mimikatz

mimikatz mimikatz is a tool I've made to learn C and make somes experiments with Windows security. It's now well known to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory. mimikatz can also perform pass-the-hash, pass-the-ticket or build Golden tickets. .. mimikatz 2....

CVE-2024-3400

CVE-2024-3400 import os,base64,time systempth = "/usr/lib/python3.6/site-packages/system.pth" with opensystempth,'wb' as f: f.writeb'''import...

Malicious code in security-research-startup-snapshot-810764b303 (PyPI)

Source: kam193 c7f807a5943ac03cda3bdddc675ad3192d210e1f0ba1300959feff5d1d29c915 The package is most likely a reconnaissance of a shared infrastructure, collecting potentially sensitive data from cloud endpoints, activated via a PTH file on every Python loading. Collected data are stored in a loca...

Malicious code in research-probe-6150c1c915 (PyPI)

Source: kam193 a646eaf4fe72ba013abc53d52c0bf017a9c4f3bfc54a8c358f9f246d3ac41945 The package is most likely a reconnaissance of a shared infrastructure, collecting potentially sensitive data from cloud endpoints, activated via a PTH file on every Python loading. Collected data are stored in a loca...

pth-toolkit

pth-toolkit A modified version of the passing-the-hash tool collection https://code.google.com/p/passing-the-hash/ designed to be portable and work straight out of the box even on the most 'bare bones' systems The master branch is compiled for amd64, the final goal will be to cross compile these...

CVE-2026-109360 MONAI 0.4.0 before 1.6.1 RCE via SENet Pretrained Weights Over Plaintext HTTP

MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over plaintext HTTP. Attackers can substitute a crafted .pth file that loadstatedictfromurl unpickles without weightsonly=True,...

CVE-2026-109360: Deserialization of Untrusted Data

MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over plaintext HTTP. Attackers can substitute a crafted .pth file that loadstatedictfromurl unpickles without weightsonly=True,...

CVE-2026-105314

Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter...

CVE-2026-105314

Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter...

CVE-2026-105314

Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter...

CVE-2026-105314

Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter...

EUVD-2026-92275

Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter...

CVE-2026-105314: Path Traversal: '../filedir'

Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter...

PT-2026-104748

Name of the Vulnerable Software and Affected Versions Papermerge version 3.5.3 Description A standard user can achieve remote code execution through a directory traversal flaw in the '/api/documents/upload' endpoint. This allows an attacker to write a Python .pth file into the site-packages...

MAL-2026-16141 Malicious code in platform-telemetry-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7464733f1d7353ae3aa3c9da2c60116c92298bfd84c94a6cba4e5f423cb0a0eb The package contains PTH file triggering the loader on every Python initialization. The loader tries to download next stage payload stored in chunks in DNS...

Malicious code in platform-telemetry-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7464733f1d7353ae3aa3c9da2c60116c92298bfd84c94a6cba4e5f423cb0a0eb The package contains PTH file triggering the loader on every Python initialization. The loader tries to download next stage payload stored in chunks in DNS...

MAL-2026-16133 Malicious code in langgrap (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b11e221d911cf4904a1508f284da0ac0eb17a88e91dadb6dc60ef3bc5d547380 Package name langgrap is a one-character deletion of langgraph, and init.py re-exports from langgraph import so imports appear to succeed. The...

Malicious code in langgrap (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b11e221d911cf4904a1508f284da0ac0eb17a88e91dadb6dc60ef3bc5d547380 Package name langgrap is a one-character deletion of langgraph, and init.py re-exports from langgraph import so imports appear to succeed. The...

Malicious code in transfomers (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df75802d76ea42dd9a4e543e30565723bfaed892475cbeaca7ef561a67c1f0b3 Package name typosquats the popular transformers library. The distribution installs a .pth file into site-packages, which the Python interpreter...

MAL-2026-16136 Malicious code in transfomers (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df75802d76ea42dd9a4e543e30565723bfaed892475cbeaca7ef561a67c1f0b3 Package name typosquats the popular transformers library. The distribution installs a .pth file into site-packages, which the Python interpreter...