tplmap

Tplmap This project is no longer maintained. I'm happy to merge new PRs as long they don't break the test suite. Tplmap assists the exploitation of Code Injection and Server-Side Template Injection vulnerabilities with a number of sandbox escape techniques to get access to the underlying operatin...

binja_arch_ref

binjaarchref A simple Binary Ninja plugin to display a cheat sheet with information about the current architecture Origins This project is a product of NCC Group's 2017 summer internship program. Further updates will be tracked athttps://github.com/ehennenfent/binjaarchref. NCC Group is not...

Linux Distros Unpatched Vulnerability : CVE-2026-102991

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.gettemplate in mako/lookup.py resolves template URIs with posixpath,...

CVE-2026-102991

Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.gettemplate in mako/lookup.py resolves template URIs with posixpath, while Template.init in mako/template.py validates them with os.path, which uses ntpath. A URI beginning with a drive designator causes ntpa...

Rocky Linux 8 [CIQ] Security Update: python3-mako (crlsa-2023_2893)

The Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20232893 advisory. mako: REDoS in Lexer class CVE-2022-40023 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that Nessus has not...

Rocky Linux 9 [CIQ] Security Update: python3-mako (crlsa-2023_2258)

The Rocky Linux 9 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20232258 advisory. python-mako: REDoS in Lexer class CVE-2022-40023 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that Nessus has...

CVE-2026-102991

Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.gettemplate in mako/lookup.py resolves template URIs with posixpath, while Template.init in mako/template.py validates them with os.path, which uses ntpath. A URI beginning with a drive designator causes ntpa...

CVE-2026-102991 Mako: Path traversal via drive-letter URI on Windows in TemplateLookup

Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.gettemplate in mako/lookup.py resolves template URIs with posixpath, while Template.init in mako/template.py validates them with os.path, which uses ntpath. A URI beginning with a drive designator causes ntpa...

CVE-2026-102991 Mako: Path traversal via drive-letter URI on Windows in TemplateLookup

Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.gettemplate in mako/lookup.py resolves template URIs with posixpath, while Template.init in mako/template.py validates them with os.path, which uses ntpath. A URI beginning with a drive designator causes ntpa...

CVE-2026-102991 Mako: Path traversal via drive-letter URI on Windows in TemplateLookup

Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.gettemplate in mako/lookup.py resolves template URIs with posixpath, while Template.init in mako/template.py validates them with os.path, which uses ntpath. A URI beginning with a drive designator causes ntpa...

CVE-2026-102991

The Mako Python template library is vulnerable to a path traversal flaw on Windows in versions prior to 1.4.2 . The issue stems from a discrepancy where TemplateLookup.get_template() uses posixpath to resolve URIs, while Template.__init__() uses os.path (which utilizes ntpath) for validation. Att...

CVE-2026-102991

Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.gettemplate in mako/lookup.py resolves template URIs with posixpath, while Template.init in mako/template.py validates them with os.path, which uses ntpath. A URI beginning with a drive designator causes ntpa...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-mako (UTSA-2023-002842)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002842 advisory. Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugi...

Astra Linux – Vulnerability in Mako

Sqlalchemy mako before version 1.2.2 is vulnerable to Regular Expression Denial of Service when using the Lexer class for parsing. This vulnerability also affects babelplugin and linguaplugin...

Astra Linux – Vulnerability in Mako

Mako is a template library written in Python. Prior to version 1.3.11, the TemplateLookup.gettemplate function was vulnerable to path traversal attacks when the URI started with // e.g., //../../../secret.txt. The root cause of this issue was an inconsistency in the two implementations of slash...

ROOT-APP-PYPI-CVE-2026-44307 CVE-2026-44307 in mako - Patched by Root

Root has patched CVE-2026-44307 in the mako package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-41205 CVE-2026-41205 in mako - Patched by Root

Root has patched CVE-2026-41205 in the mako package for Root:PyPI. Multiple fixed versions available...

OPENSUSE-SU-2026:11567-1 python313-Mako-1.4.1-1.1 on GA media

These are all security issues fixed in the python313-Mako-1.4.1-1.1 package on the GA media of openSUSE Tumbleweed...

Important Photon OS Security Update - PHSA-2026-5.0-92-0960

Updates of 'python3-mako', 'go' packages of Photon OS have been released...

Security Bulletin:Mako Template Lookup Path Traversal Vulnerability Fixed in 1.3.11

Summary Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.gettemplate is vulnerable to path traversal when a URI starts with // e.g., //../../../secret.txt. The root cause is an inconsistency between two slash-stripping implementations. Any file readable by the process...