

Vulnerable Web applications Generator

• vulnerabilities
• docker
• python
• generator

eBPF Security Monitoring and Sandboxing Agent Based on Aya

• aya
• bpf
• ebpf
• security

Awesome Splunk SPL hunt queries that can be used to detect the latest vulnerability exploitation attempts & subsequent compromise

• detection
• splunk
• bpfdoor
• vulnerability

🌊 Elixir RSS/ATOM feed builder with a focus on standards compliance, security and extensibility

• elixir
• rss
• atom

🛡 Modern elixir ACL/ABAC library for managing granular user abilities and permissions

• elixir
• elixir-phoenix
• ecto
• acl

Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.

• bpf
• ebpf
• forensics
• golang

Password generator written in Golang, usable as a CLI or Go library. Provides options for human readable and accessibility friendly passwords.

• golang
• go
• go-library
• golang-library

A low interaction honeypot for the Cisco ASA component capable of detecting CVE-2018-0101, a DoS and remote code execution vulnerability.

• security
• security-tools
• vulnerability
• honeypot

Example repository for GitHub Actions Time of Check to Time of Use (TOCTOU vulnerabilities)

• actions
• bugbounty
• cicd

A vulnerability patch gathering tool

K8s API Honeypot with Active Defense Capabilities

• never
• going
• to
• give

XSSMaze is a web service designed to test and improve the performance of security testing tools by providing various cases of XSS vulnerabilities.

• crystal-lang
• hacking
• security
• vulnapp

Local-first policy gateway for coding agents. Allow, review, or block MCP, shell, SQL, GitHub, and HTTP actions with scoped credentials and signed evidence.

• golang
• observability
• opentelemetry
• policy-engine

WebLogic Honeypot is a low interaction honeypot to detect CVE-2017-10271 in the Oracle WebLogic Server component of Oracle Fusion Middleware. This is a Remote Code Execution vulnerability.

• security
• security-tools
• honeypot
• deception