atproto

Blacksky AppView This is Blacksky's fork of the AT Protocol reference implementation by Bluesky Social PBC. It powers the AppView at api.blacksky.community. We're publishing this for transparency and so other communities can benefit from the work. This repository is not accepting contributions,...

MeshTNC

MeshTNC MeshTNC is a tool for piping LoRa data to and from consumer grade radios. Code - github.com/datapartyjs/MeshTNC Releases - github.com/datapartyjs/MeshTNC/releases Support - ko-fi/dataparty Features Simple serial cli built into the firmware Transmit raw bytes hex over LoRA using serial CLI...

EtwLeakKernel

EtwLeakKernel This repository contains a PoC for a program that utilizes ETW to leak kernel memory addresses. It does so by creating a consumer could be to almost any provider as almost all of them leak kernel addresses and requesting a stack trace from it. Once the stack trace is received, it is...

restler-fuzzer

RESTler What is RESTler? RESTler is the first stateful REST API fuzzing tool for automatically testing cloud services through their REST APIs and finding security and reliability bugs in these services. For a given cloud service with an OpenAPI formerly Swagger specification, RESTler analyzes its...

fuzztruction

Fuzztruction Fuzztruction is an academic prototype of a fuzzer that does not directly mutate inputs as most fuzzers do but instead uses a so-called generator application to produce an input for our fuzzing target. As programs generating data usually produce the correct representation, our fuzzer...

PHP 8.2 < 8.2.35, 8.3 < 8.3.36, 8.4 < 8.4.27, 8.5 < 8.5.12 - Use-After-Free Remote Code Execution

PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27, and 8.5 before 8.5.12 contain a use-after-free caused by request-owned global state that is not reset before the request heap is freed, letting unauthenticated attackers execute arbitrary code in a subsequent request handled by the same...

PT-2026-137292

This module introduces an OAuth 2.0 authorization server, which can be configured to protect your Drupal instance with access tokens, or allow clients to request new access tokens and refresh them. The module doesn't sufficiently restrict access to consumer configuration. Users who can create or...

CVE-2026-117531 @fastify/multipart vulnerable to Denial of Service via a malformed upload hanging delayed file consumers

@fastify/multipart is the multipart form-data and file upload plugin for the Fastify web framework. In versions 5.3.0 through 10.1.6, the plugin does not propagate a parser error to the file stream when a request body ends inside a file part with no closing boundary, even though the Content-Lengt...

CVE-2026-117531 @fastify/multipart vulnerable to Denial of Service via a malformed upload hanging delayed file consumers

@fastify/multipart is the multipart form-data and file upload plugin for the Fastify web framework. In versions 5.3.0 through 10.1.6, the plugin does not propagate a parser error to the file stream when a request body ends inside a file part with no closing boundary, even though the Content-Lengt...

CVE-2026-117531 @fastify/multipart vulnerable to Denial of Service via a malformed upload hanging delayed file consumers

@fastify/multipart is the multipart form-data and file upload plugin for the Fastify web framework. In versions 5.3.0 through 10.1.6, the plugin does not propagate a parser error to the file stream when a request body ends inside a file part with no closing boundary, even though the Content-Lengt...

Spring-Kafka-POC-CVE-2023-34040

Spring Kafka Deserialization POC Requirements Java 11 Maven Docker or Kafka Usage First start up the Dockerized Kafka instance. This will start up Kafka and make it available on port 29092. docker-compose up Start up the Consumer application. cd spring-kafka-consumer mvn clean install mvn...

CVE-2026-84180

CVE-2026-84180 — camel-knative: HTTP consumer information disclosure exception written back to the caller Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the Knative HTTP consumer , when an exchange failed on the consumer side, wrote the resulting exception back to t...

redis-poc

Redis Authenticated RCE stream NACK double free, TDigest & TopK module bugs Non-destructive RCE exploits for Redis 6.2.22, 7.4.9, 8.6.4 via the stream consumer-group shared-NACK double free a patch bypass of CVE-2026-25243, 8.8.0 via a TDigest heap-overflow in bundled RedisBloom, and 8.8.1 via a...

CVE-2026-40860

camel-jms JMS ObjectMessage Unsafe Deserialization Reproducer CVE-2026-40860 This project demonstrates a Java deserialization vulnerability in Apache Camel's camel-jms component and, transitively, camel-sjms, camel-sjms2, camel-amqp, camel-activemq, camel-activemq6, tracked as CVE-2026-40860...

ollama-consumer

ollama-consumer Demo consumer app pinned to github.com/ollama/ollama v0.5.0 — used by Endor Labs to demonstrate vulnerability detection and exploit-chain analysis against the upstream ollama library...

OAuth-Request-Crafter

OAuth-Request-Crafter OAuth Request Crafter is a tool that helps you to play with OAuth signature protected URLs. Features Support GET,POST,PUT and DELETE Proxy the Request Tamper URL, Parameters & Headers on the GO Add additional Headers and Cookie Why? When dealing with OAuth signature protecte...

invokeai-consumer

invokeai-consumer Demo consumer app pinned to invokeai==5.0.1 — used by Endor Labs to demonstrate vulnerability detection and exploit-chain analysis against the upstream invokeai library. v5.0.1 is the specific release named in the source CVE CVE-2024-10821...

gin-vulnerable

gin-vulnerable Demo consumer pinned to github.com/gin-gonic/gin v1.7.0 vulnerable to CVE-2023-29401. The /download/:filename handler passes user input directly to Context.FileAttachment — the exploit-condition pattern Endor flags as exploitable...

dlink-dir-819-dos

CVE-2022-40946 Exploit: Unauthenticated Denial of Service in DLink consumer DIR 819 A1 routers Exploit Fetch the sources $ git clone https://github.com/whokilleddb/dlink-dir-819-dos $ cd dlink-dir-819-dos $ pip install -r requirements.txt Run the exploit $ ./exploit.py -i 192.168.0.1 + DLink...

CVE-2026-85315

CVE-2026-85315 — camel-grpc: consumer exception disclosure Runnable proof-of-concept reproducer for the Apache Camel vulnerability where, when a route behind a gRPC consumer failed, the route exception's message was copied into the gRPC Status description. Unlike the status cause withCause...,...