Astra Linux – Vulnerability in python-git

GitPython versions before 3.1.54 contain a vulnerability where an arbitrary file overwrite is possible, due to a flaw in the Diffable.diff method. This method fails to validate git options passed through thekwargs parameter. Attackers can provide the --output argument via another parameter, or us...

Astra Linux – Vulnerability in python-urllib3

urllib3 is a user-friendly HTTP client library for Python. urllib3 does not treat the Cookie HTTP header specially or provides any helpers for managing cookies over HTTP; that responsibility lies with the user. However, it is possible for a user to specify a Cookie header, and information may be...

Astra Linux - vulnerability in pillow

In Pillow versions prior to 9.0.0, PIL.ImageMath.eval enables evaluation of arbitrary expressions—including those that utilize the Python exec method. A lambda expression can also be used...

Astra Linux – vulnerability in python-git

GitPython versions prior to 3.1.59 contain an incomplete denylist within the unsafegitrevisionoptions guard; this list omits the --contents and -S options. As a result, attackers can read arbitrary files by passing these options to Repo.blame. Attackers can also supply revision values such as...

Astra Linux – Vulnerability in python-ipaddress

The Lib/ipaddress.py module in Python up to version 3.8.3 incorrectly calculates hash values for the IPv4Interface and IPv6Interface classes. This may allow a remote attacker to cause a denial of service if an application relies on the performance of a dictionary containing IPv4Interface or...

hackingtool

AI-guided, all-in-one toolkit for authorized security testing 219 curated tools across 21 categories — recon, OSINT, web, wireless, phishing, forensics, post-exploitation and more — with an AI layer that turns plain English into the right tool and the exact command. Built for penetration testers ...

G0BurpSQLmaPI

Kousei こうせい Author: nu11secur1ty Years: 2023–2026 Language: Python with optional Go modules Purpose: Generate SQLi Proof-of-Concept requests, automate sqlmap attacks, and manage attack modules with ease. Description Kousei こうせい is an aggressive framework for sqlmap that can work with any web...

Exegol

Exegol — Cybersecurity CTF Write-ups !Statushttps://img.sh...

CVE-2026-79824

A flaw was found in Python. An attacker can exploit this directory traversal vulnerability by providing a specially crafted TAR archive containing relative path sequences, such as dot-dot notation. When the archive is extracted, files can be written outside the intended extraction directory,...

Shiny for Python has path traversal in bookmark restore

ImpactShiny for Python's bookmark-restore path accepted a client-supplied stateidquery-string value and joined it into the server-side bookmark directory/shinybookmarks/ without validating it. A value containing ..path segments, or an absolute path, could therefore cause the server to open andpar...

PYSEC-2026-4300 Shiny for Python has path traversal in bookmark restore

Impact Shiny for Python's bookmark-restore path accepted a client-supplied stateid query-string value and joined it into the server-side bookmark directory /shinybookmarks/ without validating it. A value containing .. path segments, or an absolute path, could therefore cause the server to open an...

PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source

API deploy code generator embeds unescaped YAML fields into Python source SummaryPraisonAI's API deployment generator copies deploy.api.host from agents.yaml directly into generated Python source without safe literal encoding. A malicious PraisonAI project can set that host value to a Python...

PYSEC-2026-4251 PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source

API deploy code generator embeds unescaped YAML fields into Python source Summary PraisonAI's API deployment generator copies deploy.api.host from agents.yaml directly into generated Python source without safe literal encoding. A malicious PraisonAI project can set that host value to a Python...

PYSEC-2026-4221 Hydra logging configuration permits unsafe callable resolution

Summary Hydra passed its Python logging configuration to logging.config.dictConfig. Python's logging configurator can resolve and invoke importable classes and factories named by configuration, including handler class values and formatter, filter, handler, queue, and listener factories. This...

PYSEC-2026-4224 Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method

Summary hydra-optuna-sweeper accepted a configuration-controlled dotted path in hydra.sweeper.customsearchspace, resolved it with the lower-level hydra.utils.getmethod API, and later invoked the returned callable. Hydra's object-lookup helpers intentionally trust their input and do not apply the...

echelon-client-agent (>=0.0.3, <=0.0.5), echelon-client-echelon (0.0.3) +1 more potentially affected by CVE-2026-106454 via twisted (18.4.0)

twisted PYPI version 18.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - echelon-client-agent =0.0.3, =0.7.2, =0.7.3 Source cves: CVE-2026-106454 Source advisory: OSV:PYSEC-2026-4304...

carly (>=0.1.0, <=0.10.1), carml (>=18.4.0, <=19.0.0) +10 more potentially affected by CVE-2026-106454 via twisted (18.9.0)

twisted PYPI version 18.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - carly =0.1.0, =18.4.0, =2019.5.0, =0.1.0a2, =0.0.12, =0.100.2rc4, =1.2.1.0, =0.1.0, =0.1.1 - tx 0.0.2 Source cves: CVE-2026-106454 Source advisor...

golemrpc (>=0.3.4, <=0.3.6), neo-python (>=0.5.7, <=0.7.1) +5 more potentially affected by CVE-2026-106454 via twisted (17.9.0)

twisted PYPI version 17.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - golemrpc =0.3.4, =0.5.7, =0.1.0, =0.2.0, =0.2.1 - txwerewolves 0.6.1 - yy-spider 1.0.0 Source cves: CVE-2026-106454 Source advisory:...

bitdust (0.0.2), kaze-python (>=0.7.8, <=0.8.9) +2 more potentially affected by CVE-2026-106454 via twisted (18.7.0)

twisted PYPI version 18.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - bitdust 0.0.2 - kaze-python =0.7.8, =0.7.5, =0.4.0.post2, =0.7.1 Source cves: CVE-2026-106454 Source advisory: OSV:PYSEC-2026-4304...

openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation

ImpactA malicious OpenAPI document processed by any openapi-python-client prior to 0.29.1 can generate arbitrary Python code. When anyone imports the malicious client, that arbitrary Python code will execute. PatchesVersions starting with 0.29.1 have updated with guardrails to prevent arbitrary...