45637 matches found
PYSEC-2026-1673 MobSF Stored Cross-Site Scripting (XSS)
Product: MobSF Version: CFBundleIdentifier value. In the dynamicanalysis.html file you do not sanitize...
PYSEC-2026-1666 Mobile Security Framework (MobSF) Stored Cross-Site Scripting Vulnerability in "Diff or Compare" Functionality
Summary The application allows users to upload files with scripts in the filename parameter. As a result, a malicious user can upload a script file to the system. When users in the application use the "Diff or Compare" functionality, they are affected by a Stored Cross-Site Scripting vulnerabilit...
PYSEC-2026-1432 Guardrails has an arbitrary code execution vulnerability
An arbitrary code execution vulnerability exists in versions 0.2.9 up to 0.5.10 of the Guardrails AI Guardrails framework because of the way it validates XML files. If a victim user loads a maliciously crafted XML file containing Python code, the code will be passed to an eval function, causing i...
Guardrails has an arbitrary code execution vulnerability
An arbitrary code execution vulnerability exists in versions 0.2.9 up to 0.5.10 of the Guardrails AI Guardrails framework because of the way it validates XML files. If a victim user loads a maliciously crafted XML file containing Python code, the code will be passed to an eval function, causing i...
carml (19.1.0), nucypher (>=0.1.0a27, <=1.2.0b1) +3 more potentially affected by CVE-2024-41671 via twisted (19.7.0)
twisted PYPI version 19.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - carml 19.1.0 - nucypher =0.1.0a27, =1.1.0, =1.0.0, =0.2.0, =0.2.1 Source cves: CVE-2024-41671 Source advisory: OSV:PYSEC-2026-1992...
an-website (>=22.5.20, <=22.6.10), carml (>=22.7.0, <=22.7.1) +4 more potentially affected by CVE-2024-6345 via setuptools (62.3.2)
setuptools PYPI version 62.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - an-website =22.5.20, =22.7.0, =2.1.5a1, =0.0.0, =2.3.0rc3 Source cves: CVE-2024-6345 Source advisory: OSV:PYSEC-2026-1918...
wger (1.5.0) potentially affected by CVE-2024-21520 via djangorestframework (2.3.13)
djangorestframework PYPI version 2.3.13 is affected by a known vulnerability. The following packages have a transitive dependency on djangorestframework and may be impacted: - wger 1.5.0 Source cves: CVE-2024-21520 Source advisory: OSV:PYSEC-2026-1304...
CVE-2026-48588
An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. UpdateCacheMiddleware and the cachepage decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache. Earlier,...
PYSEC-2026-1877 Ryu Infinite Loop vulnerability
OFPHello in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service infinite loop via length=0...
Ryu Infinite Loop vulnerability
OFPBucket in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service infinite loop via action.len=0...
PYSEC-2026-1880 Ryu Infinite Loop vulnerability
OFPBucket in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service infinite loop via action.len=0...
django-globus-portal-framework (>=0.3.23, <=0.4.2), django-user-app (0.0.6) +14 more potentially affected by CVE-2024-32879 via social-auth-app-django (4.0.0)
social-auth-app-django PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-app-django and may be impacted: - django-globus-portal-framework =0.3.23, =2.28.1, =1.3.0, =1.0.0b3, =1.6.0, =0.9.2.dev0, =0.9.0, =0.1.0, =6.0.0,...
Mobile Security Framework (MobSF) vulnerable to SSRF in firebase database check
ImpactWhat kind of vulnerability is it? Who is impacted?SSRF vulnerability in firebase database check logic. The attacker can cause the server to make a connection to internal-only services within the organization’s infrastructure. When malicious app is uploaded to Static analyzer, it is possible...
PYSEC-2026-1676 Mobile Security Framework (MobSF) vulnerable to SSRF in firebase database check
Impact What kind of vulnerability is it? Who is impacted? SSRF vulnerability in firebase database check logic. The attacker can cause the server to make a connection to internal-only services within the organization’s infrastructure. When malicious app is uploaded to Static analyzer, it is possib...
SSRF Vulnerability on assetlinks_check(act_name, well_knowns)
SummaryWhile examining the "App Link assetlinks.json file could not be found" vulnerability detected by MobSF, we, as the Trendyol Application Security team, noticed that a GET request was sent to the "/.well-known/assetlinks.json" endpoint for all hosts written with "android:host". In the...
Denial of Service Vulnerability in gRPC TCP Server (Posix-compatible platforms)
Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms ex. Linux allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Jav...
Twisted vulnerable to NameVirtualHost Host header injection
When the host header does not match a configured host, twisted.web.vhost.NameVirtualHost will return a NoResource resource which renders the Host header unescaped into the 404 response allowing HTML and script injection.Example configuration:pythonfrom twisted.web.server import Sitefrom...
MobSF allows attackers to read arbitrary files via a crafted HTTP request
Mobile Security Framework MobSF v0.9.2 and below was discovered to contain a local file inclusion LFI vulnerability in the StaticAnalyzer/views.py script. This vulnerability allows attackers to read arbitrary files via a crafted HTTP request...
PYSEC-2026-848 MobSF allows attackers to read arbitrary files via a crafted HTTP request
Mobile Security Framework MobSF v0.9.2 and below was discovered to contain a local file inclusion LFI vulnerability in the StaticAnalyzer/views.py script. This vulnerability allows attackers to read arbitrary files via a crafted HTTP request...
