CVE-2025-0868

渗透测试项目报告：利用CVE-2025-0868 DocsGPT JSON Eval远程代码执行 1. 引言 一个严重的远程代码执行RCE漏洞CVE-2025-0868于2025年2月20日被披露，存在于开源DocsGPT库中，由在解析JSON有效载荷时不安全地使用eval函数引起。 关键细节： 影响DocsGPT 0.8.1至0.12.0版本 CVSS 4.0评分为9.3（严重） 允许未经身份验证、可通过网络访问的代码注入 对机密性、完整性和可用性造成全面影响 关于CVE-2025-0868...

CVE-2025-3248

CVE-2025-3248 脆弱性悪用ツール ドキュメント 概要 本ツールは CVE-2025-3248 脆弱性（Pythonベースのコードインジェクション脆弱性）を利用し、悪意のあるペイロードを構築してターゲットサーバーでリモートコマンド実行（RCE）を実現するものです。本脆弱性はあるWebアプリケーションのAPIエンドポイントに存在し、攻撃者は未検証のコード実行ポイントを通じて任意のPythonコードを注入できます。 重要なお知らせ：...

CVE-2026-33017-Langflow-RCE

CVE-2026-33017 - Langflow RCE 漏洞 xpl0ited by infrar3d 本概念验证利用针对 Langflow 1.9.0 之前版本中的一个严重远程代码执行（RCE）漏洞。该漏洞允许未经身份验证的攻击者通过向流程构建 API 端点注入恶意 Python 代码来执行任意系统命令。漏洞存在于 /api/v1/buildpublictmp/flowid/flow 端点中，该端点未能正确清理组件模板中 code 字段的用户提供代码。 使用方法： root@kitploit: python3 CVE-2026-33017.py --help usage:...

CVE-2026-34398

A flaw was found in FreeCAD, a 3D parametric modeler. The BIM Project Manager's Load Template function does not properly validate certain properties within a project template. This vulnerability allows a remote attacker to embed malicious Python code into a specially crafted BIM project template...

CVE-2026-73485

Flowise before version 3.1.3 contains a code injection vulnerability in the Airtable Agent node that lets unauthenticated attackers bypass the pythonCodeValidator blocklist via obfuscation and inject malicious Python code. The injected code can run in an unsandboxed pyodide environment with full ...

DEBIAN-CVE-2026-73233

FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the FEM Displacement Constraint task dialog in src/Mod/Fem/Gui/TaskFemConstraintDisplacement.cpp passes the xDisplacementFormula, yDisplacementFormula, and zDisplacementFormula fields of a...

CVE-2026-73233

FreeCAD CVE-2026-73233 affects the FEM Displacement Constraint dialog prior to version 1.1.2. The escaping helper fails to neutralize backslashes, letting crafted x/y/zDisplacementFormula text terminate the generated Python string and execute arbitrary Python code with the FreeCAD process privile...

PT-2026-70894

FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the FEM Displacement Constraint task dialog in src/Mod/Fem/Gui/TaskFemConstraintDisplacement.cpp passes the xDisplacementFormula, yDisplacementFormula, and zDisplacementFormula fields of a...

CVE-2026-54621

datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, GraphQL Union description values in src/datamodelcodegenerator/model/template/UnionTypeStatement.jinja2 and src/datamodelcodegenerator/model/template/UnionTypeStatement.py312.jinja2 are rendered into...

CVE-2026-27510

Unitree Go2 firmware versions 1.1.7 through 1.1.11, when used with the Unitree Go2 Android application com.unitree.doggo2, are vulnerable to remote code execution due to missing integrity protection and validation of user-created programmes. The Android application stores programs in a local SQLi...

CVE-2026-27510 Unitree Go2 Mobile Program Tampering Enables Root RCE

Unitree Go2 firmware versions 1.1.7 through 1.1.11, when used with the Unitree Go2 Android application com.unitree.doggo2, are vulnerable to remote code execution due to missing integrity protection and validation of user-created programmes. The Android application stores programs in a local SQLi...

CVE-2025-14927 Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability

Hugging Face Transformers SEW-D convertconfig Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the...

CVE-2025-33184

NVIDIA Isaac-GR00T for all platforms contains a vulnerability in a Python component, where an attacker could cause a code injection issue. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering...

EUVD-2018-17775

Malware in sbrugna...

EUVD-2020-7345

Malware in sbrugna...

EUVD-2018-8022

Malware in sbrugna...

EUVD-2025-24605

Malicious code in bioql PyPI...

EUVD-2025-12263

Malicious code in bioql PyPI...

CVE-2025-23296

NVIDIA Isaac-GR00T for all platforms contains a vulnerability in a Python component where an attacker could cause a code injection issue. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering...

CVE-2025-23295

NVIDIA Apex for all platforms contains a vulnerability in a Python component where an attacker could cause a code injection issue by providing a malicious file. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data...