Brute-Ratel-C4-Community-Kit

Brute-Ratel-C4 Dieses Repository enthält Skripte, Konfigurationen und veraltete Payload-Loader für Brute Ratel C4 https://bruteratel.com/. Alles, was im Ordner „deprecated“ hinzugefügt wird, ist nicht Teil der neuesten Version von BRc4...

dotNetPELoader

dotNetPELoader सुरक्षा सूचना हाल ही में, मुझे इस परियोजना का एक अनधिकृत संशोधित संस्करण इस रिपॉजिटरी के बाहर पुनर्वितरित होता मिला। फ़ाइलों की समीक्षा करने के बाद, मैंने अतिरिक्त छिपे हुए घटकों और स्क्रिप्ट-लोडिंग व्यवहार की पहचान की जो आधिकारिक स्रोत कोड में मौजूद नहीं हैं। कृपया जान लें: अनधिकृ...

CVE-2026-79657

NLTK (Python Natural Language Toolkit) versions before 3.10.3 are affected by a remote code execution vulnerability in its allowlisted pickle deserialization mechanism. The root cause is that the safe pickle loaders trust entire module namespaces rather than restricting to specific safe callables...

Moodle - Cross-Site Scripting/Remote Code Execution

The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system. Moodle versions 4.1.x before 4.1.3 and 4.2.x before...

Crystal-Loaders

Crystal Loaders В этом репозитории содержатся несколько PIC-загрузчиков и кастомный sleepmask COFF для использования с Cobalt Strike. Это базовые реализации, в которые необходимо вплести собственную обходную тактику evasion tradecraft с помощью Crystal Palace. Использование 1. Загрузите релиз...

PT-2026-81276

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.3 Description Allowlisted pickle loaders trust entire module namespaces instead of specific safe callables. This allows attackers to craft malicious pickle payloads that use the pickle REDUCE mechanism to invoke...

CVE-2026-74360

The CVE-2026-74360 entry describes a Linux kernel vulnerability in BPF iterators: bpf_map_elem iterators bind their target map at attach time, bypassing the exclusivity check enforced by check_map_prog_compatibility() for excl_prog_hash. This can undermine the intended isolation of exclusive maps...

MAL-2026-12246 Malicious code in tinkoff-pfp-atom-styles-tiles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 471d141c15ae867da45bf9c0f0802fa3c690c545184df894b96f1fcf61792c35 index.js unconditionally requires./ext inside a swallowed try/catch. ext.js is a platform-aware dropper: it constructs Cloudflare workers.dev hostnam...

Files or Directories Accessible to External Parties

Overview Affected versions of this package are vulnerable to Files or Directories Accessible to External Parties through the Vips analyzer and Vips transformer in vips.rb. An attacker can read files from the server, including process environment variables, by uploading a crafted image and causing...

CVE-2026-53598

Prompty is a markdown file format .prompty for LLM prompts. Prior to 2.0.0-beta.2, Prompty loaders expanded $file:... references in .prompty frontmatter without enforcing that resolved paths stayed within the prompt directory or allowed roots, allowing an attacker-controlled prompt file to read...

CVE-2026-43637 Cornac < 2.6.0 Path Traversal via _extract_archive() in download.py

Cornac before 2.6.0 contains a path traversal Tar Slip vulnerability that allows attackers to write arbitrary files outside the intended cache directory by supplying a crafted TAR archive containing ../ sequences, absolute paths, or symlink/hardlink entries to the extractarchive function in...

EUVD-2026-44669

Cornac before 2.6.0 contains a path traversal Tar Slip vulnerability that allows attackers to write arbitrary files outside the intended cache directory by supplying a crafted TAR archive containing ../ sequences, absolute paths, or symlink/hardlink entries to the extractarchive function in...

PYSEC-2026-2556 LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders

Summary Several LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or t...

CVE-2026-59180

Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available. Prior to 1.11.0, Apprise HTTP-based notification plugins and HTTP attachment and config loaders in apprise/attachment/http.py and apprise/config/http.py...

CVE-2026-54499

CVE-2026-54499 affects Stanza prior to 1.12.2, where model loading uses torch.load(..., weights_only=True) and on an attacker-controllable pickle.UnpicklingError falls back to weights_only=False, enabling arbitrary pickle code execution when loading a malicious .pt pretrain/file. The vulnerabilit...

CVE-2026-54499 Stanza: Remote Code Execution via Unsafe Pickle Deserialization in Model Loaders

Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.12.2, Stanza model loaders such as stanza.models.common.pretrain.Pretrain.load attempt torch.load..., weightsonly=True but fall back to torch.load...,...

CVE-2026-54499 Stanza: Remote Code Execution via Unsafe Pickle Deserialization in Model Loaders

Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.12.2, Stanza model loaders such as stanza.models.common.pretrain.Pretrain.load attempt torch.load..., weightsonly=True but fall back to torch.load...,...

PYSEC-2026-1570 LlamaIndex has an XML Entity Expansion vulnerability in its sitemap parser

An XML Entity Expansion vulnerability, also known as a 'billion laughs' attack, exists in the sitemap parser of the run-llama/llamaindex repository, specifically affecting the Papers Loaders package before version 0.3.2 in llama-index v0.10.0 and above through v0.12.29. This vulnerability allows ...

SUSE-SU-2026:22302-1 Security update for glycin-loaders

This update for glycin-loaders fixes the following issues - CVE-2025-55159: slab: incorrect bounds check in getdisjointmut function can lead to undefined behavior or potential crash due to out-of-bounds access bsc1248035. - CVE-2025-58160: tracing-subscriber: Tracing log pollution bsc1249010...

Security update for glycin-loaders (moderate)

openSUSE security update: security update for glycin-loaders ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21134-1 Rating: moderate References: bsc1248035 bsc1249010 Cross-References: CVE-2025-55159 CVE-2025-58160 CVSS scores: CVE-2025-55159 SUSE ...