$ whoami
kai aizen — adversarial ai researcher · linux kernel contributor · cve hunter
$ cat /proc/threat-surface
CVEs: 97 | Critical: 7 | High: 25 | Kernel: 5 | AI/LLM: 17
$ ls /usr/lib/frameworks/
AATMF_v3.1/ AGT/ SEF/ P.R.O.M.P.T/
$ echo $CURRENT_OPS
OlympicGames FLAWLESS RBME-Theory CLS-Gap-Weaponadversarial ai research · llm red teaming · kernel · vulnerability research
|
|
|
6 patches accepted into the Linux kernel mainline — io_uring · bluetooth · iommufd · rtnetlink · rdma · usb gadget
| CVE | Subsystem | Finding | Status |
|---|---|---|---|
| CVE-2026-43121 | io_uring/zcrx |
user_ref race → double-free → OOB write | ✅ v6.18.16 |
| CVE-2026-46111 | bluetooth/hci_conn |
use-after-free in big sync create/complete | ✅ mainlined |
| CVE-2026-64293 | iommufd/veventq |
high severity flaw | ✅ mainlined |
| CVE-2026-46132 | net/rtnetlink |
ifla_vf_broadcast kernel stack leak | ✅ mainlined |
| CVE-2026-53371 | rdma/ionic |
unbounded %s → OOB read via sysfs | ✅ mainlined |
| CVE-2026-64233 | usb: gadget: uvc |
medium severity | ✅ mainlined |
Severity: 🔴 Critical | 🟠 High | 🟡 Medium | 🔵 Low | ⚫ Unknown Status: ✅ Published/Mainlined | 🔒 Pending
| # | CVE | Target | Finding | Sev | Status |
|---|---|---|---|---|---|
| 1 | CVE-2026-46111 | Linux Kernel (Bluetooth/hci_conn) | Use-After-Free in create_big_sync / create_big_complete | 🟠 | ✅ Mainlined |
| 2 | CVE-2026-64293 | Linux Kernel (iommufd veventq) | High severity flaw | 🟠 | ✅ Mainlined |
| 3 | CVE-2026-46132 | Linux Kernel (net/rtnetlink) | ifla_vf_broadcast kernel stack memory leak | 🟡 | ✅ Mainlined |
| 4 | CVE-2026-53371 | Linux Kernel (RDMA/ionic) | Unbounded %s → OOB read through sysfs | 🟡 | ✅ Mainlined |
| 5 | CVE-2026-64233 | Linux Kernel (usb: gadget: uvc) | Medium severity issue | 🟡 | ✅ Mainlined |
| 6 | CVE-2026-43121 | Linux Kernel (io_uring/zcrx) | user_ref race condition → double-free → OOB write | 🟡 | ✅ Mainlined (v6.18.16) |
| 7 | CVE-2026-30911 | Apache Airflow Core | Missing per-task authorization on HITL endpoints | 🟠 | ✅ Published |
| 8 | CVE-2026-32794 | Apache Airflow Databricks | TLS certificate verification bypass | 🟡 | ✅ Published |
| 9 | CVE-2026-61308 | Oracle Java / GraalVM | Networking / credential leakage across redirects | 🟡 | ✅ Published |
| 10 | CVE-2026-3288 | Kubernetes ingress-nginx | Configuration injection → RCE | 🟠 | ✅ Published |
| 11 | CVE-2026-19017 | HashiCorp / IBM Consul | ACL token evaluation bypass | 🟡 | ✅ Published |
| 12 | CVE-2026-93576 | Netty (netty-codec-smtp) | High severity issue | 🟠 | ✅ Published |
| 13 | CVE-2026-69261 | Git LFS | SSH credential handling | ⚫ | 🔒 Pending |
| 14 | CVE-2026-55070 | argoproj/argo-workflows | Incomplete authorization bypass | 🟡 | 🔒 Pending |
| 15 | CVE-2026-57303 | Jenkins Assembla | XML External Entity (XXE) Injection | 🟠 | ✅ Published |
| 16 | CVE-2026-84674 | Jenkins XebiaLabs XL Deploy | Medium severity | 🟡 | ✅ Published |
| 17 | CVE-2026-57297 | Jenkins Contrast CAS | Missing permission check | 🟡 | ✅ Published |
| 18 | CVE-2026-57298 | Jenkins Contrast CAS | CSRF | 🟡 | ✅ Published |
| 19 | CVE-2026-57304 | Jenkins Assembla | Missing permission check | 🟡 | ✅ Published |
| 20 | CVE-2026-57305 | Jenkins Assembla | CSRF | 🟡 | ✅ Published |
| 21 | CVE-2026-70445 | Jenkins Sauce OnDemand | Impersonation & permission check missing | 🟡 | ✅ Published |
| 22 | CVE-2026-57299 | Jenkins Contrast CAS | Metadata & workspace enumeration | 🟡 | ✅ Published |
| 23 | CVE-2026-8661 | Rapid7 InsightConnect | Markdown to PDF plugin issue | 🟡 | ✅ Published |
| 24 | CVE-2026-48130 | tektoncd/pipeline | Unbounded response read → OOM DoS | 🟡 | 🔒 Pending |
| 25 | CVE-2026-17351 | pgAdmin 4 | Code injection in desktop runtime | 🔴 | ✅ Published |
| 26 | CVE-2026-46627 | Twig (PHP) | Sandbox does not protect against resource exhaustion | 🟡 | ✅ Published |
| 27 | CVE-2026-94608 | goauthentik/authentik | High severity | 🟠 | 🔒 Pending |
| 28 | CVE-2026-54236 | vLLM | Information leak enabling ASLR bypass | 🟡 | ✅ Published |
| 29 | CVE-2026-48782 | pydantic-ai | SSRF metadata blocklist bypass | 🟡 | ✅ Published |
| 30 | CVE-2026-47393 | PraisonAI | Authentication disabled by default | 🔴 | ✅ Published |
| 31 | CVE-2026-57127 | PraisonAI | recipe serve auth middleware disables itself | 🔴 | ✅ Published |
| 32 | CVE-2026-57131 | PraisonAI | Jobs API without authentication | 🔴 | ✅ Published |
| 33 | CVE-2026-57147 | PraisonAI | Hardcoded default JWT signing secret | 🔴 | ✅ Published |
| 34 | CVE-2026-57126 | PraisonAI | SSRF guard without DNS resolution | 🟠 | ✅ Published |
| 35 | CVE-2026-55528 | PraisonAI | AgentServer auth_token not enforced | 🟠 | ✅ Published |
| 36 | CVE-2026-47398 | PraisonAI | Code injection through exec_module | 🟠 | ✅ Published |
| 37 | CVE-2026-57120 | PraisonAI | execute_code sandbox bypass | 🟡 | ✅ Published |
| 38 | CVE-2026-55530 | PraisonAI | ast_grep_rewrite modifies arbitrary files | 🟡 | ✅ Published |
| 39 | CVE-2026-60087 | PraisonAI | Tool approval caching bypass | 🟡 | ✅ Published |
| 40 | CVE-2026-60086 | PraisonAI | Medium severity | 🟡 | ✅ Published |
| 41 | CVE-2026-49853 | tornadoweb/tornado | Authorization header forwarded across redirects | 🟠 | ✅ Published |
| 42 | CVE-2026-79777 | rclone (Go) | Low severity | 🔵 | ✅ Published |
| 43 | CVE-2026-44840 | Dgraph (Go) | DQL Injection | 🟠 | ✅ Published |
| 44 | CVE-2026-54076 | ArcadeDB | High severity | 🟠 | ✅ Published |
| 45 | CVE-2026-8368 | Perl LWP::UserAgent | Medium severity | 🟡 | ✅ Published |
| 46 | CVE-2026-48022 | @hapi/wreck (npm) | Medium severity | 🟡 | ✅ Published |
| 47 | CVE-2026-96754 | orval @orval/hono | High — credit dispute (correction pending) | 🟠 | ✅ Published |
| 48 | CVE-2026-96757 | orval @orval/fetch / core | High — credit dispute (correction pending) | 🟠 | ✅ Published |
| 49 | CVE-2026-107715 | mechanize (RubyGems) | Medium severity | 🟡 | ✅ Published |
| 50 | CVE-2026-54171 | Excon (RubyGems) | Medium severity | 🟡 | ✅ Published |
| 51 | CVE-2026-45363 | jwt (RubyGems) | Empty-key HMAC signature verification bypass | 🟠 | ✅ Published |
| 52 | CVE-2026-31899 | Kozea/CairoSVG | Recursive SVG amplification → exponential DoS | 🟠 | ✅ Published |
| 53 | CVE-2026-32885 | github.com/ddev/ddev | ZipSlip / path traversal | 🟡 | ✅ Published |
| 54 | CVE-2026-43884 | WWBN/AVideo | High severity | 🟠 | ✅ Published |
| 55 | CVE-2026-45619 | WWBN/AVideo | Medium severity | 🟡 | ✅ Published |
| 56 | CVE-2026-45620 | WWBN/AVideo | Medium severity | 🟡 | ✅ Published |
| 57 | CVE-2026-56396 | phpMyFAQ | High severity | 🟠 | ✅ Published |
| 58 | CVE-2026-52775 | yeswiki/yeswiki | High severity | 🟠 | ✅ Published |
| 59 | CVE-2026-33693 | activitypub-federation-rust | SSRF via 0.0.0.0 bypass | 🟡 | ✅ Published |
| 60 | CVE-2026-32809 | ouch (Rust) | Symlink path traversal | 🟠 | 🔒 Pending |
| 61 | CVE-2026-44217 | sse-channel (npm) | SSE injection | 🟡 | ✅ Published |
| 62 | CVE-2026-49353 | decolua/9router | Host-header access-gate bypass | 🟠 | ✅ Published |
| 63 | CVE-2026-48814 | Network AI (npm) | Empty default secret → auth bypass | 🔴 | ✅ Published |
| 64 | CVE-2026-1314 | WordPress - 3D FlipBook | Missing authentication checks | 🟡 | ✅ Published |
| 65 | CVE-2025-12030 | WordPress - ACF to REST API | IDOR | 🟡 | ✅ Published |
| 66 | CVE-2026-0811 | WordPress - Advanced CF7 DB | CSRF → form deletion | 🟡 | ✅ Published |
| 67 | CVE-2026-0814 | WordPress - Advanced CF7 DB | Unauthorized database export | 🟡 | ✅ Published |
| 68 | CVE-2025-9776 | WordPress - CatFolders | SQL injection via CSV import | 🟡 | ✅ Published |
| 69 | CVE-2025-11171 | WordPress - Chartify (joint w/ Avraham Shemesh) | Missing authentication | 🟡 | ✅ Published |
| 70 | CVE-2025-11174 | WordPress - Document Library Lite (joint w/ Avraham Shemesh) | Missing authentication → info disclosure | 🟡 | ✅ Published |
| 71 | CVE-2026-1208 | WordPress - Friendly Functions for Welcart | CSRF → settings update | 🟡 | ✅ Published |
| 72 | CVE-2026-2717 | WordPress - HTTP Headers | CRLF Injection | 🟡 | ✅ Published |
| 73 | CVE-2026-1313 | WordPress - MimeTypes Link Icons | SSRF | 🟠 | ✅ Published |
| 74 | CVE-2025-12163 | WordPress - Omnipress | Stored XSS | 🟡 | ✅ Published |
| 75 | CVE-2026-3596 | WordPress - Riaxe Product Customizer | Missing authentication → privilege escalation | 🔴 | ✅ Published |
| 76 | CVE-2026-3599 | WordPress - Riaxe Product Customizer | Unauthenticated SQL injection | 🟠 | ✅ Published |
| 77 | CVE-2026-3594 | WordPress - Riaxe Product Customizer | Unauthenticated information disclosure | 🟡 | ✅ Published |
| 78 | CVE-2026-3595 | WordPress - Riaxe Product Customizer | Unauthenticated arbitrary user deletion | 🟡 | ✅ Published |
| 79 | CVE-2026-15298 | WordPress - TelSender | Unauthenticated stored XSS | 🟠 | ✅ Published |
| Project | Description |
|---|---|
| AATMF v3.1 | Adversarial AI Threat Modeling Framework — 15 tactics, 240+ techniques, 2,152+ procedures, 4,980+ prompts. Crosswalks to OWASP LLM Top-10, NIST AI RMF, MITRE ATLAS, EU AI Act. On OWASP GenAI Security 2026 roadmap. YARA + Sigma detection signatures included. |
| AATMF Toolkit | Python CLI for systematic LLM safety testing — three-layer evaluation pipeline, defense fingerprinting, regression tracking, attack chain planning. |
| Claude-Red | 78 offensive security skills across 23 categories for the Claude skills system. Drop a SKILL.md and Claude operates as a specialist — SQLi to shellcode, EDR evasion to ADCS abuse. |
| LLM Red Teamer's Playbook | Diagnostic methodology for bypassing LLM defense layers — input filters → alignment → identity → output → agentic trust. |
| Burp MCP Toolkit | Skills-based security analysis — Burp Suite traffic capture with Claude Code reasoning via MCP. |
| JystDastIt | The Burp You Can Afford — open-source CLI DAST toolkit. |
| SnailObfuscator | Structurally-aware code obfuscation engine — polymorphic payload generation. |
| SnailHunter | AI-powered bug bounty automation — LLM analysis + traditional scanning. |
| KubeRoast | Red-team Kubernetes misconfiguration & attack-path scanner. |
| Xposure | Autonomous credential intelligence platform for attack-surface recon. |
| SnailSploit Recon | Chrome MV3 extension — passive recon, security headers, IP intel, CPE→CVE enrichment. |
| Awesome-Snail-OSINT | Curated OSINT resource collection for offensive recon. |
| P.R.O.M.P.T | Adversarial prompt engineering methodology — structured attack phases with Cialdini influence principles. |
| SEF | Social Engineering Framework — organizational gap analysis, pretext selection, MITRE ATT&CK mapping. |
published at snailsploit.com, Hakin9 Magazine, and Medium.
| Paper | Summary |
|---|---|
| Self-Replicating Memory Worm | Autonomous persistence — skill injection + memory poisoning = self-healing implant. Four-stage kill chain, no jailbreak. |
| Memory Injection Through Nested Skills | Persistent autonomous operator via skills + memory + MCP. Submitted to Anthropic. |
| AI Output Classifier Gap | Classifiers miss ~30% of adversarial output classes. |
| AI Breach Detection Gap | Detection blind spots in AI-integrated production systems. |
| AI Coding Agent Attack Surface | Attack surface analysis of AI-powered coding assistants and their tool-use capabilities. |
| Agentic AI Threat Landscape | Threat landscape survey of autonomous AI agent architectures. |
| Adversarial Prompting: Complete Guide | End-to-end methodology — direct, indirect, multi-turn, and agentic prompt injection. |
| Computational Countertransference | The psychology of human–AI manipulation dynamics. |
| AATMF v3.1 vs MITRE ATLAS | Framework comparison — coverage gaps in existing AI threat taxonomies. |
| The Memory Manipulation Problem | How attackers exploit persistent context to compromise future interactions. |
| ChatGPT Canvas DNS Exfiltration | DNS exfil via ChatGPT Canvas — rendered content triggers DNS lookups without outbound HTTP. |
| ChatGPT Sandbox RCE + DNS Exfil | Pickle deserialization RCE chained with DNS exfiltration to escape Code Interpreter sandbox. |
| Double AI, Triple Mechanism | Cloud-based obfuscator attack research. |
| Linux Kernel io_uring/zcrx Race Condition | Race condition → double-free → OOB write in io_uring zero-copy receive. Mainlined; CVE-2026-43121. |
sources of record: Wordfence · GHSA Credit · GitHub · lore.kernel.org
same attack. different substrate.