Gather and update all available and newest CVEs with their PoC.

Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.

Asset inventory of over 800 public bug bounty programs.

Integrates Dependency-Check reports into SonarQube

A collection of FREE cyber security books

《macOS软件安全与逆向分析》随书源码

Keyshuffling Attack for Persistent Early Code Execution in the Nintendo 3DS Secure Bootchain

SBT Plugin for OWASP DependencyCheck. Monitor your dependencies and report if there are any publicly known vulnerabilities (e.g. CVEs). :rainbow:

A simple Java command-line utility to mirror the CVE JSON data from NIST.

PatchEval: A New Benchmark for Evaluating LLMs on Patching Real-World Vulnerabilities

Find CVE PoCs on GitHub

A compilation of Software Supply Chain Security resources including initiatives, standards, regulations, organizations, vendors, tooling, books, articles and a plethora of learning resources from the web.

Jenkins plugin for OWASP Dependency-Check. Inspects project components for known vulnerabilities (e.g. CVEs).

Trickest Workflow for discovering log4j vulnerabilities and gathering the newest community payloads.

A Java library for parsing and programmatically using threat models

Integrates OWASP Zed Attack Proxy reports into SonarQube

The official repository of "GraphSPD: Graph-Based Security Patch Detection with Enriched Code Semantics". The paper will appear in the IEEE Symposium on Security and Privacy (S&P), San Francisco, CA, May 22-26, 2023.

A simple Java command-line utility to mirror the entire contents of VulnDB.

Solutions and discussions from the Software Security course on Coursera. Open for collaboration and knowledge sharing.

Cottontail: A LLM-Driven Concolic Execution Engine (Accepted by IEEE S&P'26)

SIde-Channel Analysis toolKit: embedded security evaluation tools

OpenVul: An Open-Source Post-Training Framework for LLM-Based Vulnerability Detection

Vendor-Neutral Security Tool Automation Controller (over REST)

Workshop for finding software vulnerabilities using open source tools, which includes a Goat-like Python and C application

SBT Plugin for OWASP DependencyCheck. Monitor your dependencies and report if there are any publicly known vulnerabilities (e.g. CVEs).

This repository contains all the source code for the various writeups I have written over time of all the Olicyber editions I have participated in.

Data Obfuscation for C/C++ Code Based on Residue Number Coding (RNC)

software vulnerabilities

A practical, research-friendly toolkit demonstrating how Python can read, parse, and analyze Solidity smart contracts using feature-engineering techniques. Extracts structural and security-relevant signals from Solidity code, detects risky patterns, builds interpretable features, and forms the basis for heuristic or ML-driven security analysis.

Solutions to Software Security course provided by University of Maryland - Coursera