#1Adversarial ML attack frameworks, evasion techniques, and model robustness evaluation tools.
Kitploit recommended
lsudoko/antibodyGitLab Duo DevSecOps loop where a second AI re-attacks every AI-written fix, saving each successful bypass as a permanent antibody replayed in CI and…
moontea0416/webmirageAdversarial image attacks on vision-language web agents, from visual grounding to browser execution
hackspeak/cve-2026-64638XSS2Shell (CVE-2026-64638) WordPress pre-auth XSS to RCE PoC mirror — WordSec, MIT; for authorized security testing
guzonghua/awesome-latency-attacksCurated index of deep learning latency, energy-latency & timing (availability) attacks and defenses — companion to the ACM Computing Surveys…
alex66366/odpureBlack-box input-stage purification defense that neutralizes backdoor attacks on object detectors via corruption, diffusion reconstruction, and DBSCAN…
george0papasotiriou/cve-2026-21010-voip-sip-digest-authentication-replayPython PoC for CVE-2026-21010 that replays captured SIP digest Authorization headers to bypass nonce uniqueness/expiration and make unauthorized VoIP…
ezramansor/cve-2025-32432-pocA simple PoC on the Remote Code Execution (RCE) Vulnerability of CraftCMS designated as CVE-2025-32432 written in Go
jackfromeast/cve-2025-30374Exploit PoCs for CVE-2025-30374, a Taipy class pollution bug, demonstrating RCE, reflected XSS, DoS, and OpenAI credential leakage with Docker-based…
george0papasotiriou/cve-2026-5556-kubernetes-admission-controller-bypass-via-case-sensitivityExploit PoC and vulnerable admission webhook for CVE-2026-5556, demonstrating Kubernetes admission controller bypass via case-sensitive pod name…
george0papasotiriou/cve-2026-7070-rdp-clipboard-hijacking-via-virtual-channel-injectionCVE-2026-7070 PoC for RDP clipboard hijacking via virtual channel injection; includes simulated server and exploit script for data theft/credential…
george0papasotiriou/cve-2026-1337-ai-coding-assistant-prompt-injection-to-sandbox-escapeA prompt injection in a code‑review bot that executes AI‑generated fixes in a sandbox. The sandbox uses a blacklist to prevent dangerous commands,…
george0papasotiriou/cve-2026-21003-jwt-none-algorithm-bypass-via-kid-header-omissionProof-of-concept exploit for CVE-2026-21003 demonstrating JWT authentication bypass by omitting the kid header and using the 'none' algorithm to…
defineid/skeletonkeyCVE-2026-6765, Test only FormAutofill handlers exposed in Firefox
george0papasotiriou/cve-2026-22007-ntp-monlist-amplification-over-ipv6Python PoC for CVE-2026-22007: NTP monlist amplification over IPv6, including a simulated vulnerable server and spoofed UDP reflection attack.
camillegr/cve-2026-73292Proof-of-concept exploit for CVE-2026-73292: CSRF attack on Semaphore UI password change endpoint, serving a malicious page that silently resets an…
chanwoochoi316/kidnapragBlack-box attack framework that hijacks reasoning in agentic retrieval-augmented generation systems by injecting poisoned documents, with support for…
cenobyte-vincit/xspawnSpawns macOS programs through launchd's private XPC interface without execing them, making EDR record launchd as parent. Supports one-shot,…
george0papasotiriou/cve-2026-6060-quic-handshake-amplification-via-address-validation-bypassEducational Python PoC for a QUIC address-validation bypass that triggers handshake amplification, including vulnerable server simulation and attack…
