PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification

Summary The plugin manager loads and executes arbitrary .py files from .praisonai/plugins/ directories both project-level and user home via importlib.util.specfromfilelocation + execmodule with zero code signing, integrity verification, or sandboxing. Any attacker who can write a file to the...

GHSA-M6WP-H223-4C8G PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification

Summary The plugin manager loads and executes arbitrary .py files from .praisonai/plugins/ directories both project-level and user home via importlib.util.specfromfilelocation + execmodule with zero code signing, integrity verification, or sandboxing. Any attacker who can write a file to the...

zyxel-vmg8825-keygen

Zyxel VMG8825-T50 Keygen per Supervisor Questo progetto contiene le seguenti funzioni implementate in Python 3: Nome funzione| Validità ---|--- zcfgBeCommonGenKeyBySerialNumCBT | ❓ zcfgBeCommonGenKeyBySerialNumMethod2 | ✅ zcfgBeCommonGenKeyBySerialNumMethod3 | ✅...

zeek2es

zeek2es.py Questa applicazione Python traduce i log di Zeek in formato ASCII TSV e JSON nel formato di caricamento bulk JSON di ElasticSearch. Indice: Introduzione Installazione Elastic v8.0+ Aggiornare zeek2es Pipeline di Ingest ES Filtraggio dei dati Filtri Python Filtro sulle chiavi Esempi da...

Posit Shiny for Python: Path traversal vulnerability

Posit Shiny for Python versions 1.4.0 to 1.6.4 had a path traversal vulnerability. This vulnerability stemmed from the bookmark restoration function’s acceptance of stateid provided by the client. The function did not verify whether it was a single secure path segment before appending it to the...

python: Use-after-free of a server-side SSLContext when sni_callback switches contexts

A flaw was found in Python. A remote, unauthenticated TLS client can cause a use-after-free in a server that uses SSLContext.snicallback to assign a different SSLSocket.context when selecting a certificate per server name, if nothing else keeps the original SSLContext alive. This can crash the...

python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio()

A flaw was found in Python. When establishing secure connections using the SSLContext.wrapbio function with hostname checking enabled, the module fails to validate that a target server hostname is supplied. Because of this missing check, certificate hostname verification is silently skipped rathe...

CVE-2026-107288

The Pydantic AI Python agent framework versions 1.77.0 through 1.107.6 and 2.44.0 are vulnerable to a Server-Side Request Forgery (SSRF) . The root cause is that the web_fetch_tool and WebFetch local fallback compare blocked_domains entries against a URL hostname before both values are normalized...

CVE-2026-107288 Pydantic AI: web_fetch_tool blocked_domains bypass via a hostname the resolver normalizes differently

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local webfetchtool and the WebFetch local fallback compare blockeddomains entries with a URL hostname before both values are normalized to the form used by...

CVE-2026-107288 Pydantic AI: web_fetch_tool blocked_domains bypass via a hostname the resolver normalizes differently

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local webfetchtool and the WebFetch local fallback compare blockeddomains entries with a URL hostname before both values are normalized to the form used by...

CVE-2026-107287 Pydantic AI: Excessive resource use when local web fetching converts nested HTML

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.7 and 2.52.0, the local webfetchtool and the WebFetch local fallback can consume excessive CPU and memory during HTML-to-Markdown conversion of attacker-controlled HTML...

CVE-2026-107286 Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 2.10.0 until 2.53.0, streamed requests made through ConcurrencyLimitedModel or limitmodelconcurrency can retain shared concurrency slots because anyio.CapacityLimiter associates an acquired sl...

Security update for python-hpack

This update for python-hpack fixes the following issue: CVE-2026-59980: unbounded variable integer decoding can cause run-away computation on malformed input, leading to quadratic runtime bsc1283035. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods lik...

SUSE-SU-2026:4593-1 Security update for python-hpack

This update for python-hpack fixes the following issue: - CVE-2026-59980: unbounded variable integer decoding can cause run-away computation on malformed input, leading to quadratic runtime bsc1283035...

heartbleed-poc

Probador y Exploit de HeartBleed NB Casi todas las herramientas nmap, metasploit, nessus, incluso burp tienen las versiones más actualizadas de sus escáneres. Estas herramientas se lanzaron en las primeras etapas, cuando las herramientas aún se estaban desarrollando. Usa mejor aquellas en lugar d...

OPENSUSE-SU-2026:22060-1 Security update for python-anyio

This update for python-anyio fixes the following issues: - CVE-2026-63374: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing bsc1281476. - CVE-2026-64847: AnyIO process-pool workers can block indefinitely on undrained stderr bsc1281475...

SUSE-SU-2026:24208-1 Security update for python-anyio

This update for python-anyio fixes the following issues: - CVE-2026-63374: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing bsc1281476. - CVE-2026-64847: AnyIO process-pool workers can block indefinitely on undrained stderr bsc1281475...

SUSE-SU-2026:24207-1 Security update for python-tornado6

This update for python-tornado6 fixes the following issues: - CVE-2026-82397: an unauthenticated request body containing millions of separator-delimited fields can synchronously stall the single-threaded event loop and delay every connection bsc1277725. - CVE-2026-91990: splitting of multipart da...

SUSE-SU-2026:24121-1 Security update for python-tornado6

This update for python-tornado6 fixes the following issues: - CVE-2026-82397: an unauthenticated request body containing millions of separator-delimited fields can synchronously stall the single-threaded event loop and delay every connection bsc1277725. - CVE-2026-91990: splitting of multipart da...

SUSE-SU-2026:24122-1 Security update for python-anyio

This update for python-anyio fixes the following issues: - CVE-2026-63374: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing bsc1281476. - CVE-2026-64847: AnyIO process-pool workers can block indefinitely on undrained stderr bsc1281475...