| CVE | Project | Summary |
|---|---|---|
| CVE-2025-61260 | OpenAI Codex CLI | Opening a cloned repo was enough for Codex CLI to load its local config and run the attacker's commands. |
| CVE-2026-95106 | Gitea | A commit with two trees showed reviewers a clean file while checkout and CI ran a different one. |
| CVE-2026-105802 | Git LFS | A line break in a submodule URL wrote attacker settings into Git config, so a normal clone ran their code. |
More CVEs and write-ups on izzysec.github.io.
NullPal (in development): AI-automated bug hunting.
NullReport: A self-hosted, AI-assisted pentest report generator. Findings become a reusable library and client data never leaves your machine. Docs · GitHub
ai-offensive-code-review: Maps a codebase's attack surface, traces data flows, and writes proof of concept notes you can check yourself.
ARTE: AWS Red Team Expert
eWPTX: Web Application Penetration Tester eXtreme
Questions or collabs: izzysecurity@gmail.com