django-badgify-lab (0.1.5), django-oscar (>=1.0.0, <=1.0.2) potentially affected by CVE-2026-54058 via pillow (2.4.0)

pillow PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-badgify-lab 0.1.5 - django-oscar =1.0.0, =1.0.2 Source cves: CVE-2026-54058 Source advisory: OSV:PYSEC-2026-3493...

Exploit for CVE-2026-64600

cve-id Donate Support the maintenance of this project wit...

Fastjson1.2.83_EXP

Fastjson 1.2.83 @JSONType RCE Fastjson 1.2.83 RCE exploitatio...

GHSA-GX64-GJ6P-PC4C JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab

JupyterLab's image viewer allows for cross-site scripting XSS when a specially-crafted image file is opened through the image viewer and then opened in a new tab. This XSS issue can be used to cause remote code execution RCE on the JupyterLab server. Impact This vulnerability allows for arbitrary...

jaeger-lab-to-nwb (0.1.1), xircuits (1.3.0) potentially affected by CVE-2026-73415 via jupyterlab (3.3.2)

jupyterlab PYPI version 3.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - jaeger-lab-to-nwb 0.1.1 - xircuits 1.3.0 Source cves: CVE-2026-73415 Source advisory: OSV:GHSA-GX64-GJ6P-PC4C...

Cross-site Scripting (XSS)

Overview jupyterlab is a JupyterLab computational environment. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the image viewer. An attacker can execute arbitrary code on the server by tricking a user into opening a specially crafted image file in the image viewer...

Incorrect Authorization

Overview jupyterlab is a JupyterLab computational environment. Affected versions of this package are vulnerable to Incorrect Authorization in the enforcement of plugin manager lock rules via direct API requests to /lab/api/plugins. An attacker can circumvent administrative restrictions on enablin...

GHSA-H5V5-8746-G7MM JupyterLab PluginManager lock-rule enforcement bypass

JupyterLab's plugin manager exposes administrator controls intended to prevent users from enabling or disabling selected plugins. Two server-side enforcement gaps let an authenticated user bypass those controls with direct requests to /lab/api/plugins. Impact Users could workaround the plugin...

jaeger-lab-to-nwb (0.1.1), xircuits (1.3.0) potentially affected by CVE-2026-73626 via jupyterlab (3.3.2)

jupyterlab PYPI version 3.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - jaeger-lab-to-nwb 0.1.1 - xircuits 1.3.0 Source cves: CVE-2026-73626 Source advisory: OSV:GHSA-WHVH-WF3X-G77J...

EternalBlue-MS17-010-Vulnerability

EternalBlue MS17-010 Vulnerability Analysis This repository...

vulnerability_chain_exploitation_lab_new

No d...

PT-2026-67362

JupyterLab's plugin manager exposes administrator controls intended to prevent users from enabling or disabling selected plugins. Two server-side enforcement gaps let an authenticated user bypass those controls with direct requests to /lab/api/plugins. Impact Users could workaround the plugin...

Malicious code in lab-3-package-438d82fc (PyPI)

Source: kam193 1647151de9ec3b78d6f3b3c4dc4bfe1f7b27f9c1ffdb56d482daa533fd2b1ec3 Packages showing simple variants of revshell with targets to ngrok. Most probably experiments. Later versions moved to use Burp Collaborator to exfiltrate simple data. Pentest? An artifact from some red team curse? --...

Malicious code in artifact-lab-3-package-f9dafccc (PyPI)

Source: kam193 8c38a10b7ad9b95b75ed342f766c42e203bbccd220031288c7107dac87641451 Packages showing simple variants of revshell with targets to ngrok. Most probably experiments. Later versions moved to use Burp Collaborator to exfiltrate simple data. Pentest? An artifact from some red team curse? --...

Malicious code in artifact-lab-3-package (PyPI)

Source: kam193 0c18a16c7c21d93a8819aed298f6691835b1a31546ca573eb94ce4265d4fb291 Packages showing simple variants of revshell with targets to ngrok. Most probably experiments. Later versions moved to use Burp Collaborator to exfiltrate simple data. Pentest? An artifact from some red team curse? --...

Malicious code in artifact-lab-3-package-e90915e1 (PyPI)

--- Credit: OpenSSF source...

Malicious code in artifact-lab-3-package-7e532784 (PyPI)

Source: kam193 d93531e3b6c6c54a9029303ec3f20394fe8268775978e1b13754c318486c88cc Packages showing simple variants of revshell with targets to ngrok. Most probably experiments. Later versions moved to use Burp Collaborator to exfiltrate simple data. Pentest? An artifact from some red team curse? --...

Malicious code in artifact-lab-3-package-76a351f5 (PyPI)

Source: kam193 ffd940df08afab8ca93f472de627c4cc633b5de2d3331b58a84602a882390ac1 Packages showing simple variants of revshell with targets to ngrok. Most probably experiments. Later versions moved to use Burp Collaborator to exfiltrate simple data. Pentest? An artifact from some red team curse? --...

Malicious code in artifact-lab-3-package-9fde789f (PyPI)

Source: kam193 f494a5211d4ea10a131bb54919b6d5e1bf765cea0c3cc018c054e7e304f5856f Packages showing simple variants of revshell with targets to ngrok. Most probably experiments. Later versions moved to use Burp Collaborator to exfiltrate simple data. Pentest? An artifact from some red team curse? --...

Malicious code in artifact-lab-3-package-89883da3 (PyPI)

Source: kam193 dc3109f451995d11f0f2e99d58397d06ac2bb036df5ceb90425befb54ea10f14 Packages showing simple variants of revshell with targets to ngrok. Most probably experiments. Later versions moved to use Burp Collaborator to exfiltrate simple data. Pentest? An artifact from some red team curse? --...