SkillsGuard

Support Development If SkillsGuard protects your pipeline, consider supporting ongoing research and new detection rules. ETH Donation Wallet 0x11282eE5726B3370c8B480e321b3B2aA13686582 Scan the QR code or copy the wallet address above. Static security scanner for AI agent skill packages. Detects...

ngxray

ngxray 用于 nginx 配置的静态漏洞扫描器。使用 nginx 自身的分词器解析配置，并根据声明式 JSON 规则进行匹配，以检测 rewrite/脚本引擎指令模式中的已知 CVE。 快速开始 root@kitploit: cd ngxray git submodule update --init make python3 scan.py /etc/nginx/nginx.conf 可检测项 规则以 rules/ 目录中的 JSON 文件形式定义。扫描器内置以下规则： 规则| CVE| 模式 ---|---|--- rewrite-is-args| CVE-2026-42945|...

modelaudit

ModelAudit 在部署之前保护你的 AI 模型。 静态扫描器，可检测 ML 模型文件中的恶意代码、潜在后门指标和安全漏洞——而无需加载或执行它们。 完整文档 | 用法示例 | 支持的格式 为什么选择 ModelAudit 模型从未受信任的注册表下载，经过 CI，最终在生产环境中运行。传统的 SAST 工具不会检查 pickle 操作码、HDF5 组布局、ONNX proto 图或 TensorFlow SavedModel 签名——而 ModelAudit 可以： 静态扫描。 任何模型都不会被加载、反序列化或执行。 覆盖你实际交付的格式。 40+ 个扫描器，涵盖...

CVE-2026-91836

A flaw has been found in OpenClaw ClawScan up to 0.1.6. This affects an unknown function of the file internal/runner/staticscanner.go of the component Static Scanner. This manipulation causes incomplete comparison with missing factors. It is possible to launch the attack on the local host. The...

cve-2026-42945-scan

cve-2026-42945-scan 针对 NGINX 配置文件的静态扫描器，用于检测与 CVE-2026-42945 相关的 rewrite/set 模式。 该扫描器使用 crossplane 解析 NGINX 配置，遍历 location 块，并打印每个疑似受影响的 location，格式如下： root@kitploit: //xxx.conf: - location XXXXX 示例： root@kitploit: /path/to/nginx.conf:39 - location ^/api/.$ 参考：CVE-2026-42945-POC。 要求 Python 3.10...

PT-2026-89610

🚨 CVE-2026-76059 IBM Langflow OSS 1.0.0 through 1.11.5 An attacker who could submit custom component source code could bypass the static security scanner by crafting an annotated class-body assignment that resolved to a dangerous callable through alias tracking; the resolved value was never check...

vibesec-static

vibesec-static — static vulnerability auditor for Python A si...

InvisibleJS Detection and Analysis Scanner

InvisibleJS is an obfuscation technique that hides JavaScript source code using zero‑width Unicode characters, making files appear empty while still executing at runtime via eval or dynamic import with data: URIs. Although visually deceptive, this method provides no real cryptographic protection...

pickle-scan-bypass-poc

CTF Write-up: BrineBreaker Pickle Scan Evasion Este reposit...

WordPress Advertisement Management 1.0 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Title: WordPress 'Advertisement Management' Plugin Version: 1.0 Author: Morten Nørtoft, Kenneth Jepsen & Mikkel Vej Date: 2015-06-16 Download: - https://wordpress.org/plugins/advertisement-management/ -...

WordPress Chief Editor 3.6.1 Cross Site Scripting

Title: WordPress 'Chief Editor' Plugin Version: 3.6.1 Author: Morten Nørtoft, Kenneth Jepsen & Mikkel Vej Date: 2015-06-17 Download: - https://wordpress.org/plugins/chief-editor/ - https://plugins.svn.wordpress.org/chief-editor/ Notified Vendor/WordPress: 2015-06-21...

WordPress Author Manager 1.0 Cross Site Scripting

Title: WordPress 'Author Manager' Plugin Version: 1.0 Author: Morten Nørtoft, Kenneth Jepsen & Mikkel Vej Date: 2015-06-16 Download: - https://wordpress.org/plugins/author-manager/ - https://plugins.svn.wordpress.org/author-manager/ Notified Vendor/WordPress: 2015-06-21...