weakpass

Weakpass 在这里，你可以找到来自 weakpass.com 的工具列表和 API 服务器示例，用于集中进行密码和哈希破解。 📂 文件夹结构 tools 密码和哈希破解工具集。试试这些： Kraker-js Lookup Passcheck Passgen libs 本项目所用库的链接。 rules 用于高级攻击的破解规则存档。 所有工具和库都可在各自的文件夹中找到。以下是工具的快速概览，方便你立即尝试。 🚀 工具概览 Passgen - 密码生成器 根据用户提供的关键词生成字典，用于针对性密码测试。 在线试用： Passgen...

SRS - Command Injection

SRS's v5.0.137v5.0.156, v6.0.18v6.0.47 api-server server is vulnerable to a drive-by command injection. id: CVE-2023-34105 info: name: SRS - Command Injection author: iamnoooob,rootxharsh,pdresearch severity: high description: | SRS's v5.0.137v5.0.156, v6.0.18v6.0.47 api-server server is vulnerab...

kubebot

Kubebot A security testing Slackbot built with a Kubernetes backend on the Google Cloud Platform NOTE: I am not actively maintaining this project anymore. I am working on v2 of Kubebot along with a couple other folks which will likely be presented at one of the upcoming security conferences...

PoC-CVE-2026-23744

PoC-CVE-2026-23744 Remote Code Execution on MCPJam Inspector Reference https://github.com/MCPJam/inspector/security/advisories/GHSA-232v-j27c-5pp6...

CVE-2020-8559

Kubernetes CVE-2020-8559 Exploit de Prueba de Concepto PoC Esto es solo para fines de demostración. Solo para usar en sistemas sobre los que estás autorizado a realizar acciones administrativas y en los que estás autorizado a explotar CVE-2020-8559 Este es un PoC para CVE-2020-8559. Esta...

PT-2026-84514

Name of the Vulnerable Software and Affected Versions hermes-agent version 0.18.0 Description A flaw in the Session Chat Interface component, specifically within the gateway/platforms/api server.py file, allows a remote attacker to cause a denial of service. Recommendations At the moment, there i...

qwed Vulnerable to Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`

Summary The qwed package version 5.1.1 passes attacker-controlled input directly to SymPy's parseexpr function without a restricted namespace. Because parseexpr internally calls Python's eval, any authenticated tenant can execute arbitrary Python code inside the API server process. The attack...

CVE-2026-55585 QWED: Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`

QWED is open-source AI verification infrastructure for deterministic verification of LLM outputs, tool calls, code, schemas, and agent state before production execution. Prior to 5.1.2, the qwed package passes caller-controlled math expressions directly to SymPy parseexpr without restricted...

CVE-2026-55585 QWED: Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`

QWED is open-source AI verification infrastructure for deterministic verification of LLM outputs, tool calls, code, schemas, and agent state before production execution. Prior to 5.1.2, the qwed package passes caller-controlled math expressions directly to SymPy parseexpr without restricted...

CVE-2026-55585

QWED (open-source AI verification infrastructure) prior to version 5.1.2 is vulnerable to authenticated Remote Code Execution . Caller-controlled math expressions are passed directly to SymPy parse_expr() without restricted global_dict/local_dict namespaces, effectively allowing Python eval() to ...

MAL-2026-14328 Malicious code in goldstar-api-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 79d095fdd61f79c64b4b5d12ba75957b7c5de47df2bcfa549b05b23c7e450eba Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-73499 vulnerabilities

Vulnerabilities for packages: kine, dapr...

BIT-AIRFLOW-2026-59242 Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom deserialize endpoint

Apache Airflow's XCom GET /api/v2/.../xcomEntries/key?deserialize=true endpoint passed a string-literal payload through BaseXCom.deserializevalue without the checkforbiddenxcomkeys guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary airflow. classes ...

BIT-AIRFLOW-2026-58076 Apache Airflow: Unguarded import_string() of airflow_exc_ser / base_exc_ser exception nodes in BaseSerialization.deserialize enables DAG-author RCE on Scheduler / API Server

Apache Airflow's serialization layer reconstructed exception nodes by calling importstring on a class name taken from the serialized blob and instantiating it with arguments from the same blob, with no restriction on what could be imported. An operator's executorconfig reaches that branch, so a D...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the deserialize. An attacker can execute arbitrary code by supplying a crafted serialized blob that causes the import and invocation of malicious callables. This can be exploited by a DAG author...

CVE-2026-58076

Apache Airflow's serialization layer reconstructed exception nodes by calling importstring on a class name taken from the serialized blob and instantiating it with arguments from the same blob, with no restriction on what could be imported. An operator's executorconfig reaches that branch, so a D...

EUVD-2026-57315

Apache Airflow's serialization layer reconstructed exception nodes by calling importstring on a class name taken from the serialized blob and instantiating it with arguments from the same blob, with no restriction on what could be imported. An operator's executorconfig reaches that branch, so a D...

CVE-2026-58076 Apache Airflow: Unguarded import_string() of airflow_exc_ser / base_exc_ser exception nodes in BaseSerialization.deserialize enables DAG-author RCE on Scheduler / API Server

Apache Airflow's serialization layer reconstructed exception nodes by calling importstring on a class name taken from the serialized blob and instantiating it with arguments from the same blob, with no restriction on what could be imported. An operator's executorconfig reaches that branch, so a D...

CVE-2026-58076

Apache Airflow CVE-2026-58076 describes an unguarded import_string() deserialization path in the serialization layer (BaseSerialization.deserialize) that can import and invoke arbitrary callables via a serialized blob placed in executor_config. The vulnerability can be triggered by a DAG author a...

CVE-2026-58076

Apache Airflow's serialization layer reconstructed exception nodes by calling importstring on a class name taken from the serialized blob and instantiating it with arguments from the same blob, with no restriction on what could be imported. An operator's executorconfig reaches that branch, so a D...