GuardModel

GuardModel Block malicious AI models in your pipeline with one line of YAML. GuardModel is a GitHub Action that automatically scans ML model files for malicious code, vulnerabilities, and security risks in CI/CD pipelines. It blocks dangerous models before they reach production by detecting pickl...

Damn-Vulnerable-ML-Model

This repository does not have a README...

camel-pqc-tls

Post-Quantum TLS with Apache Camel This repository contains three examples demonstrating Post-Quantum Cryptography PQC TLS 1.3 handshakes with Apache Camel, using the X25519MLKEM768 hybrid key exchange. X25519MLKEM768 combines classical X25519 elliptic curve Diffie-Hellman with ML-KEM-768 , a...

ejbca-pqc-lab

EJBCA Pure PQC Lab — ML-DSA-65 Two-Tier PKI Hierarchy A hands-on implementation of NIST FIPS 204 ML-DSA in a two-tier PKI hierarchy using EJBCA Community Edition. 📖 Full walkthrough: Building a Post-Quantum PKI: How I Signed a Root CA and Sub CA Using ML-DSA on EJBCA What This Lab Builds A comple...

gha-lab-40e23db109

轻松构建 & 分享 令人愉快的机器学习程序 官网 | 文档 | 指南 | 开始 | 样例 | English Gradio: 用Python构建机器学习网页APP Gradio是一个开源的Python库，用于构建演示机器学习或数据科学，以及web应用程序。 使用Gradio，您可以基于您的机器学习模型或数据科学工作流快速创建一个漂亮的用户界面，让用户可以”尝试“拖放他们自己的图像、粘贴文本、录制他们自己的声音，并通过浏览器与您的演示程序进行交互。 Gradio适用于: 向客户/合伙人/用户/学生演示 您的机器学习模型。 通过自动共享链接快速部署 您的模型，并获得模型性能反馈。...

discuz-ml-rce

discuz-ml-rce 影响系统及版本：Discuz!ML V3.2-3.4 Discuz!x V3.2-3.4 漏洞原因：Discuz!ML 系统对cookie中的l接收的language参数内容未过滤，导致字符串拼接，从而执行php代码。 cookie字段中会出现xxxxxxxxlanguage字段，根本原因就是这个字段存在注入，导致的RCE 抓包找到cookie的language的值修改为 xxxxxxxxlanguage=sc'.phpinfo.' getshell...

LR-WebPKI

LR+ WebPKI 评估工件 本包包含最终版 LR+ 参考实现、生产重建包装器、测试以及针对 WebPKI CA 上下文中的上下文封闭后量子认证生成的评估输出。 该包有意作为提交工件而非研究日志快照编写：目标名称、文件名、模块名称和报告均使用稳定的实现术语。 内容 root@kitploit: src/lrplus/ LR+ 参考模块 scripts/ 语料库下载、构建、重建、评估和检查 config/ 固定的重建和下载配置 results/ 论文使用的生成生产输出 audit/ 来源报告和输出哈希清单 backups/ 重建前输入语料库备份的清单 data/ccadbfull/...

Final-project-SQL-injection-pipeline

SQL 注入检测 — 混合机器学习流水线 硕士论文源代码： 利用机器学习增强 Web 应用防火墙以检测 SQL 注入 | ---|--- 作者| Lilliane Linnet Musoke 机构| 雷丁大学计算机科学系 专业| 数据科学与高级计算理学硕士 导师| Atta Badii 教授 提交日期| 2024年9月17日 本仓库内容 两条新颖的混合机器学习流水线，每条均以独立的 Jupyter notebook 实现，用于检测 Web 应用流量中的 SQL 注入（SQLi）攻击： 1. DistilBERTStackedEnsemblepipeline.ipynb —...

fickling

Fickling Fickling is a decompiler, static analyzer, and bytecode rewriter for Python pickle object serializations. You can use fickling to detect, analyze, reverse engineer, or even create malicious pickle or pickle-based files, including PyTorch files. Fickling can be used both as a python libra...

PrivacyRaven

Note: This project is on hiatus. PrivacyRaven is a privacy testing library for deep learning systems. You can use it to determine the susceptibility of a model to different privacy attacks; evaluate privacy preserving machine learning techniques; develop novel privacy metrics and attacks; and...

sentrygrid

SentryGrid ML-driven threat detection and continuous monitoring platform built for federal zero-trust architectures. OSCAL-native, FedRAMP Moderate-aligned, hash-chained audit, three-model anomaly ensemble. Quick start root@kitploit: make setup install bun + python deps make dev-up bring up the...

EUVD-2026-70264

Windows ML CLI: CORS misconfig enables localhost RCE...

CVE-2026-84452

Windows ML CLI is a command line tool for building portable, performant, and high-quality AI models for Windows ML. Prior to 0.4.0, the src/winml/modelkit/serve/cliapi.py component exposes WinML CLI commands through a localhost HTTP API without authentication and configures the alloworigins setti...

CVE-2026-84452

Windows ML CLI (a command-line tool for building AI models for Windows) is vulnerable to arbitrary code execution via a CORS misconfiguration on its localhost HTTP API. Prior to version 0.4.0 , the cli_api.py and app.py components expose WinML CLI commands on localhost without authentication and ...

CVE-2026-84452 Windows ML CLI: CORS misconfig enables localhost RCE

Windows ML CLI is a command line tool for building portable, performant, and high-quality AI models for Windows ML. Prior to 0.4.0, the src/winml/modelkit/serve/cliapi.py component exposes WinML CLI commands through a localhost HTTP API without authentication and configures the alloworigins setti...

CVE-2026-84452 Windows ML CLI: CORS misconfig enables localhost RCE

Windows ML CLI is a command line tool for building portable, performant, and high-quality AI models for Windows ML. Prior to 0.4.0, the src/winml/modelkit/serve/cliapi.py component exposes WinML CLI commands through a localhost HTTP API without authentication and configures the alloworigins setti...

PT-2026-84865

Name of the Vulnerable Software and Affected Versions Windows ML CLI versions prior to 0.4.0 Description The src/winml/modelkit/serve/cli api.py component exposes commands through a localhost HTTP API without authentication and uses a wildcard for the allow origins setting. This allows a maliciou...

AZL-98451 CVE-2026-72649 affecting package rubygem-elasticsearch 8.9.0-1

Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine learning component can lead to remote code execution via Object Injection CAPEC-586. A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface tha...

EUVD-2026-69562

Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine learning component can lead to remote code execution via Object Injection CAPEC-586. A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface tha...

PT-2026-84388

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description Deserialization of untrusted data in the machine learning component allows remote code execution through object injection. An attacker can use a specially crafted trained model artifact...