grr

GRR Rapid Response — это платформа реагирования на инциденты, ориентированная на удаленную живую криминалистику. GRR — это клиент на Python агент, который устанавливается на целевые системы, и серверная инфраструктура на Python, которая может управлять клиентами и взаимодействовать с ними...

ASPX_WebShell_COFFLoader

ASPX Web Shell с загрузчиком COFF Основано на TrustedSec's CSCOFFLoader Описание Эта ASPX веб-оболочка позволяет выполнять Beacon Object Files BOFs на целевом сервере с помощью полуинтерактивного Python-клиента. Она использует реализацию загрузчика COFF, полученную из TrustedSec’s CSCOFFLoader...

pybatfish

Des questions, des commentaires ou des demandes de fonctionnalités ? Rejoignez notre communauté surSlack! Pybatfish Pybatfish est un client Python pour Batfish. Qu'est-ce que Batfish ? Batfish est un outil de validation réseau qui fournit des garanties de correction pour la sécurité, la fiabilité...

tinyshell

tinyshell Небольшая PHP оболочка, управляемая Python клиентом, подключающимся через метод протокола возможности подключение с прямой сессией без необходимости обратного соединения. поддержка защиты паролем. может быть привязан к любому файлу без повреждения. использование GET/POST запросов с...

CVE-2026-15911

Confluent Kafka Python client's HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive information due to improper TLS certificate validation...

EUVD-2026-91008

Confluent Kafka Python client's HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive information due to improper TLS certificate validation...

CVE-2026-15911

The Confluent Kafka Python client contains a vulnerability in its HashiCorp Vault KMS integration due to a failure to properly validate Transport Layer Security (TLS) certificates by default. A remote attacker capable of intercepting network traffic could exploit this flaw to intercept and decryp...

dnspython

dnspython INTRODUCTION dnspython is a DNS toolkit for Python. It supports almost all record types. It can be used for queries, zone transfers, and dynamic updates. It supports TSIG-authenticated messages and EDNS0. dnspython provides both high- and low-level access to DNS. The high-level classes...

vt-py

vt-py Это официальная клиентская библиотека Python для VirusTotal. С её помощью вы можете взаимодействовать с VirusTotal REST API v3 и быстро и эффективно автоматизировать свой рабочий процесс. Что можно делать с vt-py Сканировать файлы и URL-адреса Получать информацию о файлах, URL-адресах,...

CVE-2026-84378

HTTPX2 is a next generation HTTP client for Python. From 2.5.0 until 2.10.0, the HTTPX2 Server-Sent Events parser in src/httpx2/httpx2/sse.py repeatedly copies and rescans buffered text in SSELineDecoder.decode when an attacker-controlled or compromised SSE endpoint splits one unterminated line...

CVE-2026-84379

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.renderheaders in src/httpx2/httpx2/multipart.py directly interpolates attacker-controlled contenttype values and custom headers from the files= three-element filename, content, contenttype tuple and the files=...

CVE-2026-84380 HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request.prepare in src/httpx2/httpx2/models.py can add a body-derived Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header because its setdefault processing checks each default head...

CVE-2026-84380

HTTPX2 , a next-generation HTTP client for Python, contains a request-smuggling vulnerability prior to version 2.11.0 . The flaw resides in Request._prepare() in _models.py, where its setdefault() logic checks Content-Length and Transfer-Encoding headers independently instead of treating them as ...

CVE-2026-84378

HTTPX2 , a next-generation HTTP client for Python, is affected by a quadratic CPU denial-of-service vulnerability in its Server-Sent Events (SSE) parser. Versions from 2.5.0 through 2.10.0 are impacted. The root cause lies in _SSELineDecoder.decode() in src/httpx2/httpx2/_sse.py, which repeatedly...

TencentOS Server 3: python3.12-urllib3 (TSSA-2026:0623)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0623 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

CVE-2026-50271 dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS

Datadog dd-trace-py is the Datadog Python APM client. Prior to 4.8.2, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES limits on the extract path. A remote, unauthenticated...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection through PythonConventionService.RemoveInvalidDescriptionCharacters and KiotaBuilder enum description handling in src/Kiota.Builder/Writers/Python and src/Kiota.Builder/KiotaBuilder.cs. An attacker can execute...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection through PythonConventionService.RemoveInvalidDescriptionCharacters and KiotaBuilder enum description handling in src/Kiota.Builder/Writers/Python and src/Kiota.Builder/KiotaBuilder.cs. An attacker can execute...

PT-2026-59067

Summary AWS Encryption SDK ESDK for Python is a client-side encryption library. An issue exists where, under certain circumstances, a specific cryptographic algorithm downgrade in the caching layer might allow an authenticated local threat actor to bypass key commitment policy enforcement via a...

PYSEC-2026-2323

Zeep is a Python SOAP client. From 4.0.0 before 4.3.3, Settings.forbidexternal is defined but not enforced when parsing WSDL or XSD documents, allowing transitive xsd:import, xsd:include, wsdl:import, and lxml entity or DTD references to fetch attacker-chosen HTTP or HTTPS URLs. This issue is fix...