CVE-2025-3248

CVE-2025-3248 – Ejecutar código Python arbitrario en un servidor Langflow vulnerable. Descubierto por: Naveen Sunkavally, Horizon3.ai Estado: Divulgación pública Fecha de reporte: 2025-04-07 ID de CVE: CVE-2025-3248 🧾 Captura de pantalla 🧩 Resumen Se ha descubierto una falla crítica en Langflow q...

hexora

hexora Hexora es una herramienta de análisis estático diseñada para detectar patrones maliciosos y dañinos en código Python. Combina un motor de análisis estático basado en reglas con un modelo de aprendizaje automático que puntúa archivos fuente completos para clasificarlos como maliciosos o...

w3af

w3af - Web Application Attack and Audit Framework w3af is an open source web application security scanner which helps developers and penetration testers identify and exploit vulnerabilities in their web applications. The scanner is able to identify 200+ vulnerabilities, including Cross-Site...

CVE-2026-33017

CVE-2026-33017 Langflow RCE ★ CVE-2026-33017 Langflow Remote Code Execution PoC ★ https://github.com/user-attachments/assets/562fc637-6be1-4ab9-a396-bfad56447af7 Environment Setup Use the following commands to build and run the vulnerable Langflow environment: docker build -t...

CVE-2025-0868

Informe de Proyecto de Pruebas de Penetración: Explotación de CVE-2025-0868 DocsGPT RCE mediante Eval JSON 1. Introducción El 20 de febrero de 2025 se reveló una vulnerabilidad crítica de ejecución remota de código RCE CVE-2025-0868 en la biblioteca de código abierto DocsGPT, causada por el uso...

CVE-2025-3248

CVE-2025-3248: Langflow Ejecución Remota de Código RCE Sin Autenticación Este repositorio contiene dos scripts de Python: LangflowCheck.py: Un escáner que verifica instancias de Langflow AI vulnerables a CVE-2025-3248. exploit.py: Un exploit funcional de reverse shell para objetivos Langflow...

CVE-2026-107204

LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by posting scripts to the /runscript endpoint. Attackers can recover real builtins through the injected FastAPI app object, bypassing the guarded import, to...

CVE-2026-107204 LMCache through 0.5.5 Unauthenticated RCE via /run_script Endpoint

LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by posting scripts to the /runscript endpoint. Attackers can recover real builtins through the injected FastAPI app object, bypassing the guarded import, to...

CVE-2026-107204 LMCache through 0.5.5 Unauthenticated RCE via /run_script Endpoint

LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by posting scripts to the /runscript endpoint. Attackers can recover real builtins through the injected FastAPI app object, bypassing the guarded import, to...

CVE-2026-107204 LMCache through 0.5.5 Unauthenticated RCE via /run_script Endpoint

LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by posting scripts to the /runscript endpoint. Attackers can recover real builtins through the injected FastAPI app object, bypassing the guarded import, to...

CVE-2026-107204

LMCache versions through 0.5.5 are vulnerable to an unauthenticated remote code execution (RCE) vulnerability via the /run_script endpoint. The root cause is that attackers can post scripts to this endpoint and recover real builtins through the injected FastAPI app object , which allows them to b...

PT-2026-107562

LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by posting scripts to the /run script endpoint. Attackers can recover real builtins through the injected FastAPI app object, bypassing the guarded import , to...

CVE-2026-105812 Code injection via unencoded configuration values during Python code generation in Bedrock AgentCore Starter Toolkit agent import

Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, via crafted configuration values...

CVE-2026-105812 Code injection via unencoded configuration values during Python code generation in Bedrock AgentCore Starter Toolkit agent import

Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, via crafted configuration values...

CVE-2026-33017-Langflow-RCE

CVE-2026-33017 - Vulnerabilidad RCE en Langflow Explotado por infrar3d Este exploit de prueba de concepto apunta a una vulnerabilidad crítica de Ejecución Remota de Código RCE en versiones de Langflow anteriores a la 1.9.0. La vulnerabilidad permite a atacantes no autenticados ejecutar comandos...

WebSocketTurboIntruder

WebSocket Turbo Intruder An extension for fuzzing WebSocket messages using custom Python code. Usage Intruder tool 1. Right-click on a WebSocket message and navigate to Extensions WebSocket Turbo Intruder Send to WebSocket Turbo Intruder. If you highlight a portion of the message before sending,...

CentOS Linux 7 [TuxCare] Security Update: python-jinja2 (CENTOS7:CLSA-2026:1790708389)

The CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1790708389 advisory. - Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filter...

CVE-2025-3248

CVE-2025-3248 Documentación de la herramienta de explotación Introducción Esta herramienta se utiliza para explotar la vulnerabilidad CVE-2025-3248 una vulnerabilidad de inyección de código basada en Python mediante la construcción de un payload malicioso para lograr la ejecución remota de comand...

Linux Distros Unpatched Vulnerability : CVE-2026-104851

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0,...

CVE-2026-33017-PoC-Reverse-Shell

CVE-2026-33017 - Langflow Unauthenticated RCE Exploit 📋 Overview CVE-2026-33017 is an unauthenticated Remote Code Execution RCE vulnerability in Langflow versions This exploit is for educational and authorized testing purposes only. Unauthorized access to computer systems is illegal. Use this too...