binja_arch_ref

binjaarchref A simple Binary Ninja plugin to display a cheat sheet with information about the current architecture Origins This project is a product of NCC Group's 2017 summer internship program. Further updates will be tracked athttps://github.com/ehennenfent/binjaarchref. NCC Group is not...

tplmap

Tplmap This project is no longer maintained. I'm happy to merge new PRs as long they don't break the test suite. Tplmap assists the exploitation of Code Injection and Server-Side Template Injection vulnerabilities with a number of sandbox escape techniques to get access to the underlying operatin...

Astra Linux – Vulnerability in Mako

Mako is a template library written in Python. Prior to version 1.3.11, the TemplateLookup.gettemplate function was vulnerable to path traversal attacks when the URI started with // e.g., //../../../secret.txt. The root cause of this issue was an inconsistency between two implementations of path...

Astra Linux – Vulnerability in Mako

Sqlalchemy mako before version 1.2.2 is vulnerable to Regular Expression Denial of Service when using the Lexer class for parsing. This vulnerability also affects babelplugin and linguaplugin...

PYSEC-2026-4243 Mako: Path traversal via drive-letter URI on Windows in TemplateLookup

Summary On Windows, a TemplateLookup URI beginning with a drive designator e.g. C:/../../secret.txt or C:....\secret.txt bypasses the directory traversal check in Template.init, allowing reads of files outside the configured template directory. This is a third, independent instance of the root...

Security Bulletin: Multiple Vulnerabilities in IBM Concert Software

Summary Multiple vulnerabilities were addressed in IBM Concert Software version 3.0.1.1 Vulnerability Details CVEID:CVE-2026-102991 DESCRIPTION: Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.gettemplate in mako/lookup.py resolves template URIs with...

CLEANSTART-2026-RY75386 Mako is a template library written in Python

CVE-2026-102991 affects multiple packages. Mako is a template library written in Python. See references for individual vulnerability details...

CLEANSTART-2026-XA70442 Mako is a template library written in Python

Security vulnerability affects the apache-superset package. Mako is a template library written in Python...

GHSA-5639-2J2P-M4MX Mako: Path traversal via drive-letter URI on Windows in TemplateLookup

Summary On Windows, a TemplateLookup URI beginning with a drive designator e.g. C:/../../secret.txt or C:....\secret.txt bypasses the directory traversal check in Template.init, allowing reads of files outside the configured template directory. This is a third, independent instance of the root...

EUVD-2026-90363

Mako: Path traversal via drive-letter URI on Windows in TemplateLookup...

Mako: Path traversal via drive-letter URI on Windows in TemplateLookup

Summary On Windows, a TemplateLookup URI beginning with a drive designator e.g. C:/../../secret.txt or C:....\secret.txt bypasses the directory traversal check in Template.init, allowing reads of files outside the configured template directory. This is a third, independent instance of the root...

adoc (>=0.1.0, <=0.1.5), adr (>=0.4.0, <=0.5.0) +285 more potentially affected by CVE-2026-102991 via mako (>=1.0.1, <=1.4.1)

mako PYPI version =1.0.1, =0.1.0, =0.4.0, =0.1.0rc3, =2022.9.19, =1.1.0, =2.0.0b1, =0.0.4rc1, =0.0.0, =0.1.0.dev1, =5.2.15, =5.3.33 and more Source cves: CVE-2026-102991 Source advisory: OSV:GHSA-5639-2J2P-M4MX...

adoc (>=0.1.0, <=0.1.5), adr (>=0.4.0, <=0.5.0) +285 more potentially affected by CVE-2026-102991 +1 more via mako (>=1.0.1, <=1.4.1)

mako PYPI version =1.0.1, =0.1.0, =0.4.0, =0.1.0rc3, =2022.9.19, =1.1.0, =2.0.0b1, =0.0.4rc1, =0.0.0, =0.1.0.dev1, =5.2.15, =5.3.33 and more Source cves: CVE-2026-102991, CVE-2026-41205 Source advisory: GHSA-5639-2J2P-M4MX...

Linux Distros Unpatched Vulnerability : CVE-2026-102991

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.gettemplate in mako/lookup.py resolves template URIs with posixpath,...

mako TemplateLookup Function Unauthenticated Access

The vulnerability of the TemplateLookup.gettemplate function in the mako/lookup.py file of the Sqlalchemy mako template library in Python is related to an incorrect path name limitation for accessing restricted directories. Exploiting this vulnerability could allow an attacker to gain unauthorize...

Rocky Linux 8 [CIQ] Security Update: python3-mako (crlsa-2023_2893)

The Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20232893 advisory. mako: REDoS in Lexer class CVE-2022-40023 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that Nessus has not...

Rocky Linux 9 [CIQ] Security Update: python3-mako (crlsa-2023_2258)

The Rocky Linux 9 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20232258 advisory. python-mako: REDoS in Lexer class CVE-2022-40023 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that Nessus has...

adoc (>=0.1.0, <=0.1.5), adr (>=0.4.0, <=0.5.0) +285 more potentially affected by CVE-2026-102991 via mako (>=1.0.1, <=1.4.1)

mako PYPI version =1.0.1, =0.1.0, =0.4.0, =0.1.0rc3, =2022.9.19, =1.1.0, =2.0.0b1, =0.0.4rc1, =0.0.0, =0.1.0.dev1, =5.2.15, =5.3.33 and more Source cves: CVE-2026-102991 Source advisory: SNYK:PYTHON-MAKO-20510290...

CVE-2026-102991

Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.gettemplate in mako/lookup.py resolves template URIs with posixpath, while Template.init in mako/template.py validates them with os.path, which uses ntpath. A URI beginning with a drive designator causes ntpa...

AZL-105645 CVE-2026-102991 affecting package python-mako 1.2.4-3

Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.gettemplate in mako/lookup.py resolves template URIs with posixpath, while Template.init in mako/template.py validates them with os.path, which uses ntpath. A URI beginning with a drive designator causes ntpa...