git-scan

git-scan Esta herramienta está diseñada para escanear e identificar si un sitio web tiene un directorio ".git" expuesto, que puede contener información sensible como código fuente o archivos de configuración de Git. Características Escanea masivamente URLs para averiguar si el directorio...

CISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch Deadline

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Wednesday added three flaws, each impacting Cisco, Citrix, and Fortinet, to its Known Exploited Vulnerabilities KEV catalog, requiring Federal Civilian Executive Branch FCEB agencies to apply the patches by September 12, 2026. The...

oss-oopssec-store v2.20.0

OSS - OopsSec Store Security training for the apps you actually ship. 36 challenges across web, API, authentication, business logic, cryptography, supply chain, AI agents and MCP. Break a deliberately vulnerable e-commerce app built on Next.js, React, TypeScript and Prisma. Find the bugs. Exploit...

smartermail-cve-scanner

Escáner SmarterMail CVE-2025-52691 Vulnerabilidad RCE CVSS 10.0 en SmarterMail. ¿Tu servidor de correo es vulnerable? Escáner rápido y preciso para CVE-2025-52691 - una vulnerabilidad crítica de carga arbitraria de archivos sin autenticación que permite la ejecución remota de código en servidores...

PYSEC-2026-3940 weasyprint Has Server-Side Request Forgery (SSRF)

Summary urlfetcher is WeasyPrint's documented mechanism for restricting resource loading - applications use it to block file://, internal hosts, etc. when rendering untrusted input. Two writepdf channels ignore the document's urlfetcher and build a fresh default URLFetcher instead. A restrictive...

asyncssh has SCP Path Traversal to Arbitrary File Write

| | ||---|---|| Product | asyncssh all versions through 2.23.0 || Related | CVE-2019-6111 same class in OpenSSH || Fix | AsyncSSH 2.23.1 |A malicious SSH server can write arbitrary files on the asyncssh SCP client's filesystem by sending filenames containing ../ traversal sequences. The SCP recei...

PYSEC-2026-3808 asyncssh has SCP Path Traversal to Arbitrary File Write

| | | |---|---| | Product | asyncssh all versions through 2.23.0 | | Related | CVE-2019-6111 same class in OpenSSH | | Fix | AsyncSSH 2.23.1 | A malicious SSH server can write arbitrary files on the asyncssh SCP client's filesystem by sending filenames containing ../ traversal sequences. The SCP...

reachy_mini Allows Unrestricted Upload of File with Dangerous Type

SummaryThe Reachy Mini daemon exposes the “/api/media/sounds/upload” endpoint without authentication and file validation mechanisms. An attacker can use this endpoint to upload malicious files into the file system that will propagate in future attacks. Compromise Chain: Unauthenticated to Full Ro...

qwed Vulnerable to Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`

SummaryThe qwed package version 5.1.1 passes attacker-controlled input directly to SymPy's parseexpr function without a restricted namespace. Because parseexpr internally calls Python's eval, any authenticated tenant can execute arbitrary Python code inside the API server process. The attack...

PYSEC-2026-3916 reachy_mini Allows Unrestricted Upload of File with Dangerous Type

Summary The Reachy Mini daemon exposes the “/api/media/sounds/upload” endpoint without authentication and file validation mechanisms. An attacker can use this endpoint to upload malicious files into the file system that will propagate in future attacks. Compromise Chain: Unauthenticated to Full...

PYSEC-2026-3914 qwed Vulnerable to Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`

Summary The qwed package version 5.1.1 passes attacker-controlled input directly to SymPy's parseexpr function without a restricted namespace. Because parseexpr internally calls Python's eval, any authenticated tenant can execute arbitrary Python code inside the API server process. The attack...

qwed-mcp has Unsafe SymPy `parse_expr()` Remote Code Execution via Unsanitized Math Expression Input

Summaryverifymathexpression in qwed-mcp v0.2.0 passes attacker-controlled strings directly to SymPy's parseexpr without restricting globaldict or validating the expression's AST. Because parseexpr internally calls eval and Python automatically injects the current module's builtins when no explici...

PYSEC-2026-3915 qwed-mcp has Unsafe SymPy `parse_expr()` Remote Code Execution via Unsanitized Math Expression Input

Summary verifymathexpression in qwed-mcp v0.2.0 passes attacker-controlled strings directly to SymPy's parseexpr without restricting globaldict or validating the expression's AST. Because parseexpr internally calls eval and Python automatically injects the current module's builtins when no explic...

PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced

Summarypraisonai serve agents and praisonai serve unified both accept --api-key for authentication. The flag is parsed but never wired into the FastAPI app — no middleware, no header check, nothing. The server runs wide open regardless of what key you set. Tested on 4.6.50 from PyPI. Affected...

PYSEC-2026-3893 PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced

Summary praisonai serve agents and praisonai serve unified both accept --api-key for authentication. The flag is parsed but never wired into the FastAPI app — no middleware, no header check, nothing. The server runs wide open regardless of what key you set. Tested on 4.6.50 from PyPI. Affected...

PYSEC-2026-3901 praisonaiagents: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation tool

Target: PraisonAI MervinPraison/PraisonAI Affected component: praisonaiagents/tools/astgreptool.py — astgreprewrite Affected versions: master at ce97667156a116c50b4a3d1aa21e09f048903fda; reproduced against the current praisonaiagents PyPI release praisonaiagents --rewrite --lang --update-all line...

praisonaiagents: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation tool

Target: PraisonAI MervinPraison/PraisonAIAffected component: praisonaiagents/tools/astgreptool.py — astgreprewriteAffected versions: master at ce97667156a116c50b4a3d1aa21e09f048903fda; reproduced against the current praisonaiagents PyPI release praisonaiagents = 1.6.52. SummaryTools in...

Copier has a trust-prefix bypass via path traversal that runs tasks unprompted

Copier: trust-prefix bypass via path traversal runs tasks unprompted SummaryIn copier = 9.5.0,...

PYSEC-2026-3818 Copier has a trust-prefix bypass via path traversal that runs tasks unprompted

Copier: trust-prefix bypass via path traversal runs tasks unprompted Summary In copier = 9.5.0, = 9.15.1, the trust setting's prefix match copier/settings.py compares the template URL against a trusted prefix with a raw str.startswith and no path normalization, while the URL is normalized when th...

CVE-2023-5612

公开邮件在标签RSS源中的泄露 https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/ root@kitploit: An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It was possible to read the user email address...