73991 matches found
SUSE CVE-2026-115557
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration...
SUSE CVE-2026-115910
Python Social Auth is a social authentication and registration mechanism. Prior to 6.2.0, OpenIdConnectAuth in socialcore/backends/openidconnect.py uses getandstorenonce to place the OpenID Connect nonce in a shared OpenIdConnectAssociation table, and getnonce and validateclaims verify only that...
mantis_rce
mantisrce Python script to obtain RCE on Mantis Bug Tracker prior to version 1.2.x Check CVE-2008-4687 for additional information...
DEBIAN-CVE-2026-116672
Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the documented ClientConfigurationEndpoint.authenticateclient and ClientConfigurationEndpoint.checkpermission reference implementations look up a target client from request-controlled clientid data a...
manticore
⚠️ Project is archived ⚠️ This project is no longer internally developed and maintained. Manticore Manticore is a symbolic execution tool for the analysis of smart contracts and binaries. Features Program Exploration : Manticore can execute a program with symbolic inputs and explore all the...
CVE-2026-116672 Authlib RFC 7592 examples omit registration-access-token client binding
Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the documented ClientConfigurationEndpoint.authenticateclient and ClientConfigurationEndpoint.checkpermission reference implementations look up a target client from request-controlled clientid data a...
CVE-2026-116672
The Authlib Python library (versions 0.15 through 1.9.1 ) is vulnerable because the reference implementations for ClientConfigurationEndpoint.authenticate_client and ClientConfigurationEndpoint.check_permission fail to verify that the request.credential belongs to the target client. Instead, they...
Debinject
Debinject Inject malicious code into .debs MAINTAINERS Alisson Moretto | Twitter: @UndeadSec Github: @UndeadSec VIDEO DEMO CLONE git clone https://github.com/UndeadSec/Debinject.git RUNNING cd Debinject python debinject.py PREREQUISITES python 2.x dpkg dpkg-deb metasploit DISCLAIMER TO BE USED FO...
EUVD-2026-108519
Authlib: ID token can disable its own nonce validation via the noncesupported claim...
EUVD-2026-108520
Authlib: Default JWT bearer grant accepts assertions for the wrong audience...
EUVD-2026-108521
Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens...
EUVD-2026-110470
Datadog dd-trace-py: IAST instrumentation can lead to application DOS...
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
Summary A flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. Details The affected IAST string-processing...
GHSA-P3M5-H5V9-VQJ6 Datadog dd-trace-py: IAST instrumentation can lead to application DOS
Summary A flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. Details The affected IAST string-processing...
GHSA-98QM-WVGF-W4CF MongoDB Python Driver: Out-of-bounds read in BSON decoding via a malformed Regex element
Impact The C extension's BSON decoder scans a Regex element's pattern and flags strings with strlen before checking the document's remaining length, so a crafted truncated Regex element can read past the end of the caller's buffer. bson.decode and bson.decodeall accept mmap and array buffers, whi...
MongoDB Python Driver: Out-of-bounds read in BSON decoding via a malformed Regex element
Impact The C extension's BSON decoder scans a Regex element's pattern and flags strings with strlen before checking the document's remaining length, so a crafted truncated Regex element can read past the end of the caller's buffer. bson.decode and bson.decodeall accept mmap and array buffers, whi...
EUVD-2026-95254
MongoDB Python Driver: Out-of-bounds read in BSON decoding via a malformed Regex element...
gladius
Gladius Easy mode from Responder to Credentials Author: Cory Duplantis @ctfhacker / blog Blog post on Gladius asciicast Gladius provides an automated method for cracking credentials from various sources during an engagement. We currently crack hashes from Responder, secretsdump.py, and...