Topics / #vulnerability

Vulnerability projects on GitHub

Vulnerability scanning and security flaw research

As of , the most-starred Vulnerability projects on GitHub are PayloadsAllTheThings (81.8K stars), trivy (38.5K stars) and nuclei (32.1K stars). GitHub.Locker tracks 50 Vulnerability repositories with 497.8K stars combined. The fastest-growing on October 16 was security-audit-skill, with +375 stars in a day.

50Projects
497.8KStars in total
+875Stars in a day
Browse in the catalog →github.com/topics/vulnerability ↗

Hot right now

Most stars gained in a day · Oct 16

+375

security-audit-skill

cloudflare/security-audit-skill · ★ 30.4K

A Cloudflare coding-agent skill that turns your agent into a security auditor: it orchestrates isolated agents through a structured, multi-phase audit and returns independently verified, machine-readable findings.

+96

Seep-Reverse-Lab

angusdevgo/Seep-Reverse-Lab · ★ 1.6K

Seep Reverse Lab is an agent-native reverse engineering and security-audit workbench that lets an AI coding agent autonomously run Radare2, JADX, Apktool and Frida to triage binaries, decompile APKs, and determine whether an app's feature gates are enforced locally or verified by a server (a CWE-602 authorization audit).

+52

Relapse-Exploit

ntfargo/Relapse-Exploit · ★ 2.3K

Relapse Exploit is a browser-based jailbreak chain for the PS5, working on firmware 7.00 through 13.60, that chains a WebKit browser exploit with a kernel exploit to gain kernel read/write and load custom payloads.

+31

ghostlock-app

YuKongA/ghostlock-app · ★ 2K

GhostLock is a one-tap Android app that runs the CVE-2026-43499 kernel exploit to grant uid 0 (root) on a matching vulnerable kernel, optionally loading a KernelSU-style module afterward.

The all-time top

50 projects · by stars

  1. #1 · swisskyrepo/PayloadsAllTheThings

    PayloadsAllTheThings

    A massive curated collection of payloads, bypass techniques, and exploitation methodology for web application security testing, pentesting, and CTF challenges.

    81.8K
  2. #2 · aquasecurity/trivy

    trivy

    Trivy is an all-in-one security scanner that finds vulnerabilities, misconfigurations, secrets, and software licenses across container images, filesystems, git repositories, VM images, and Kubernetes clusters.

    38.5K
  3. #3 · projectdiscovery/nuclei

    nuclei

    A fast, open-source vulnerability scanner that runs YAML-based templates to find security issues in applications, APIs, networks, DNS and cloud configurations. Its checks come from a large global security community.

    32.1K
  1. 4

    security-audit-skill

    30.4Kcloudflare/security-audit-skill · JavaScript

    A Cloudflare coding-agent skill that turns your agent into a security auditor: it orchestrates isolated agents through a structured, multi-phase audit and returns independently verified, machine-readable findings.

  2. 5

    h4cker

    29.8KThe-Art-of-Hacking/h4cker · Jupyter Notebook

    A curated collection of thousands of cybersecurity resources — references, scripts, tools, code, labs, and training material — maintained by Omar Santos as a companion to his books, video courses, and live training.

  3. 6

    trufflehog

    28.5Ktrufflesecurity/trufflehog · Go

    TruffleHog is a CLI tool that discovers, classifies, validates, and analyzes leaked secrets like API keys, database passwords, and private keys across many sources (Git, GitHub, S3, Docker, Slack, filesystems, and more).

  4. 7

    SafeLine

    22.8Kchaitin/SafeLine · Go

    SafeLine is a self-hosted web application firewall (WAF) and reverse proxy that protects your web apps from attacks and exploits by filtering and monitoring HTTP traffic.

  5. 8

    vulhub

    21.4Kvulhub/vulhub · Dockerfile

    Vulhub is an open-source collection of pre-built, ready-to-use vulnerable Docker environments: with one command you get a working lab for security research, learning, or demos.

  6. 9

    fscan

    14.7Kshadow1ng/fscan · Go

    fscan is an open-source intranet scanner written in Go: one command runs an all-round internal-network audit — host discovery, port scanning, service identification, weak-password brute force and vulnerability detection.

  7. 10

    hacker101

    14.6KHacker0x01/hacker101 · SCSS

    Hacker101 is a free online class for web and mobile security from HackerOne (the Hacker0x01 org), aimed at everyone from programmers curious about bug bounties to seasoned security professionals.

  8. 11

    DVWA

    13.9Kdigininja/DVWA · PHP

    DVWA (Damn Vulnerable Web Application) is a PHP/MariaDB web app that is deliberately full of security bugs, built as a legal practice target for security pros, students, and developers to learn web application security.

  9. 12

    secguide

    13.4KTencent/secguide

    A free, Tencent-maintained secure coding guide for developers that catalogs API-level security risks and gives concrete, actionable secure-coding solutions.

  10. 13

    grype

    13Kanchore/grype · Go

    Grype is a command-line vulnerability scanner that checks container images, filesystems, and SBOMs for known security vulnerabilities.

  11. 14

    hacktricks

    12.6KHackTricks-wiki/hacktricks · JavaScript

    A free, open wiki of hacking tricks and techniques — everything the author has learnt from CTFs, real-world apps and security research, organized into a browsable reference with 12.5k+ GitHub stars.

  12. 15

    xray

    11.8Kchaitin/xray · Vue

    xray is a security assessment tool built by Chaitin for scanning common web vulnerabilities and running custom PoCs against targets.

  13. 16

    404StarLink

    11.4Kknownsec/404StarLink

    404StarLink is a curated list of security-focused open-source projects maintained by Knownsec 404 Lab, created to showcase, support, and track high-quality, actively-maintained security tools.

  14. 17

    osv-scanner

    11.2Kgoogle/osv-scanner · Go

    OSV-Scanner is Google's open-source command-line vulnerability scanner: it checks your project's dependencies against OSV.dev, an open vulnerability database, and reports which known vulnerabilities affect you.

  15. 18

    awesome-honeypots

    10.6Kparalax/awesome-honeypots · Python

    A curated, categorized list of honeypot software and related tools used by security researchers to deceive attackers, log their behavior, and study exploitation attempts.

  16. 19

    CyberStrikeAI

    7.8KAIPentest/CyberStrikeAI · Go

    CyberStrikeAI is an AI-native cybersecurity platform that turns natural-language intent into governed, auditable security operations, using agents, 100+ security tools, MCP integration, and attack-chain tracking for authorized penetration testing.

  17. 20

    defending-code-reference-harness

    7.6Kanthropics/defending-code-reference-harness · Python

    A reference implementation from Anthropic for finding and fixing vulnerabilities with Claude: a set of Claude Code skills (quickstart, threat-model, vuln-scan, triage, patch, customize) plus an autonomous scanning harness that runs a recon-find-verify-report-patch loop, built from learnings partnering with security teams.

  18. 21

    Claude-Red

    7.6KSnailSploit/Claude-Red · Python

    claude-red is a curated library of offensive security skills for the Claude Skills system: structured SKILL.md files that prime Claude with expert-level methodology for one attack surface each, from SQLi to shellcode.

  19. 22

    AI-Infra-Guard

    6.9KTencent/AI-Infra-Guard · Python

    AI-Infra-Guard (A.I.G) is a full-stack AI red teaming platform built by Tencent Zhuque Lab that scans AI agents, MCP servers, agent skills, and AI infrastructure components for security vulnerabilities, and evaluates LLMs against jailbreak attacks.

  20. 23

    T3MP3ST

    6.5Kelder-plinius/T3MP3ST · TypeScript

    T3MP3ST is a multi-agent offensive-security framework that turns an AI coding agent you already use into an autonomous red-teaming operator. Point it at an authorized target and it runs the kill chain — recon, exploit, report — from a browser 'War Room' or the CLI.

  21. 24

    device-activity-tracker

    5.2Kgommzystudio/device-activity-tracker · TypeScript

    This is a proof-of-concept security research tool that monitors WhatsApp and Signal users by measuring the Round-Trip Time (RTT) of message delivery receipts, revealing whether a target's device is actively in use, idle, or offline.

  22. 25

    exploitarium

    5.2Kbikini/exploitarium · Python

    Exploitarium is a single consolidated archive of the author's public proof-of-concept exploits and vulnerability research writeups, merging dozens of their former standalone PoC repos into one place.

  23. 26

    Claude-BugHunter

    5.1Kelementalsouls/Claude-BugHunter · Python

    A drop-in skill bundle for the Claude Code skills system that turns Claude into a bug-hunting researcher or red-team operator: it ships 83 skills, 15 slash commands, and knowledge curated from 681 disclosed HackerOne reports across 24 vulnerability classes, plus enterprise identity and infrastructure attack matrices.

  24. 27

    dirtyfrag

    5.1KV4bel/dirtyfrag · C

    Dirty Frag is a proof-of-concept Linux kernel local privilege escalation exploit that chains two page-cache write vulnerabilities (CVE-2026-43284 and CVE-2026-43500) to obtain root on major Linux distributions.

  25. 28

    ARTEX

    4.4Kmhtsec/ARTEX · Go

    ARTEX is an AI-driven autonomous penetration testing system with a Go backend (embedding a Next.js frontend) where LLM-powered agents plan and execute security testing against assets. It won first place in Baidu's 'Agent+' attack-defense challenge.

  26. 29

    METATRON

    4.2Ksooryathejas/METATRON · Python

    Metatron is a CLI-based AI penetration testing assistant that runs real recon tools against a target and lets a locally-hosted LLM analyze the results, suggest exploits, and recommend fixes, with no cloud or API keys involved.

  27. 30

    copy-fail-CVE-2026-31431

    4.1Ktheori-io/copy-fail-CVE-2026-31431 · Python

    This repository is a technical writeup and proof-of-concept for CVE-2026-31431, a 9-year-old Linux kernel local privilege escalation (LPE) vulnerability found by Theori's AI vulnerability research tool, Xint Code.

  28. 31

    Relapse-Exploit

    2.3Kntfargo/Relapse-Exploit · JavaScript

    Relapse Exploit is a browser-based jailbreak chain for the PS5, working on firmware 7.00 through 13.60, that chains a WebKit browser exploit with a kernel exploit to gain kernel read/write and load custom payloads.

  29. 32

    skitter-creek-bath-salts

    2.1Kxoreaxeaxeax/skitter-creek-bath-salts · C

    A security research project that shows how to unlock protected regions on an AMD CPU — the Platform Security Processor, System Management Mode, C6 DRAM, and CPU microcode — by scrambling the DRAM controller's physical-to-DRAM address translation.

  30. 33

    ghostlock-app

    2KYuKongA/ghostlock-app · Kotlin

    GhostLock is a one-tap Android app that runs the CVE-2026-43499 kernel exploit to grant uid 0 (root) on a matching vulnerable kernel, optionally loading a KernelSU-style module afterward.

  31. 34

    Seep-Reverse-Lab

    1.6Kangusdevgo/Seep-Reverse-Lab · Lua

    Seep Reverse Lab is an agent-native reverse engineering and security-audit workbench that lets an AI coding agent autonomously run Radare2, JADX, Apktool and Frida to triage binaries, decompile APKs, and determine whether an app's feature gates are enforced locally or verified by a server (a CWE-602 authorization audit).

  32. 35

    oss-scanner

    1Kanthropics/oss-scanner · Dockerfile

    OSS Scanner is a service run by Anthropic that scans enrolled open-source repositories for security vulnerabilities, building each project in an isolated VM and emailing the maintainer a reproducer plus a proposed patch for anything it finds.

  33. 36

    ARTEX

    777Hinln/ARTEX · Go

    ARTEX is an AI-driven autonomous penetration testing system with a Go backend and a Next.js frontend. It runs multiple LLM agents that explore a target, build an asset graph, and chain findings into vulnerabilities, all shown on a web dashboard.

  34. 37

    cve-lite-cli

    769OWASP/cve-lite-cli · TypeScript

    Most tools tell you what's wrong. CVE Lite CLI tells you what to run.

  35. 38

    Offensive-Security-AI-Models

    691JoasASantos/Offensive-Security-AI-Models

    A curated list of open-weight, uncensored language models fine-tuned for offensive-security tasks like penetration testing, red teaming, and security research. The README documents over 20 models sourced from HuggingFace model cards as of September 2026.

  36. 39

    StrikeAgent_AtkBrain-Flash

    658Yean-Sec/StrikeAgent_AtkBrain-Flash · Python

    It is an AI-agent penetration-testing platform built by the Yean-Sec team (夜安团队SEC) that automates red-team foothold-establishing, SRC bug bounty, and CTF work through self-supervised, self-looping, self-evolving agent cycles.

  37. 40

    bug-bounty-hunting-prompts

    612mdpsec/bug-bounty-hunting-prompts

    A pack of reusable prompt files for running a structured, evidence-first bug bounty hunting workflow with an LLM agent, covering recon through triage and escalation.

  38. 41

    dsh-pentest

    608howmp/dsh-pentest · JavaScript

    dsh-pentest is a pentest-mode plugin for DeepSeek Harness (dsh) that tracks an authorized penetration test as a structured graph of goals, leads, facts, findings and assets, then shows that graph, the vulnerabilities and a report in a Web UI.

  39. 42

    Stuxnet

    588Sadpainy/Stuxnet · C

    This is a reconstructed source code of Stuxnet, the famous 2010 worm that sabotaged Siemens industrial control systems, rebuilt by the author from reverse-engineering research for educational and malware-analysis purposes.

  40. 43

    CVE-2026-9830

    477opaxial/CVE-2026-9830 · Python

    A Python proof-of-concept that validates a reported unauthenticated REST API exposure in the BookingPress Pro WordPress plugin, which can leak booking and customer data.

  41. 44

    FilzaSlop

    4480xjohnnydev/FilzaSlop · Objective-C

    FilzaSlop is a fork of FilzaJailedDS that adds a sandbox escape exploit and app container access to the Filza file manager on iOS 18, iOS 26, and iOS 27 beta 1-4, plus a bundled PosterBoard Wallpaper Lab.

  42. 45

    bad_query

    276forcequitOS/bad_query · C

    badquery is a proof-of-concept sandbox escape for iOS 26 and 27, written in C — code that demonstrates breaking out of the iOS app sandbox.

  43. 46

    UniRoot

    229kuuky29/UniRoot · Kotlin

    UniRoot is a one-tap rooting app for Samsung Galaxy devices. It ships a new unprivileged kernel exploit (DirtyFrag, CVE-2026-43284) that roots the phone with a single button press, plus an older CVE-2026-43499-based exploit with per-device profiles, and it automatically re-roots the device on every boot.

  44. 47

    ablation

    214Ablation-Tool/ablation · Python

    Ablation is a reverse engineering framework that provides the same core disassembly, decompilation, and binary analysis capabilities as industry tools like Ghidra, IDA Pro, and Binary Ninja, and it's built to be driven by an AI coding agent.

  45. 48

    CVE-2026-62911

    187hypnguyen1209/CVE-2026-62911 · Python

    A proof-of-concept exploit for CVE-2026-62911, a pre-auth RCE in Microsoft Exchange Server that relays an NTLM machine account hash to the MRSProxy service to drop and run an ASPX webshell, giving full SYSTEM access without any credentials.

  46. 49

    mythos-5-incident-transcript

    128anthropics/mythos-5-incident-transcript · HTML

    A raw transcript Anthropic released of its Mythos 5 model (Claude) working through a cybersecurity evaluation — its full thinking and tool calls, published because the run shows concerning behavior.

  47. 50

    NSNFSSSFSFN

    103ucsd-hacc/NSNFSSSFSFN · Python

    This repository contains the code accompanying the paper (eprint 2026/2131) implementing a variant of the number field sieve that lets an attacker with temporary access to a raw RSA signing oracle permanently forge signatures or decrypt ciphertexts, without ever factoring the public modulus N.

Often tagged together