CVE-2026-79824

A flaw was found in Python. An attacker can exploit this directory traversal vulnerability by providing a specially crafted TAR archive containing relative path sequences, such as dot-dot notation. When the archive is extracted, files can be written outside the intended extraction directory,...

Malicious code in proxyrubika (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 dd55df978007c1a7548ff7e6a548553cf89bd536afffbc8b0921eb3efe31a342 The package contains code for automated files exfiltration. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

MAL-2026-17885 Malicious code in proxyrubika (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 dd55df978007c1a7548ff7e6a548553cf89bd536afffbc8b0921eb3efe31a342 The package contains code for automated files exfiltration. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

CVE-2025-47256

CVE-2025-47256 Stack overflow in LibXMP Description A stack-based buffer overflow vulnerability exists in the depackpha function of libxmp, a library for module music playback. The vulnerability is triggered when parsing malformed Pha Packer PHA module files. Improper bounds checking on a local...

PYSEC-2026-4261 PraisonAI: Project custom command templates can read outside-workspace files into model prompts

Project custom command templates can read outside-workspace files into model prompts Summary PraisonAI's new file-based custom command feature auto-discovers project commands from .praisonai/commands/.md. When a user runs praisonai run --command inside a repository, the command body is interpolat...

CVE-2026-50619

A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attackers to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsirch 7.0.3.0 and later...

CVE-2026-79824

A directory traversal vulnerability in HPE NonStop Python 3.x could allow attackers to overwrite arbitrary files via a .. dot dot sequence in filenames in a TAR archive...

CVE-2021-36934

CVE-2021-36934 CVE-2021-36934 HiveNightmare vulnerability checker and workaround Flow The script has the following flow: Requires it to run with Administrator privileges Check Windows 10 version is affected by the vulnerability. IF affected by vulnerability: Show Windows version may be affected b...

juicy-php

juicy-php Juicy-php - finds PHP info files with juicy information...

CVE-2026-26243 Arbitrary Folder Deletion in Qsync Central 5.0.0.5

A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central...

EUVD-2026-101971

A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central...

CVE-2026-79824 HPE NonStop Python 3.x - Directory traversal vulnerability

A directory traversal vulnerability in HPE NonStop Python 3.x could allow attackers to overwrite arbitrary files via a .. dot dot sequence in filenames in a TAR archive...

CVE-2026-79824

A directory traversal vulnerability exists in HPE NonStop Python 3.x (specifically version T0993 - T0993L01^AAL and earlier ) caused by a .. (dot dot) sequence in filenames within a TAR archive. This flaw could allow an attacker to overwrite arbitrary files. HPE has released fixes, including vers...

EUVD-2026-101969

A directory traversal vulnerability in HPE NonStop Python 3.x could allow attackers to overwrite arbitrary files via a .. dot dot sequence in filenames in a TAR archive...

MAL-2026-17883 Malicious code in py-worm (PyPI)

Importing py-worm's agentaix module downloads a mutable Python file from https://raw.githubusercontent.com/anonrider404/pypl/refs/heads/main/readme.txt to a temporary .py file and launches it without a visible console on Windows. Versions 0.1.0 and 2.0.0 do this directly during import; version...

CVE-2025-24071-PoC

CVE-2025-24071 - Windows File Explorer Spoofing Vulnerability Proof of Concept Overview CVE-2025-24071 is a spoofing vulnerability in Windows File Explorer that allows an unauthenticated attacker to expose sensitive information over a network. The vulnerability arises due to the implicit trust an...

Malicious code in py-sock2 (PyPI)

Importing py-sock2's agentaix module downloads a mutable Python file from https://raw.githubusercontent.com/anonrider404/pypl/refs/heads/main/readme.txt to a temporary .py file and launches it without a visible console on Windows. Its agentaix console entry point imports the module. The remote...

CVE-2024-24816

CVE-2024-24816 CKEditor 4 XSS This issue was caused by a lack of sanitization of the data passed to "preview" feature. This problem has been fixed in CKEditor 4 at version 4.24.0-lts. Affected versions 4.24.0-lts Advisory Update CKEditor 4 to version 4.24.0-lts or newer. References...

CVE-2020-10977

Python Exploit for gitlab private instance arbitrary file read At the date of 03/23/2020, a vulnerability report with its PoC was released in hackerone by William Bowling With this vulnerability we can read any world readable files with permission 444 or more on the gitlab server like /etc/passwd...

CVE-2026-41544

A path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: QcalAgent 1.1.10 and...