w3af

w3af - Web Application Attack and Audit Framework w3af is an open source web application security scanner which helps developers and penetration testers identify and exploit vulnerabilities in their web applications. The scanner is able to identify 200+ vulnerabilities, including Cross-Site...

hexora

hexora Hexora is a static analysis tool designed to detect malicious and harmful patterns in Python code. It combines a rule-based static analysis engine with a machine-learned model that scores entire source files to classify them as malicious or benign. It can be used to: Audit project...

CVE-2025-3248

CVE-2025-3248: Langflow Unauthenticated Remote Code Execution RCE This repository contains two Python scripts: LangflowCheck.py: A scanner that checks for Langflow AI instances vulnerable to CVE-2025-3248. exploit.py: A working reverse shell exploit for vulnerable Langflow targets. Summary...

CVE-2025-0868

Penetration Testing Project Report: Exploiting CVE-2025-0868 DocsGPT RCE via JSON Eval 1. Introduction A critical Remote Code Execution RCE flaw CVE-2025-0868 was disclosed on February 20, 2025, in the open-source DocsGPT library, caused by unsafe use of eval when parsing JSON payloads. Key...

CVE-2025-3248

CVE-2025-3248 Exploit Tool Documentation Introduction This tool is used to exploit the CVE-2025-3248 vulnerability a Python-based code injection vulnerability to achieve remote command execution RCE on the target server by crafting malicious payloads. The vulnerability exists in a web application...

CVE-2025-3248

CVE-2025-3248 – Exécuter du code Python arbitraire sur un serveur Langflow vulnérable. Découvert par : Naveen Sunkavally, Horizon3.ai Statut : Divulgation publique Date signalée : 2025-04-07 ID CVE : CVE-2025-3248 🧾 Capture d'écran 🧩 Résumé Une faille critique a été découverte dans Langflow qui...

Linux Distros Unpatched Vulnerability : CVE-2026-104851

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0,...

CVE-2026-33017-PoC-Reverse-Shell

CVE-2026-33017 — Эксплойт неаутентифицированного RCE в Langflow 📋 Обзор CVE-2026-33017 — это уязвимость неаутентифицированного удалённого выполнения кода RCE в Langflow версиях Данный эксплойт предназначен только для образовательных целей и авторизованного тестирования. Несанкционированный доступ...

CVE-2026-33017

CVE-2026-33017 Langflow RCE ★ CVE-2026-33017 Langflow Remote Code Execution PoC ★ https://github.com/user-attachments/assets/562fc637-6be1-4ab9-a396-bfad56447af7 Настройка окружения Используйте следующие команды для сборки и запуска уязвимого окружения Langflow: docker build -t...

CentOS Linux 7 [TuxCare] Security Update: python-jinja2 (CENTOS7:CLSA-2025:1765310613)

The CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2025:1765310613 advisory. - Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allow...

CVE-2026-51857

In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, CodeExecutionToolkit can run model-produced Python code through SubprocessInterpreter without an approval boundary...

EUVD-2026-90423

In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, CodeExecutionToolkit can run model-produced Python code through SubprocessInterpreter without an approval boundary...

CVE-2026-51857

In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, CodeExecutionToolkit can run model-produced Python code through SubprocessInterpreter without an approval boundary...

CVE-2026-51857

The camel-ai camel library (versions v0.2.91a1 , v0.2.91a2 , and v0.2.91a3 ) contains a vulnerability where the CodeExecutionToolkit can execute Python code produced by a model via the SubprocessInterpreter without an approval boundary . This lack of control over generated code execution (CWE-94)...

CVE-2026-51856

In agentscope 1.0.18, 1.0.19, and 1.0.19 when the RealtimeAgent session exposes executepythoncode as an available tool, a remote WebSocket user can prompt the agent to call that tool and run Python code in the service environment. In the validated path, RealtimeAgent.acting forwards the...

CVE-2026-33017-Langflow-RCE

CVE-2026-33017 - Уязвимость удалённого выполнения кода RCE в Langflow xpl0ited by infrar3d Этот proof-of-concept эксплойт нацелен на критическую уязвимость удалённого выполнения кода RCE в версиях Langflow до 1.9.0. Уязвимость позволяет неаутентифицированным злоумышленникам выполнять произвольные...

Wazuh - Unsafe Deserialization Remote Code Execution

A critical Remote Code Execution RCE vulnerability exists in Wazuh server versions = 4.4.0 and = 4.4.0 and 4.9.1. The vulnerability occurs due to unsafe deserialization in the wazuh-manager package, specifically in the DistributedAPI where parameters are serialized as JSON and deserialized using...

EUVD-2026-87829

heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback resolver that allows authenticated users to execute arbitrary Python code. Attackers can craft workflow expressions using dunder attribute access through item expressions or the...

CVE-2026-100864

The heym library (versions prior to 0.0.91 ) contains a sandbox escape vulnerability within the expression engine 's DotList map/filter and fallback resolver. This flaw allows authenticated users to execute arbitrary Python code by crafting workflow expressions that use dunder attribute access . ...

EUVD-2026-86479

IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL. The generatecertificate runs a Python script saved as a certificate file. The pyhton script attempts to retrieve code from a hardcoded http URL that is obfuscated with base6...