slither-mcp

Slither MCP Server A Model Context Protocol MCP server that provides static analysis capabilities for Solidity smart contracts using Slither. Overview This MCP server wraps Slither static analysis functionality, making it accessible through the Model Context Protocol. It can analyze Solidity...

snuck

snuck Automatic XSS filter bypass Overview snuck is an automatic tool whose goal is to significantly test a given XSS filter by specializing the injections on the basis of the reflection context. This approach adopts Selenium to drive a web browser in reproducing both the attacker and the victim...

RightHand-Persistence

RightHand Persistence inspired by CVE-2026-21509 C++ COM Context Menu Handler for Persistence A sample implementation of a Windows context menu handler using C++ and COM, demonstrating a stealthy persistence technique. By registering a custom COM object, your code executes whenever a user...

windbg-mcp

WinDbg MCP An MCP Model Context Protocol server that exposes every pybag Windows debugger function as a native MCP tool. It gives any MCP-compatible client Claude Desktop, Claude Code, Cowork, OpenAI Codex CLI, Cursor, and custom agents full control over user-mode processes, kernel sessions, and...

printix-CVE-2022-25090

CVE-2022-25090 Instead of printing your homework as a user, print your system security policies as SYSTEM for fun. Explore the docs » View Demo . Report Bug . Request Feature Table Of Contents About the Project Built With Getting Started Prerequisites Installation Usage Roadmap Contributing Licen...

CVE-2026-19621

Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to strip action integration secrets from post payloads before broadcasting post-deletion web socket events and returning thread API responses, which allows an authenticated channel member to obtain...

DbgNexum

DbgNexum - Shellcode Injection DbgNexum is a Proof-of-Concept for injecting shellcode using the Windows Debugging API and Shared Memory File Mapping. It avoids writing and reading remote memory directly, instead using context manipulation to force the target process to load and execute the payloa...

sentinel-mcp

SentinelMCP — AI-Powered Cyber Defense System Google Cloud Hackathon submission — Autonomous threat detection and remediation orchestrated by Google Cloud Agent Builder Vertex AI Agent , powered by Gemini 2.0 Flash, Model Context Protocol MCP, and Dynatrace observability. The Problem Security tea...

wordlistgen

wordlistgen What and why? wordlistgen is a tool to pass a list of URLs and get back a list of relevant words for your wordlists. Wordlists are much more effective when you take the application's context into consideration. wordlistgen pulls out URL components, such as subdomain names, paths, quer...

threatspec

threatspec - continuous threat modeling, through code Threatspec is an open source project that aims to close the gap between development and security by bringing the threat modelling process further into the development process. This is achieved by having developers and security engineers write...

binary-ninja-headless-mcp

Binary Ninja Headless MCP A headless Binary Ninja server that speaks MCP Model Context Protocol, giving AI agents full access to deep reverse-engineering workflows — disassembly, IL, patching, types, xrefs, and more — without a GUI. Designed to run in the same Docker container as the agent runtim...

cve-2021-45046

Although log4j RCE CVE-2021-44228 was patched in 2.15, a new vulnerability, CVE-2021-45046 causing DoS, has been discovered. Below are the test results. Test Environment log4j-2.15.0 api , core JRE-1.8.0 jdk1.8.0151 Eclipse IDE Maven Project 1. Log4j RCE CVE-2021-44228 syntax test - Not Vuln 2...

EUVD-2026-102743

Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to strip action integration secrets from post payloads before broadcasting post-deletion web socket events and returning thread API responses, which allows an authenticated channel member to obtain...

ghidrecomp

Ghidrecomp - Command Line Ghidra Decompiler About This Python command line tool decompiles all functions of a binary and writes them to a directory in separate C files: flowchart LR afilename -- bghidrecomp a2Symbol Server -- b b -- eGhidra Project Files b -- output subgraph output subgraph...

openrasp

OpenRASP Introduction Unlike perimeter control solutions like WAF, OpenRASP directly integrates its protection engine into the application server by instrumentation. It can monitor various events including database queries, file operations and network requests etc. When an attack happens, WAF...

psc

psc psc ps container is a fast process scanner that uses eBPF iterators and Google CEL to query system state with precision and full container context. Why psc? Fast Kernel-Level Access with eBPF Iterators psc uses eBPF iterators to read process and file descriptor information directly from kerne...

CVE-2026-11114-Node.js-vm-Sandbox-Escape-via-Proxy

CVE-2026-11114 – Node.js vm Sandbox Escape via Proxy Program Code Node.js // sandboxserver.js - Vulnerable VM sandbox const vm = require'vm'; const express = require'express'; const app = express; app.useexpress.json; app.post'/eval', req, res = const code = req.body.code; const sandbox = console...

CVE-2026-111443

Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in production, by supplying an X-Wheels-Test-Context header or WHEELSTESTCONTEXT cookie with any value, or including a test-runner path anywhere in the URL, even the quer...

MS09-050

MS09-050 — SMBv2 Remote Code Execution Exploit CVE-2009-3103 The Vulnerability Windows Vista and Server 2008 introduced SMBv2 with a new kernel driver, srv2.sys. This driver fails to validate the Process Id High field in SMB negotiate requests. By sending a specially crafted value in this field, ...

Log4j_CVE-2021-45046

Log4j 2.15.0 Privilege Escalation -- CVE-2021-45046 Attack Discription It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map MDC input data when the logging...