EUVD-2026-83177

A vulnerability was identified in Forget-C Jellyfish AI Short Drama Studio 0.1.0-alpha/0.2.0/0.3.0/0.3.1/0.3.2. This affects an unknown function of the file backend/app/dependencies.py of the component FastAPI. The manipulation leads to missing authentication. It is possible to initiate the attac...

CVE-2026-93559 Forget-C Jellyfish AI Short Drama Studio FastAPI dependencies.py missing authentication

A vulnerability was identified in Forget-C Jellyfish AI Short Drama Studio 0.1.0-alpha/0.2.0/0.3.0/0.3.1/0.3.2. This affects an unknown function of the file backend/app/dependencies.py of the component FastAPI. The manipulation leads to missing authentication. It is possible to initiate the attac...

CVE-2026-93559 Forget-C Jellyfish AI Short Drama Studio FastAPI dependencies.py missing authentication

A vulnerability was identified in Forget-C Jellyfish AI Short Drama Studio 0.1.0-alpha/0.2.0/0.3.0/0.3.1/0.3.2. This affects an unknown function of the file backend/app/dependencies.py of the component FastAPI. The manipulation leads to missing authentication. It is possible to initiate the attac...

FencePost

FencePost 多主机 UFW 防火墙仪表板。通过 SSH 连接 Linux 主机，解析防火墙规则和监听端口，以通俗易懂的语言进行解释，并标记安全缺口。 功能特性 多主机概览 —— 一目了然查看所有主机的 UFW 状态、默认策略和活跃服务 通俗易懂的解释 —— 每条防火墙规则都被翻译成可读的描述，包含 VLAN 和服务名称 安全缺口检测 —— 发现没有匹配 UFW 允许规则的监听端口，按外部暴露和本地暴露分类 连接诊断 —— 追踪源 IP + 目标端口经过规则链的过程，查看流量会被允许、阻止还是拒绝 变更检测 —— 将当前状态与上次快照进行比较，并将事件（规则添加/删除、UFW...

SubMon

SubMon 有人说漏洞赏金不只是发现漏洞，而是成为“第一个”发现它们的人。我正在构建这个工具，目的是在发现新子域时通知赏金猎人。 功能 你可以添加你关注的目标：名称 + 域名。 然后你可以点击 扫描 或 安排扫描。 扫描完成后，你会收到一个 Discord 提醒。 如果你设置了调度器，每次发现新子域时都会收到 Discord 通知。 这里你可以看到上次扫描的结果：哪些子域是新增的，哪些已消失。 你还可以看到该子域的标题，但可能不太准确。 技术栈 后端：FastAPI ORM：SQLModel 数据验证：Pydantic 数据库：SQLite 前端：React Vite Vibe 编码...

CVE-2025-62727-Demo

Demo CVE-2025-62727 Descripción de la víctima La víctima objetivo de CVE-2025-62727 es una aplicación FastAPI sencilla que: Sirve Hello World en /. Sirve archivos estáticos bajo /static usando StaticFiles de Starlette. Genera automáticamente archivos de texto que contienen A repetida N veces para...

k4_cve-2023-41064

k4cve-2023-41064 运行项目的步骤 设置前端： 导航到前端文件夹： root@kitploit: Copier Modifier cd frontend 通过运行以下命令安装所需的Node.js依赖项： root@kitploit: Copier Modifier npm install 设置后端： 导航到后端文件夹： root@kitploit: Copier Modifier cd backend 通过运行以下命令安装所需的Python依赖项： root@kitploit: Copier Modifier pip install -r requirements.txt...

PYSEC-2026-3937 vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages

Summary When the vLLM API receives a malformed request e.g., invalid JSON or missing required fields, FastAPI raises a Pydantic RequestValidationError. The validationexceptionhandler in vllm/entrypoints/openai/serverutils.py converts this exception to a string via strexc, which includes the...

PYSEC-2026-3885 PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and delete

Summary PraisonAI's async Jobs API the FastAPI service in praisonai/jobs/ installs its router with no authentication middleware, no router-level dependency, and no per-route auth check. Any caller who can reach the jobs server can submit agent jobs executed against the operator's configured LLM...

PYSEC-2026-3893 PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced

Summary praisonai serve agents and praisonai serve unified both accept --api-key for authentication. The flag is parsed but never wired into the FastAPI app — no middleware, no header check, nothing. The server runs wide open regardless of what key you set. Tested on 4.6.50 from PyPI. Affected...

PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced

Summarypraisonai serve agents and praisonai serve unified both accept --api-key for authentication. The flag is parsed but never wired into the FastAPI app — no middleware, no header check, nothing. The server runs wide open regardless of what key you set. Tested on 4.6.50 from PyPI. Affected...

PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution

Summary PraisonAI's praisonai serve agents command exposes --api-key as the documented authentication control for production/external deployments, but the configured key is not enforced on the public agent invocation compatibility endpoints. An operator can start the server with --api-key and bin...

PYSEC-2026-3887 PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution

Summary PraisonAI's praisonai serve agents command exposes --api-key as the documented authentication control for production/external deployments, but the configured key is not enforced on the public agent invocation compatibility endpoints. An operator can start the server with --api-key and bin...

PT-2026-88203

These are all security issues fixed in the python313-fastapi-0.138.0-2.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11710-1 python313-fastapi-0.138.0-2.1 on GA media

These are all security issues fixed in the python313-fastapi-0.138.0-2.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-85684

marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler that fails to sanitize the file.filename parameter. Unauthenticated attackers can supply filenames containing directory traversal sequences to write arbitrary files to any location or delete existin...

CVE-2026-85684 marker through 2.0.0 Path Traversal via upload filename

marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler that fails to sanitize the file.filename parameter. Unauthenticated attackers can supply filenames containing directory traversal sequences to write arbitrary files to any location or delete existin...

CVE-2026-85684 marker through 2.0.0 Path Traversal via upload filename

marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler that fails to sanitize the file.filename parameter. Unauthenticated attackers can supply filenames containing directory traversal sequences to write arbitrary files to any location or delete existin...

CVE-2026-85684

marker through version 2.0.0 contains a path traversal vulnerability in its FastAPI /marker/upload handler. The root cause is a failure to sanitize the file.filename parameter, allowing unauthenticated attackers to supply filenames containing directory traversal sequences. This permits writing ar...

CVE-2026-85684 marker through 2.0.0 Path Traversal via upload filename

marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler that fails to sanitize the file.filename parameter. Unauthenticated attackers can supply filenames containing directory traversal sequences to write arbitrary files to any location or delete existin...