💭
Highlights
Block or report SnailSploit
Block user
Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.
You must be logged in to block users.
Add an optional note
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse
Contact GitHub support about this user’s behavior. Learn more about reporting abuse.
Report abuse
adversarial ai research · llm red teaming · kernel · vulnerability research
same attack. different substrate.
snailsploit is an independent adversarial research group — vulnerability research, framework development, and offensive tooling across kernels, language models, and everything between them.
61 published CVEs · 3 linux kernel CVEs · 5 mainlined kernel patches · 27 distinct targets
sorted by target class — infrastructure and AI first, then libraries, then CMS plugins. severity is the secondary sort within each tier.
| # | CVE | Target | Type | Severity | Status |
|---|---|---|---|---|---|
| 1 | CVE-2026-47393 | PraisonAI | Authentication disabled by default | Critical (9.8) | Published |
| 2 | CVE-2026-57127 | PraisonAI | recipe serve auth middleware disables itself with no secret | Critical (9.8) | Published |
| 3 | CVE-2026-57131 | PraisonAI | Jobs API exposes agent-execution endpoints with no auth | Critical (9.8) | Published |
| 4 | CVE-2026-57147 | PraisonAI | Hardcoded default JWT signing secret enables token forgery | Critical (9.8) | Published |
| 5 | CVE-2026-47398 | PraisonAI | Code injection via exec_module (YAML-controlled module paths) | High (8.1) | Published |
| 6 | CVE-2026-57126 | PraisonAI | SSRF guard validates literal IPs only — never resolves DNS | High (8.5) | Published |
| 7 | CVE-2026-55528 | PraisonAI | AgentServer declares auth_token but never enforces it on any route (CWE-862) | High (8.2) | Published |
| 8 | CVE-2026-57120 | PraisonAI | execute_code sandbox bypass via str.format dunder access | Medium (6.5) | Published |
| 9 | CVE-2026-55530 | PraisonAI | ast_grep_rewrite rewrites arbitrary files without @require_approval gate (CWE-862) | Moderate (6.1) | Published |
| 10 | CVE-2026-62164 | PraisonAI | HITL tool approval cached by tool name — silently reused for subsequent calls with arbitrary arguments | — | CVE Assigned |
| 11 | CVE-2026-62171 | PraisonAI | Prompt-injection defense blocks only when 3+ detector families fire simultaneously; single-vector injections pass through | — | CVE Assigned |
| 12 | CVE-2026-48814 | Network AI | Empty default secret accepted → authentication bypass (CWE-287/1188) | High | Published |
| 13 | CVE-2026-54236 | vLLM | Incomplete CVE-2026-22778 fix → PIL repr ASLR-bypass infoleak via Anthropic router (CWE-532) | Medium (5.3) | Published |
| 14 | CVE-2026-48782 | pydantic-ai | SSRF — metadata blocklist bypass via IPv6 transition forms | Medium (6.8) | Published |
| # | CVE | Target | Type | Severity | Status |
|---|---|---|---|---|---|
| 15 | CVE-2026-43121 | Linux Kernel io_uring/zcrx | user_ref race → double-free → OOB write | Medium (4.7) | Published |
| 16 | CVE-2026-46132 | Linux Kernel net/rtnetlink | ifla_vf_broadcast stack infoleak via Netlink RTM_GETLINK | Low | Published |
| 17 | CVE-2026-53371 | Linux Kernel RDMA/ionic | Unbounded %s in hca_type_show reads past node_desc[64] — userspace-triggerable OOB read via sysfs | — | Published |
| # | CVE | Target | Type | Severity | Status |
|---|---|---|---|---|---|
| 18 | CVE-2026-3288 | Kubernetes ingress-nginx | Config injection → RCE | High (8.8) | Published |
| 19 | CVE-2026-30911 | Apache Airflow Core | Missing auth (HITL) | High (8.1) | Published |
| 20 | CVE-2026-32794 | Apache Airflow (Databricks Provider) | TLS verification bypass → MitM | Medium (4.8) | Published |
| 21 | CVE-2026-55070 | argoproj/argo-workflows | Informer-cache auth-bypass fix incomplete — Lint/Create resolve templates without per-caller auth (CWE-285) | Moderate (5.3) | CVE Assigned |
| 22 | CVE-2026-48130 | tektoncd/pipeline | Hub resolver reads HTTP response body via unbounded io.ReadAll → OOM DoS (CWE-770) | Moderate (6.5) | CVE Assigned |
| # | CVE | Target | Type | Severity | Status |
|---|---|---|---|---|---|
| 23 | CVE-2026-57303 | Jenkins Assembla plugin | XXE | High | Published |
| 24 | CVE-2026-57297 | Jenkins Contrast CAS plugin | Missing permission check — connection-test → credential capture / SSRF | Medium | Published |
| 25 | CVE-2026-57299 | Jenkins Contrast CAS plugin | Missing permission checks — metadata enumeration | Medium | Published |
| 26 | CVE-2026-57304 | Jenkins Assembla plugin | Missing permission check | Medium | Published |
| 27 | CVE-2026-57298 | Jenkins Contrast CAS plugin | CSRF | Medium | Published |
| 28 | CVE-2026-57305 | Jenkins Assembla plugin | CSRF | Medium | Published |
| # | CVE | Target | Type | Severity | Status |
|---|---|---|---|---|---|
| 29 | CVE-2026-49853 | tornadoweb/tornado | Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient | High (7.7) | Published |
| 30 | CVE-2026-49353 | decolua/9router | Incomplete fix for CVE-2026-46339 — local-only access gate bypass via Host header spoofing (CWE-290) | High (7.5) | Published |
| 31 | CVE-2026-31899 | CairoSVG | Exponential DoS — recursive amplification | High (7.5) | Published |
| 32 | CVE-2026-44840 | Dgraph | DQL injection via checkUserPassword GraphQL query | High | Published |
| 33 | CVE-2026-52775 | yeswiki/yeswiki | Authenticated SQL injection via ReactionManager | High | Published |
| 34 | CVE-2026-32809 | ouch (Rust) | Symlink escape | High (7.4) | NVD: RESERVED |
| 35 | CVE-2026-45363 | jwt/ruby-jwt | Empty-key HMAC bypass | 7.4 | NVD: RESERVED |
| 36 | CVE-2026-48022 | @hapi/wreck (npm) | Credential header leak on cross-port / cross-scheme redirect | Moderate | Published |
| 37 | CVE-2026-54171 | Excon (RubyGems) | Sensitive/risky headers not redacted on redirect | Moderate | Published |
| 38 | CVE-2026-33693 | activitypub-federation-rust | SSRF — 0.0.0.0 bypass | Medium (6.5) | Published |
| 39 | CVE-2026-32885 | ddev/ddev | ZipSlip | Medium (6.5) | Published |
| 40 | CVE-2026-8368 | Perl LWP::UserAgent / HTTP::Tiny | Zero header strip on cross-host redirect | — | NVD: RESERVED |
| 41 | CVE-2026-44217 | sse-channel (npm) | SSE injection — unsanitized fields | Moderate | Published |
| 42 | CVE-2026-46627 | Twig (PHP) | Sandbox resource exhaustion — CPU/memory DoS | Moderate | Published |
| # | CVE | Target | Type | Severity | Status |
|---|---|---|---|---|---|
| 43 | CVE-2026-43884 | AVideo | SSRF protection bypass via DNS rebinding | High | Published |
| 44 | CVE-2026-43881 | AVideo | Unauthenticated user enumeration via isCompany parameter | Medium (5.3) | Published |
| 45 | CVE-2026-45619 | AVideo | CVE-2026-43884 incomplete fix — 6+ isSSRFSafeURL() call sites discard $resolvedIP out-param | — | Published |
| 46 | CVE-2026-45620 | AVideo | CVE-2026-43881 incomplete fix | — | Published |
| # | CVE | Target | Type | Severity | Status |
|---|---|---|---|---|---|
| 47 | CVE-2026-3596 | Riaxe Product Customizer | Missing auth → priv esc | Critical (9.8) | Published |
| 48 | CVE-2026-1313 | MimeTypes Link Icons | SSRF | High (8.3) | Published |
| 49 | CVE-2026-3599 | Riaxe Product Customizer | Unauthenticated SQLi | High (7.5) | Published |
| 50 | CVE-2025-9776 | CatFolders | SQLi via CSV import | Medium (6.5) | Published |
| 51 | CVE-2025-12163 | Omnipress | Stored XSS | Medium (6.4) | Published |
| 52 | CVE-2026-2717 | HTTP Headers | CRLF injection | Medium (5.5) | Published |
| 53 | CVE-2026-0811 | Advanced CF7 DB | CSRF → form deletion | Medium (5.4) | Published |
| 54 | CVE-2026-3594 | Riaxe Product Customizer | Info disclosure — /orders | Medium (5.3) | Published |
| 55 | CVE-2026-3595 | Riaxe Product Customizer | Unauthenticated user deletion | Medium (5.3) | Published |
| 56 | CVE-2026-1314 | 3D FlipBook | Missing auth | Medium (5.3) | Published |
| 57 | CVE-2025-11171 | Chartify | Missing auth — admin function | Medium (5.3) | Published |
| 58 | CVE-2025-11174 | Document Library Lite | Missing auth → info disclosure | Medium (5.3) | Published |
| 59 | CVE-2025-12030 | ACF to REST API | IDOR | Medium (4.3) | Published |
| 60 | CVE-2026-0814 | Advanced CF7 DB | Missing auth — subscriber+ export | Medium (4.3) | Published |
| 61 | CVE-2026-1208 | Welcart | CSRF → settings update | Medium (4.3) | Published |
five patches mainlined through the standard kernel maintainer process — three with assigned CVEs.
| Subsystem | Fix | CVE | Status |
|---|---|---|---|
| io_uring/zcrx | Fix user_ref race between scrub and refill → double-free → OOB write | CVE-2026-43121 | Mainlined 7.0-rc1 |
| net/rtnetlink | Zero ifla_vf_broadcast to avoid stack infoleak | CVE-2026-46132 | Mainlined |
| RDMA/ionic | Bound node_desc sysfs read with %.64s — unbounded %s OOB read | CVE-2026-53371 | Mainlined |
| net/tipc | tipc_mon_peer_up/down/remove_peer UAF | — | Mainlined |
| Bluetooth/hci_conn | UAF in create_big_sync and create_big_complete | — | Mainlined |
all patches on lore.kernel.org →
| ID | Target | Type | Status |
|---|---|---|---|
| — | TelSender (WP) | Unauthenticated stored XSS via Telegram chat title (7.2) | Plugin taken down |
| GHSA-j425-whc4-4jgc | OpenClaw | system.run env override RCE — allowlist bypass (6.3) | Published |
| GHSA-gxhx-2686-5h9g | slack-go/slack | Security advisory | Published |
| GHSA-985r-q3qp-299h | phpmyfaq/phpmyfaq | Incomplete fix — editUser() and updateUserRights() lack auth guards | Published |
| — | @linear/sdk | LinearWebhooks.verify accepts empty secret without precondition | Merged ($400 bounty) |
| Project | Description |
|---|---|
| AATMF v3.1 | Adversarial AI Threat Modeling Framework — 20 tactics, 240+ techniques, 2,152+ procedures, 4,980+ prompts. Crosswalks to OWASP LLM Top-10, NIST AI RMF, MITRE ATLAS, EU AI Act. On OWASP GenAI Security 2026 roadmap. YARA + Sigma detection signatures included. |
| AATMF Toolkit | Python CLI for systematic LLM safety testing — three-layer evaluation pipeline, defense fingerprinting, regression tracking, attack chain planning. |
| Claude-Red | 58 offensive security skills across 13 categories for the Claude skills system. Drop a SKILL.md and Claude operates as a specialist — SQLi to shellcode, EDR evasion to ADCS abuse. |
| LLM Red Teamer's Playbook | Diagnostic methodology for bypassing LLM defense layers — input filters → alignment → identity → output → agentic trust. |
| Burp MCP Toolkit | Skills-based security analysis — Burp Suite traffic capture with Claude Code reasoning via MCP. |
| JystDastIt | The Burp You Can Afford — open-source CLI DAST toolkit. |
| SnailObfuscator | Structurally-aware code obfuscation engine — polymorphic payload generation. |
| SnailHunter | AI-powered bug bounty automation — LLM analysis + traditional scanning. |
| KubeRoast | Red-team Kubernetes misconfiguration & attack-path scanner. |
| Xposure | Autonomous credential intelligence platform for attack-surface recon. |
| SnailSploit Recon | Chrome MV3 extension — passive recon, security headers, IP intel, CPE→CVE enrichment. |
| Awesome-Snail-OSINT | Curated OSINT resource collection for offensive recon. |
| P.R.O.M.P.T | Adversarial prompt engineering methodology — structured attack phases with Cialdini influence principles. |
| SEF | Social Engineering Framework — organizational gap analysis, pretext selection, MITRE ATT&CK mapping. |
published at snailsploit.com, Hakin9 Magazine, and Medium.
| Paper | Summary |
|---|---|
| Self-Replicating Memory Worm | Autonomous persistence — skill injection + memory poisoning = self-healing implant. Four-stage kill chain, no jailbreak. |
| Memory Injection Through Nested Skills | Dual-persistence architecture: memory slots and skill files, each restoring the other on boot. |
| Weaponized AI Supply Chain | End-to-end supply chain attack through AI agent skill injection, validated against DVWA and Juice Shop. |
| AI Gateway Threat Model (TC-21) | First generalized threat model for AI gateways — 8 attack vectors, proposed as AATMF v3 TC-21. |
| MCP vs A2A Attack Surface | Comparative threat model — where MCP and Agent-to-Agent diverge in trust boundaries. |
| The 30% Blind Spot | LLM-as-judge safety classifiers miss ~30% of adversarial output classes. |
| AI Breach Detection Gap | Detection blind spots in AI-integrated production systems. |
| AI Coding Agent Attack Surface | Attack surface analysis of AI-powered coding assistants and their tool-use capabilities. |
| Agentic AI Threat Landscape | Threat landscape survey of autonomous AI agent architectures. |
| Adversarial Prompting: Complete Guide | End-to-end methodology — direct, indirect, multi-turn, and agentic prompt injection. |
| Computational Countertransference | The psychology of human–AI manipulation dynamics. |
| AATMF v3.1 vs MITRE ATLAS | Framework comparison — coverage gaps in existing AI threat taxonomies. |
| The Memory Manipulation Problem | How attackers exploit persistent context to compromise future interactions. |
| ChatGPT Canvas DNS Exfiltration | DNS exfil via ChatGPT Canvas — rendered content triggers DNS lookups without outbound HTTP. |
| ChatGPT Sandbox RCE + DNS Exfil | Pickle deserialization RCE chained with DNS exfiltration to escape Code Interpreter sandbox. |
| Double AI, Triple Mechanism | Cloud-based obfuscator attack research. |
| Linux Kernel io_uring/zcrx Race Condition | Race condition → double-free → OOB write in io_uring zero-copy receive. Mainlined; CVE-2026-43121. |
| Metric | Count |
|---|---|
| Published / assigned CVEs | 61 |
| — critical | 5 |
| — high | 18 |
| Distinct targets | 27 |
| Mainlined linux kernel patches | 5 |
| Kernel CVEs | 3 |
| GHSAs / vendor disclosures / bounties | 5 |
| Published frameworks | 3 (AATMF, SEF, P.R.O.M.P.T) |
| Open-source tools | 11 |
cross-reference note: CVE-2026-43121, CVE-2026-46132, and CVE-2026-53371 each appear once in the CVE table and once in the kernel patches section — same finding, listed in both places for discoverability. CVE-2026-48022 (@hapi/wreck) appears once in the CVE table; its GHSA is the same finding.
sources of record: Wordfence · GHSA Credit · GitHub · lore.kernel.org
same attack. different substrate.
Pinned Loading
Something went wrong, please refresh the page to try again.
If the problem persists, check the GitHub status page or contact support.
If the problem persists, check the GitHub status page or contact support.