PyPATHPwner

POC Exploit for CVE-2022-26488 - Python for Windows CPython escalation of privilege vulnerability, discovered by the Lockheed Martin Red Team...

cve-2026-19445-sni-uaf

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · cve-2026-19445-sni-uaf Write-up: https://abraxaslabs.tech/research/cve-2026-19445-sni-uaf cve-2026-19445-sni-uaf CPython ssl - Python Software Foundation A TLS server that mints an SSLContext per connection, sets...

autonomous-offensive-llm-handbook

📖 Read the handbook online : follow the lessons from your first fixture run to an agent with clear limits. The model proposes, the code disposes AUTONOMOUS SECURITY / THE BUILDER'S FIELD MANUAL Read the website · Start the course · Run the lab · Connect your model · The build sequence A practical...

CVE-2018-1000117-Exploit

CVE-2018-1000117 Python Software Foundation CPython version From 3.2 until 3.6.4 on Windows contains a Buffer Overflow vulnerability in os.symlink function on Windows that can result in Arbitrary code execution, likely escalation of privilege. This attack appears to be exploitable via a python...

PyPath-Escape-CVE-2025-4517-Exploit-Research

🛡️ PyPath-Escape: Advanced PATHMAX Bypass Toolkit Author: Beriwalarohit Research Target: CVE-2025-4517 / CVE-2025-4138 ██████╗ ███████╗██████╗ ██╗██╗ ██╗ █████╗ ██╗ █████╗ ██████╗ ██╔══██╗██╔════╝██╔══██╗██║██║ ██║██╔══██╗██║ ██╔══██╗██╔══██╗ ██████╔╝█████╗ ██████╔╝██║██║ █╗ ██║███████║██║...

CVE-2018-1000802-PoC

Python CVE-2018-1000802 Proof-of-Concept This is a PoC for the vulnerability in makearchive function exported by shutil builtin module. Vulnerability is present in CPython Python 2.7 prior to commit add531a1e55b0a739b0f42582f1c9747e5649ace. For the vulnerability to be exploitable in the wild ther...

security_monkey

NOTE: Security Monkey is in maintenance mode and will be end-of-life in 2020. For AWS users, please make use of AWS Config. For GCP users, please make use of Cloud Asset Inventory. Security Monkey Security Monkey monitors your AWS and GCP accounts for policy changes and alerts on insecure...

CVE-2007-4559

demonstration of CVE-2007-4559 what is this? This is a demonstration of how python's default handling of tar file extraction prior to python v3.11.4 is vulnerable to a simple symlink attack. The instructions below describe how to craft a malicious payload. The script untar.py demonstrates how and...

CVE-2026-115791: Python Software Foundation CPython: When tarfile or zipfile command line interface (CLI) is used to decompress an archive, a Python script shadowing the…

When tarfile or zipfile command line interface CLI is used to decompress an archive, a Python script shadowing the stdlib can be created. Then if an error occurs during decompressing the next file, the newly created Python script is executed. This is especially true if the created Python is calle...

CVE-2026-19552: Python Software Foundation CPython: When ca_certs parameter was supplied to ssl.get_server_certificate() function, the identity of the certificate is not…

When cacerts parameter was supplied to ssl.getservercertificate function, the identity of the certificate is not checked...

CVE-2026-124249: Python Software Foundation CPython: http.cookiejar.CookieJar deleted a stored cookie when a response carried an already expired Set-Cookie header for it,…

http.cookiejar.CookieJar deleted a stored cookie when a response carried an already expired Set-Cookie header for it, using the Domain and Path attributes from the header without consulting the cookie policy. A server could therefore delete cookies belonging to other domains from a shared cookie...

K000164129: CPython vulnerability CVE-2025-8194

Security Advisory Description There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of...

CVE-2026-119170: Python Software Foundation CPython: There was a regression in how FIPS algorithms were enforced for the hashlib module

There was a regression in how FIPS algorithms were enforced for the hashlib module. Only users that are using OpenSSL in FIPS mode are affected. Only Python 3.14.10 is affected, all other Python versions are unaffected...

F5 Networks BIG-IP : CPython vulnerability (K000164129)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.3.1 / 17.5.1.4. It is, therefore, affected by a vulnerability as referenced in the K000164129 advisory. There is a defect in the CPython tarfile module affecting the TarFile extraction and entry enumeration APIs. The...

CLEANSTART-2025-RK33121 package python/cpython from 0 and before 3

CVE-2021-23336 affects multiple packages. The package python/cpython from 0 and before 3. See references for individual vulnerability details...

GraphQL-core Has Denial Of Service Via Memory Leak In Aborted Validations

Summary When a validation was aborted because the document contained more errors than allowed by "maxerrors" 100 by default, "validate" raised a single module-level "ValidationAbortedError" instance. Python appends the frames of every "raise" to the existing "traceback" of an exception that is...

GraphQL-core has denial of service via memory leak in aborted validations

Summary When a validation was aborted because the document contained more errors than allowed by maxerrors 100 by default, validate raised a single module-level ValidationAbortedError instance. Python appends the frames of every raise to the existing traceback of an exception that is raised again...

Python CPython input validation error vulnerability

Python versions prior to CPython 3.16.0 contain an input validation error vulnerability. This vulnerability arises because socket.getaddrinfo accepts empty bytes in the host and port parameters, potentially leading to silent truncation of those parameters...

CVE-2026-116566: Python Software Foundation CPython: socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to…

socket.getaddrinfo previously accepted null bytes within host and port parameters which can cause the values to be silently truncated...

Python CPython input validation error vulnerability

A vulnerability related to input validation exists in Python versions prior to CPython 3.16.0. This vulnerability stems from improper handling of non-hexadecimal or negative integers in response bodies and chunk parsing, potentially leading to misinterpretation of HTTP responses...