GCP Compute Attack Surface

Map Compute Engine attack surface: public IPs, scopes, metadata, and weak controls !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Compute Attack Surface", "description": "Map Compute Engin...

GCP Compute Instances

Enumerate Compute Engine instances in the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Compute Instances", "description": "Enumerate Compute Engine...

GCP Compute SSH Pivot via OS Login

Pivot to a VM by importing an SSH key through OS Login and preparing a Compute SSH session !/usr/bin/env python3 -- coding: utf-8 -- import json import time from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Compute SSH Pivot via OS...

GCP Compute SSH Pivot via Metadata

Pivot to a VM by injecting an SSH key into Compute metadata and preparing a Compute SSH session !/usr/bin/env python3 -- coding: utf-8 -- import json import time from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Compute SSH Pivot via...

Rucio has SQL Injection in FilterEngine Oracle JSON Path via DID Search API

SummaryA SQL injection vulnerability in the Oracle path of FilterEngine.createsqlaquery allows any authenticated Rucio user to execute arbitrary SQL against the backend database through the DID search endpoint GET /dids//dids/search. Attacker-controlled filter keys and values are interpolated...

PYSEC-2026-528 Rucio has SQL Injection in FilterEngine Oracle JSON Path via DID Search API

Summary A SQL injection vulnerability in the Oracle path of FilterEngine.createsqlaquery allows any authenticated Rucio user to execute arbitrary SQL against the backend database through the DID search endpoint GET /dids//dids/search. Attacker-controlled filter keys and values are interpolated...

Rucio has SQL Injection in FilterEngine PostgreSQL Query Builder via DID Search API

SummaryA SQL injection vulnerability in FilterEngine.createpostgresquery allows any authenticated Rucio user to execute arbitrary SQL against the configured PostgreSQL metadata database through the DID search endpoint GET /dids//dids/search. When the external metadata plugin postgresmeta is...

PYSEC-2026-527 Rucio has SQL Injection in FilterEngine PostgreSQL Query Builder via DID Search API

Summary A SQL injection vulnerability in FilterEngine.createpostgresquery allows any authenticated Rucio user to execute arbitrary SQL against the configured PostgreSQL metadata database through the DID search endpoint GET /dids//dids/search. When the external metadata plugin postgresmeta is...

airalogy-engine (0.0.2) potentially affected by CVE-2026-46703 via boxlite (0.8.2)

boxlite PYPI version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on boxlite and may be impacted: - airalogy-engine 0.0.2 Source cves: CVE-2026-46703 Source advisory: OSV:PYSEC-2026-298...

airalogy-engine (0.0.2) potentially affected by CVE-2026-46695 via boxlite (0.8.2)

boxlite PYPI version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on boxlite and may be impacted: - airalogy-engine 0.0.2 Source cves: CVE-2026-46695 Source advisory: OSV:PYSEC-2026-299...

ai-safety-engine (0.1.0) potentially affected by CVE-2026-30625 via upsonic (0.60.0a1754435135)

upsonic PYPI version 0.60.0a1754435135 is affected by a known vulnerability. The following packages have a transitive dependency on upsonic and may be impacted: - ai-safety-engine 0.1.0 Source cves: CVE-2026-30625 Source advisory: OSV:PYSEC-2026-559...

PYSEC-2026-310 changedetection.io has a Server Side Template Injection using Jinja2 which allows Remote Command Execution

Summary A Server Side Template Injection in changedetection.io caused by usage of unsafe functions of Jinja2 allows Remote Command Execution on the server host. Details changedetection.io version: 0.45.20 docker images REPOSITORY TAG IMAGE ID CREATED SIZE dgtlmoon/changedetection.io latest...

PYSEC-2026-387 LiteLLM has Server-Side Template Injection vulnerability in /completions endpoint

BerriAI/litellm is vulnerable to Server-Side Template Injection SSTI via the /completions endpoint. The vulnerability arises from the hfchattemplate method processing the chattemplate parameter from the tokenizerconfig.json file through the Jinja template engine without proper sanitization...

vLLM Allows Remote Code Execution via PyNcclPipe Communication Service

Impacted EnvironmentsThis issue ONLY impacts environments using the PyNcclPipe KV cache transfer integration with the V0 engine. No other configurations are affected. SummaryvLLM supports the use of thePyNcclPipeclass to establish a peer-to-peer communication domain for data transmission between...

PYSEC-2026-567 vLLM Allows Remote Code Execution via PyNcclPipe Communication Service

Impacted Environments This issue ONLY impacts environments using the PyNcclPipe KV cache transfer integration with the V0 engine. No other configurations are affected. Summary vLLM supports the use of the PyNcclPipe class to establish a peer-to-peer communication domain for data transmission...

dimweb-persona-bot (0.0.6), finetuning-scheduler (0.2.2) +1 more potentially affected by CVE-2024-8019 via pytorch-lightning (1.7.6)

pytorch-lightning PYPI version 1.7.6 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - dimweb-persona-bot 0.0.6 - finetuning-scheduler 0.2.2 - gts-engine 0.1.3 Source cves: CVE-2024-8019 Source advisory:...

github.com/containerd/containerd: containerd: Denial of Service via maliciously crafted image leading to unbounded group parsing

A flaw was found in containerd, an open-source container runtime. A remote attacker could exploit this vulnerability by providing a maliciously crafted image. When a container is created from this image, it leads to uncontrolled resource consumption and memory exhaustion, causing the containerd...

github.com/containerd/containerd: containerd: Denial of Service via maliciously crafted image leading to unbounded group parsing

A flaw was found in containerd, an open-source container runtime. A remote attacker could exploit this vulnerability by providing a maliciously crafted image. When a container is created from this image, it leads to uncontrolled resource consumption and memory exhaustion, causing the containerd...

PT-2026-53434

A Code Injection and Missing Authentication vulnerability in Google Agent Development Kit ADK versions 1.7.0 and 2.0.0a1 through 1.28.1 and 2.0.0a2 on Python OSS, Cloud Run, and GKE allows an unauthenticated remote attacker to execute arbitrary code on the server hosting the ADK instance. This...

PT-2026-53477

Description llama-cpp-python depends on class Llama in llama.py to load .gguf llama.cpp or Latency Machine Learning Models. The init constructor built in the Llama takes several parameters to configure the loading and running of the model. Other than NUMA, LoRa settings, loading tokenizers, and...