39319 matches found
Malicious code in turbom (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 64978153f8a987180b6c8e88b5787598ed949a604527f0098271f97d8c66a235 Starting version 1.0.1, the package contains obfuscated code and embedded binary that is executed during the import, sharing many similarities with package...
Malicious code in turbod (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 78d60e25c1258021c4fb69a93456c76ef1157be852c7b9dc7165290ca599b0f7 Starting version 1.0.7, the package contains obfuscated code and embedded binary that is executed during the import, sharing many similarities with package...
Wiz ASM for any environment, any risk, everywhere
Protect the modern attack surface with new auto-reconnaissance capabilities, deep internal context, and the Red Agent to find any risk, anywhere...
CVE-2026-9731
The Wp Js Detect plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.9. This is due to missing or incorrect nonce validation on the pluginsettings function. This makes it possible for unauthenticated attackers to update the plugin's...
Entropy-Adaptive Multi-Map Chaotic Modulation for Physical-Layer Security
This paper presents a Multi-Map Dynamic-Entropy Intrusion-Aware Chaotic Modulation MU-DE-IAEACM-MM framework for adaptive physical-layer security in multi-user wireless systems. Unlike conventional chaos-based schemes that rely on static parameter secrecy, the proposed architecture treats entropy...
Suricata IDPE 8.0.6
Suricata is a network intrusion detection and prevention engine developed by the Open Information Security Foundation and its supporting vendors. The engine is multi-threaded and has native IPv6 support. It's capable of loading existing Snort rules and signatures and supports the Barnyard and...
Exploit for Path Traversal in Adobe Coldfusion
CVE-2026-48282 — Adobe ColdFusion RDS Validation and Detection...
Fickling vulnerable to use of ctypes and pydoc gadget chain to bypass detection
Fickling's assessmentpydoc and ctypes were added to the list of unsafe imports https://github.com/trailofbits/fickling/commit/b793563e60a5e039c5837b09d7f4f6b92e6040d1. Original report SummaryBoth ctypes and pydoc modules arent explictly blocked. Even other existing pickle scanning tools like...
PYSEC-2026-1369 Fickling vulnerable to use of ctypes and pydoc gadget chain to bypass detection
Fickling's assessment pydoc and ctypes were added to the list of unsafe imports https://github.com/trailofbits/fickling/commit/b793563e60a5e039c5837b09d7f4f6b92e6040d1. Original report Summary Both ctypes and pydoc modules arent explictly blocked. Even other existing pickle scanning tools like...
Picklescan does not block ctypes
SummaryPicklescan doesnt flag ctypes module as a dangerous module, which is a huge issue. ctypes is basically a foreign function interface library and can be used to Load DLLs Call C functions directly Manipulate memory raw pointers.This can allow attackers to achieve RCE by invoking direct...
PYSEC-2026-1368 Fickling has missing detection for marshal.loads and types.FunctionType in unsafe modules list
Fickling Assessment Based on the test case provided in the original report below, this bypass was caused by marshal and types missing from the block list of unsafe module imports, Fickling started blocking both modules to address this issue. This was fixed in...
PYSEC-2026-1868 reflex-dev/reflex has an Open Redirect vulnerability
Mitigation Make sure GITHUBCODESPACESPORTFORWARDINGDOMAIN is not set in a production environment. So the following is correct: assert os.getenv"GITHUBCODESPACESPORTFORWARDINGDOMAIN" is None Vulnerability Description --- Vulnerability Overview - When the GET /auth-codespace page loads in a GitHub...
Picklescan has a missing detection when calling built-in python idlelib.debugobj.ObjectTreeItem
SummaryUsing idlelib.debugobj.ObjectTreeItem.SetText, which is a built-in python library function to execute remote pickle file. DetailsThe attack payload executes in the following steps:First, the attacker craft the payload by calling to idlelib.debugobj.ObjectTreeItem.SetText function in reduce...
PYSEC-2026-1792 Picklescan is missing detection when calling built-in python ensurepip._run_pip
Summary Using ensurepip.runpip function, which is a built-in python library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to ensurepip.runpip function in reduce method Then when the victim after...
PYSEC-2026-1784 Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.get_entity
Summary Using idlelib.autocomplete.AutoComplete.getentity, which is a built-in python library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to idlelib.autocomplete.AutoComplete.getentity functio...
Picklescan is missing detection when calling built-in python ensurepip._run_pip
SummaryUsing ensurepip.runpip function, which is a built-in python library function to execute remote pickle file. DetailsThe attack payload executes in the following steps:First, the attacker craft the payload by calling to ensurepip.runpip function in reduce methodThen when the victim after...
PYSEC-2026-1788 Picklescan has pickle parsing logic flaw that leads to malicious pickle file bypass
Details There's a parsing logic error in picklescan and modelscan while trying to deal with opcode STACKGLOBAL. Function listglobals when handling STACKGLOBAL at position n, it is expected to track two arguments but in wrong range. The loop only consider the range from 1 to n-1 but forgets to...
Picklescan has pickle parsing logic flaw that leads to malicious pickle file bypass
DetailsThere's a parsing logic error in picklescan and modelscan while trying to deal with opcode STACKGLOBAL.Function listglobals when handling STACKGLOBAL at position n, it is expected to track two arguments but in wrong range. The loop only consider the range from 1 to n-1 but forgets to...