CVE-2023-0045

Bypassing Spectre-BTI User Space Mitigations on Linux This is a working document, please send us feedback if you think we got something wrong or if we missed a citation Version 1.0 José Oliveira esoj Rodrigo Branco BSDaemon Introduction When testing the success rate of Spectre-BTI attacks, we...

scorecard

OpenSSF Scorecard Overview What Is Scorecard? Prominent Scorecard Users View a Project's Score Scorecard's Public Data Using Scorecard Scorecard GitHub Action Scorecard REST API Scorecard Badges Scorecard Command Line Interface Prerequisites Installation Authentication Basic Usage Checks Default...

btr

Branch Target Reuse BTR Artifacts This repository contains the artifacts for the paper "Branch Target Reuse: Practical Spectre-v2 Attacks in JIT Engines via Stale Branch Prediction Entries" accepted at ACM CCS 2026. For more information about the BTR attack, see our project-page and our paper! bt...

gh-safe-repo

gh-safe-repo Create GitHub repositories with safe defaults applied, in one command. gh-safe-repo new Branch protection, immutable tags, locked-down Actions, Dependabot, secret scanning with push protection, and private vulnerability reporting are all configured before you push your first commit...

TriforceAFL

New: For those looking to play with TriforceAFL and TLSF, Richard Johnson created a Dockerfile which installs both and even builds a Linux kernel for you. It's available here https://hub.docker.com/r/moflow/afl-triforce/tags/. Also new: afl-tmin now works with the forkserver!...

ConcoLLMic

ConcoLLMic: Agentic Concolic Execution Paper : IEEE S&P 2026 ConcoLLMic is the first language- and theory-agnostic concolic executor powered by LLM agents. Unlike traditional symbolic execution tools that require language-specific implementations and struggle with constraint solving, ConcoLLMic:...

qubes-core-admin

Qubes core, version 3 This is master branch of the Qubes OS core. API documentation is available: https://dev.qubes-os.org/projects/core-admin/en/latest/...

CVE-2021-3345

CVE-2021-3345 How to build vulnerable libgcrypt git clone --single-branch --branch LIBGCRYPT-1.9-BRANCH https://dev.gnupg.org/source/libgcrypt.git cd libgcrypt git checkout aa3f595341eb ./autogen.sh ./configure --enable-maintainer-mode && make How to use exploit make ./main This vulnerability is...

ExecASLR-ekoparty

ExecASLR - Abusing Intel branch predictors to bypass ASLR What is ASLR Address Space Layout Randomization is a mitigation used to make harder to exploit memory corruption attacks. In a scenario of a buffer overflow vulnerability, for example, an attacker that tries to make a Return Oriented...

SpeculativeExecutionAssessment

SpeculativeExecutionAssessment Assesses a system for the "speculative execution" vulnerabilities described in: CVE-2017-5715 branch target injection CVE-2017-5753 bounds check bypass CVE-2017-5754 rogue data cache load WARNING: Ensure that "Prefer 32-bit" is not checked in the build options...

CVE-2026-79611

A flaw was found in Xen. A user inside a guest virtual machine can cause a Denial of Service DoS of that guest by enabling a specific combination of processor debugging and branch tracing states. Due to improper state handling during hardware virtualization transitions, the hypervisor triggers a...

functrace

functrace - A function tracer functrace is a tool that helps to analyze a binary file with dynamic instrumentation using DynamoRIO http://dynamorio.org/. These are some implemented features based on DynamoRIO: disassemble all the executed code disassemble a specific function dump if these are...

Angora

Angora Angora is a mutation-based coverage guided fuzzer. The main goal of Angora is to increase branch coverage by solving path constraints without symbolic execution. Published Work Arxiv: Angora: Efficient Fuzzing by Principled Search, S&P 2018. Building Angora Build Requirements Linux-amd64...

spectre-attack-example

Spectre Attack Example January 2, 2018 CVE-2017-5753 and CVE-2017-5715 "Spectre" exploit example What is this? We place the text "The Magic Words are Squeamish Ossifrage." in memory, and then we attempt to read it using the vulnerability. If the system is vulnerable, you will see the same text on...

cacti-cve-2023-39361

Cacti ™ Running Cacti from the develop Branch IMPORTANT When using source or by downloading the code directly from the repository, it is important to run the database upgrade script if you experience any errors referring to missing tables or columns in the database. Changes to the database are...

atlas-tj-actions-poc

CVE-2025-54416: tj-actions/branch-names Command Injection PoC This repository demonstrates CVE-2025-54416 , a critical command injection vulnerability in tj-actions/branch-names affecting over 5,000 public repositories. Vulnerability The tj-actions/branch-names GitHub Action versions...

CVE-2026-14288 Use of Incorrectly-Resolved Name or Reference in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated to bypass a required merge request approval policy on a protected branch due to improper access...

CVE-2026-14288

GitLab EE is affected by a vulnerability where improper access control during approval rule synchronization could allow an authenticated user to bypass required merge request approval policies on a protected branch. This issue, categorized under CWE-706 , impacts versions 17.4 before 19.3.6 , 19....

CVE-2017-16995

CVE-2017-16995 A record of my own tinkering with the CVE-2017-16995 vulnerability and related analysis Hopefully I can find one myself, lol Overview This vulnerability is an LPE caused by an error in the verifier's branch judgment during BPF virtual execution In essence, it is an integer extensio...

CVE-2026-25232-PoC

CVE-2026-25232 — Gogs Protected Branch Deletion Bypass Write → Admin Escalation Overview Field| Details ---|--- CVE| CVE-2026-25232 Product| Gogs Go Git Service Affected Versions| = 0.13.4 Fixed Version| 0.14.1 CVSS Score| Medium CWE| CWE-863: Incorrect Authorization Authentication Required| Yes...