Malicious code in minecraft-ytreceiver (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad998d7ff924f18f57116d8dd586342fd060d8fb1459d94c0a911589bc2e3686 The package's module polls a hardcoded Telegram bot api.telegram.org, bot id 8871201315 for commands scoped to a specific chat and topic. On matching...

Chainlist has SSRF via MCP SSE and streamable-http transports that allows unauthenticated internal network access

Am I affected? Only if your deployment sets features.mcp.enabled = true in .chainlit/config.toml. MCP has been disabled by default since v2.7.0, so most Chainlit deployments are not affected. No authentication is required: /mcp is reachable by any client that can open a session. Summary When MCP ...

GHSA-HVFH-5MJ3-5F3J Chainlist has SSRF via MCP SSE and streamable-http transports that allows unauthenticated internal network access

Am I affected? Only if your deployment sets features.mcp.enabled = true in .chainlit/config.toml. MCP has been disabled by default since v2.7.0, so most Chainlit deployments are not affected. No authentication is required: /mcp is reachable by any client that can open a session. Summary When MCP ...

GHSA-W3FX-MC44-MF6J Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution

Am I affected? Only if your deployment sets features.mcp.enabled = true in .chainlit/config.toml. MCP has been disabled by default since v2.7.0, so most Chainlit deployments are not affected. No authentication is required: /mcp is reachable by any client that can open a session. Summary When MCP ...

Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution

Am I affected? Only if your deployment sets features.mcp.enabled = true in .chainlit/config.toml. MCP has been disabled by default since v2.7.0, so most Chainlit deployments are not affected. No authentication is required: /mcp is reachable by any client that can open a session. Summary When MCP ...

CVE-2026-45018 Chainlit: Command injection via MCP stdio transport allows unauthenticated remote code execution

Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For stdio transport, the...

CVE-2026-45018 Chainlit: Command injection via MCP stdio transport allows unauthenticated remote code execution

Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For stdio transport, the...

EUVD-2026-65737

Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For stdio transport, the...

CVE-2026-45018

Chainlit (Python framework for conversational AI applications) is vulnerable to command injection via its MCP stdio transport in versions 2.4.0rc0 through 2.12.0 . When features.mcp.enabled is set to true, the POST /mcp endpoint is exposed without authentication . The validate_mcp_command() funct...

CVE-2026-45018 Chainlit: Command injection via MCP stdio transport allows unauthenticated remote code execution

Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For stdio transport, the...

lst2x64dbg

lst2x64dbg This command extracts all the labels found in the LST file that is given as the single argument. An x64dbg database is created in the current directory based on the extracted labels. The LST file can be generated in IDA from the File menu: Produce file - Create LST file... Example...

PAN-OS-CVE-2024-3400-Command-Injection-Investigation

Indagine su un tentativo di command injection PAN-OS CVE-2024-3400 Panoramica Questo progetto documenta l'indagine su un tentativo di command injection CVE-2024-3400 rivolto a un servizio PAN-OS GlobalProtect. L'obiettivo era determinare: se si tratti di un attacco reale se l'esecuzione di comand...

Exploit for CVE-2026-75604

CVE-2026-75604 RCE PoC Python proof of concept for CVE-2026-...

Security update for LibVNCServer

This update for LibVNCServer fixes the following issue: CVE-2026-50538: a malicious or man-in-the-middle VNC server can force a connecting libvncclient to write attacker- controlled data past the end of its framebuffer bsc1276218. Patch Instructions: To install this SUSE update use the SUSE...

beagle

Beagle 1. About Beagle 2. Installation 1. Docker 2. Python Package 3. Configuration 3. Web Interface 1. Uploading Data 2. Browsing Existing Graphs 3. Graph Interface 1. Inspecting Nodes and Edges 2. Expanding Neighbours 3. Hiding Nodes 4. Running Mutators 5. Toggling Node and Edge Types 6...

hashcobra

hashcobra hashcobra Hash Cracking tool. Description This tool uses a new method to crack hashes. With the help of rainbow tables concept this tool generates rainbow tables from wordlists to heavily optimize the cracking process. Usage root@kitploit: $ ./hashcobra -H --== hashcobra by sepehrdad ==...

Important: Red Hat Security Advisory: sg3_utils security update

An update for sg3utils is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export

A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev...

reconspider

Most Advanced Open Source Intelligence OSINT Framework ReconSpider ReconSpider is most Advanced Open Source Intelligence OSINT Framework for scanning IP Address, Emails, Websites, Organizations and find out information from different sources. ReconSpider can be used by Infosec Researchers,...

zuthaka

A collaborative free open-source Command & Control integration framework that allows developers to concentrate on the core function and goal of their C2. Explore the docs » · Report Bug · Request Feature · Table of Contents 1. About The Project Problem statement Solution Built With 2. Already...