add-staves (>=0.1.1, <=0.2.4), agentix-agent-sdk (0.1.0) +135 more potentially affected by CVE-2026-59935 via pypdf (4.3.1)

pypdf PYPI version 4.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - add-staves =0.1.1, =0.0.1, =0.0.1.dev1, =3.0.0, =0.1.0, =1.0.0, =0.3.8.0, =0.3.2, =0.1.6, =1725528079.0.0, =0.1.4, =0.1.9 and more Source cves:...

django-badgify-lab (0.1.5), django-oscar (>=1.0.0, <=1.0.2) potentially affected by CVE-2026-54058 via pillow (2.4.0)

pillow PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-badgify-lab 0.1.5 - django-oscar =1.0.0, =1.0.2 Source cves: CVE-2026-54058 Source advisory: OSV:PYSEC-2026-3493...

Exploit for CVE-2026-64600

cve-id Donate Support the maintenance of this project wit...

Fastjson1.2.83_EXP

Fastjson 1.2.83 @JSONType RCE Fastjson 1.2.83 RCE exploitatio...

GHSA-GX64-GJ6P-PC4C JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab

JupyterLab's image viewer allows for cross-site scripting XSS when a specially-crafted image file is opened through the image viewer and then opened in a new tab. This XSS issue can be used to cause remote code execution RCE on the JupyterLab server. Impact This vulnerability allows for arbitrary...

jaeger-lab-to-nwb (0.1.1), xircuits (1.3.0) potentially affected by CVE-2026-73415 via jupyterlab (3.3.2)

jupyterlab PYPI version 3.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - jaeger-lab-to-nwb 0.1.1 - xircuits 1.3.0 Source cves: CVE-2026-73415 Source advisory: OSV:GHSA-GX64-GJ6P-PC4C...

Cross-site Scripting (XSS)

Overview jupyterlab is a JupyterLab computational environment. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the image viewer. An attacker can execute arbitrary code on the server by tricking a user into opening a specially crafted image file in the image viewer...

GHSA-H5V5-8746-G7MM JupyterLab PluginManager lock-rule enforcement bypass

JupyterLab's plugin manager exposes administrator controls intended to prevent users from enabling or disabling selected plugins. Two server-side enforcement gaps let an authenticated user bypass those controls with direct requests to /lab/api/plugins. Impact Users could workaround the plugin...

Incorrect Authorization

Overview jupyterlab is a JupyterLab computational environment. Affected versions of this package are vulnerable to Incorrect Authorization in the enforcement of plugin manager lock rules via direct API requests to /lab/api/plugins. An attacker can circumvent administrative restrictions on enablin...

jaeger-lab-to-nwb (0.1.1), xircuits (1.3.0) potentially affected by CVE-2026-73626 via jupyterlab (3.3.2)

jupyterlab PYPI version 3.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - jaeger-lab-to-nwb 0.1.1 - xircuits 1.3.0 Source cves: CVE-2026-73626 Source advisory: OSV:GHSA-WHVH-WF3X-G77J...

EternalBlue-MS17-010-Vulnerability

EternalBlue MS17-010 Vulnerability Analysis This repository...

vulnerability_chain_exploitation_lab_new

No d...

PT-2026-67362

JupyterLab's plugin manager exposes administrator controls intended to prevent users from enabling or disabling selected plugins. Two server-side enforcement gaps let an authenticated user bypass those controls with direct requests to /lab/api/plugins. Impact Users could workaround the plugin...

Malicious code in lab-3-package-438d82fc (PyPI)

Source: kam193 1647151de9ec3b78d6f3b3c4dc4bfe1f7b27f9c1ffdb56d482daa533fd2b1ec3 Packages showing simple variants of revshell with targets to ngrok. Most probably experiments. Later versions moved to use Burp Collaborator to exfiltrate simple data. Pentest? An artifact from some red team curse? --...

Malicious code in artifact-lab-3-package-f9dafccc (PyPI)

Source: kam193 8c38a10b7ad9b95b75ed342f766c42e203bbccd220031288c7107dac87641451 Packages showing simple variants of revshell with targets to ngrok. Most probably experiments. Later versions moved to use Burp Collaborator to exfiltrate simple data. Pentest? An artifact from some red team curse? --...

Malicious code in artifact-lab-3-package (PyPI)

Source: kam193 0c18a16c7c21d93a8819aed298f6691835b1a31546ca573eb94ce4265d4fb291 Packages showing simple variants of revshell with targets to ngrok. Most probably experiments. Later versions moved to use Burp Collaborator to exfiltrate simple data. Pentest? An artifact from some red team curse? --...

Malicious code in artifact-lab-3-package-ccd28738 (PyPI)

Source: kam193 5da429dcc2bd3c0de786f149b4b510b2aebb23e894f5eaea3f80812b8241dd6a Packages showing simple variants of revshell with targets to ngrok. Most probably experiments. Later versions moved to use Burp Collaborator to exfiltrate simple data. Pentest? An artifact from some red team curse? --...

Malicious code in artifact-lab-3-package-e90915e1 (PyPI)

--- Credit: OpenSSF source...

Malicious code in artifact-lab-3-package-7e532784 (PyPI)

Source: kam193 d93531e3b6c6c54a9029303ec3f20394fe8268775978e1b13754c318486c88cc Packages showing simple variants of revshell with targets to ngrok. Most probably experiments. Later versions moved to use Burp Collaborator to exfiltrate simple data. Pentest? An artifact from some red team curse? --...

Malicious code in artifact-lab-3-package-76a351f5 (PyPI)

Source: kam193 ffd940df08afab8ca93f472de627c4cc633b5de2d3331b58a84602a882390ac1 Packages showing simple variants of revshell with targets to ngrok. Most probably experiments. Later versions moved to use Burp Collaborator to exfiltrate simple data. Pentest? An artifact from some red team curse? --...