PT-2026-69842

Name of the Vulnerable Software and Affected Versions Python affected versions not specified Description Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing, leading to significant CPU consumption when applications pass unbounded input to the...

Malicious code in hex-encode-utils (npm)

hex-encode-utils is a purpose-built npm trojan that masquerades as a zero-dependency hex encoding/decoding utility published by the npm account devroolx under the repo github.com/stdlib-utils/hex-encode-utils. It is a multi-stage downloader/loader that runs automatically on install via a...

ROS-20260810-73-0036

The vulnerability in python-authlib relates to the redirection of URLs to unreliable websites. Exploiting this vulnerability allows a malicious actor to redirect users to arbitrary URL addresses...

RHEL 8 : python-pillow (RHSA-2026:52551)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:52551 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

ROS-20260810-73-0035

The vulnerability in python-authlib is related to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to perform a CSRF attack remotely...

jdwp-exploit

JDWP Remote Code Execution Exploit A Python 3 implementation...

monty v0.0.20

Monty A minimal, secure Python interpreter written in Rust for use by AI. Experimental - This project is still in development, and not ready for prime time. A minimal, secure Python interpreter written in Rust for use by AI. Monty avoids the cost, latency, complexity and general faff of using a...

Updated python-starlette package fixes security vulnerabilities

The updated package fixes security vulnerabilities: Proxy-Authorization header kept across hosts. CVE-2024-28849 Starlette vulnerable to On^2 DoS via Range header merging in starlette.responses.FileResponse. CVE-2025-62727 Security restriction bypass via malformed HTTP Host header. CVE-2026-48710...

Fedora 43 : python-wsgidav (2026-3808436c81)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3808436c81 advisory. fixes the following security issues: - CVE-2026-55509 - CVE-2026-55560 Tenable has extracted the preceding description block directly from the Fedor...

Kitty Agent Installer Pack

Writes kittyagent.py plus installlinux.sh systemd and/or installwindows.ps1 scheduled task. Controller: listeners/multi/reversehttppolling. from kittysploit import from lib.c2.agentinstaller import buildinstallreadme, buildlinuxinstallsh, buildwindowsschtasksinstallps1, from lib.c2.agentspec impo...

Python Reverse UDP Shell

UDP connect-back shell KSUDPHELLO protocol. Pairs with listeners/multi/reverseudp !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModulePayload: CLIENTLANGUAGE = "python" info = "name": "Python Reverse UDP Shell", "description": "UDP connect-back shell KSUDPHELLO protocol...

Python PostgreSQL NOTIFY Reverse Agent

C2 agent over PostgreSQL LISTEN/NOTIFY. Pairs with listeners/database/postgresqlnotifyshell. Requires psycopg2 on target and network access to PostgreSQL. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.postgresqlnotifyagent import buildpostgresqlnotifyagentscript...

Python Slack Reverse Agent

Poll Slack channel for !ks cmd messages and post output. Pairs with listeners/messaging/slacksocketmode. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.slackreverseagent import buildslackreverseagentscript class ModulePayload: CLIENTLANGUAGE = "python" info = "name"...

Unix Download Stager, python urllib

Download and exec stager via Python urllib — no curl/wget required. Host stager.py with hoststager generate. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.downloadstagers import buildstagerurl class ModulePayload: CLIENTLANGUAGE = "python" info = "name": "Unix...

Python Reverse SSH Client

Connect back to listeners/multi/reversessh with username/password and spawn an interactive shell over the SSH channel. !/usr/bin/env python3 -- coding: utf-8 -- """Paramiko-based reverse SSH client for listeners/multi/reversessh.""" from kittysploit import class ModulePayload: CLIENTLANGUAGE =...

python: Fix of CVE-2026-11972

CVE-2026-11972: fix an unbounded loop CPU DoS in the tarfile module when a member header in a streaming-mode archive mode="r|" declares a huge size, by breaking out of the Stream.seek read loop at EOF...

Malicious code in riakcs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3dada3cec22fb43bb528b8f4f7173bb346b25e373eaeb719af2df48698119240 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

maltrail v3.0

Maltrail Maltrail is a network traffic detection system that identifies communication with known malicious infrastructure and reports selected traffic anomalies. It matches domains, URLs, IP addresses, IP:port pairs, and User-Agent values observed on the network against a set of indicators called...

quark-engine v26.8.1

Malware Family Analysis Report Showcase | | ---|---|--- | !https://assets.kitpl...

readme2demo v0.8.0

readme2demo — verified tutorials & demo videos from your README ▶ readme2demo generating its own tutorial: an AI agent runs this repo's README in a sandbox, a fresh container replays every step, then the demo is rendered. Full self-run output in examples/readme2demo · run against another project ...