CVE-2026-33017

CVE-2026-33017 — Langflow 未认证远程代码执行 HoGent CyberSecurity II — 网络渗透测试与利用（NPE） 学年 2025–2026 概述 本仓库包含一个完整的实验环境及 CVE-2026-33017 的利用演示，这是 Langflow ≤ 1.8.1 中的一个严重未认证远程代码执行（RCE）漏洞。 攻击者无需任何认证即可通过 /api/v1/buildpublictmp/flowid/flow 端点在服务器上执行任意 Python 代码，原因是用户输入被直接传递给 Python 的 exec，且没有沙箱隔离或验证。 ⚠️ 免责声明：...

ALPINE-CVE-2026-57456

Vim is an open source, command line text editor. Prior to 9.2.0699, Vim's Python omni-completion runtime/autoload/python3complete.vim and the legacy pythoncomplete.vim executes reconstructed function and class definitions from the current buffer with exec as part of populating the completion...

CVE-2026-52806 Gogs: RCE via git rebase --exec argument injection in pull request merge

Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs allows authenticated users to achieve Remote Code Execution RCE on the server by creating a pull request with a specially crafted branch name that injects the --exec flag into the git rebase command during the "Rebase before...

Gogs vulnerable to RCE via git rebase --exec argument injection in pull request merge

Gogs: RCE via git rebase --exec Argument Injection in PR Merge Summary Gogs allows authenticated users to achieve Remote Code Execution RCE on the server by creating a pull request with a specially crafted branch name that injects the --exec flag into the git rebase command during the "Rebase...

CVE-2026-4511

CVE-2026-4511 affects vanna-ai up to version 2.0.2. The vulnerability targets the function exec in the file /src/vanna/legacy, enabling injection due to an underlying manipulation. The issue is exploitable remotely and has publicly disclosed exploit materials. Multiple CVE references corroborate ...

CVE-2026-4511 vanna-ai vanna legacy exec injection

A security vulnerability has been detected in vanna-ai vanna up to 2.0.2. Affected is the function exec of the file /src/vanna/legacy. Such manipulation leads to injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early...

EUVD-2022-6236

Malicious code in bioql PyPI...

AZL-10532 CVE-2022-30580 affecting package golang for versions less than 1.18.5-1

Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset...