hexora

hexora Hexora — это инструмент статического анализа, предназначенный для обнаружения вредоносных и опасных шаблонов в коде Python. Он сочетает в себе механизм статического анализа на основе правил с моделью машинного обучения, которая оценивает целые исходные файлы для классификации их как...

CVE-2025-0868

Отчет по проекту тестирования на проникновение: эксплуатация CVE-2025-0868 DocsGPT RCE через JSON Eval 1. Введение Критическая уязвимость удаленного выполнения кода RCE CVE-2025-0868 была раскрыта 20 февраля 2025 года в библиотеке DocsGPT с открытым исходным кодом, вызванная небезопасным...

w3af

w3af - Web Application Attack and Audit Framework w3af is an open source web application security scanner which helps developers and penetration testers identify and exploit vulnerabilities in their web applications. The scanner is able to identify 200+ vulnerabilities, including Cross-Site...

CVE-2025-3248

CVE-2025-3248: Langflow 인증되지 않은 원격 코드 실행 RCE 이 저장소에는 두 개의 Python 스크립트가 포함되어 있습니다: LangflowCheck.py: CVE-2025-3248에 취약한 Langflow AI 인스턴스를 확인하는 스캐너입니다. exploit.py: 취약한 Langflow 대상에 대한 작동하는 리버스 셸 익스플로잇입니다. 요약 CVE-2025-3248 은 Langflow AI의 치명적인 취약점으로, 인증되지 않은 공격자 가 /api/v1/validate/code에 조작된 페이로드를 전송하...

CVE-2025-3248

CVE-2025-3248 – Выполнение произвольного кода Python на уязвимом сервере Langflow. Обнаружено: Naveen Sunkavally, Horizon3.ai Статус: Публичное раскрытие Дата сообщения: 2025-04-07 ID CVE: CVE-2025-3248 🧾 Скриншот 🧩 Краткое описание Критическая уязвимость была обнаружена в Langflow, которая...

CVE-2026-33017-PoC-Reverse-Shell

CVE-2026-33017 - Langflow 인증 우회 RCE 익스플로잇 📋 개요 CVE-2026-33017 은 Langflow 버전 1.8.2 이하에서 발생하는 인증 우회 원격 코드 실행RCE 취약점입니다. 이 취약점은 /api/v1/buildpublictmp/flowid/flow 엔드포인트에 존재하며, 적절한 인증이 없어 공격자가 그래프 컴파일 과정에서 임의의 Python 코드를 실행할 수 있습니다. ⚠️ 면책 조항 이 익스플로잇은 교육 및 승인된 테스트 목적으로만 사용됩니다. 승인되지 않은 컴퓨터 시스템 접근은 불법입니다...

CVE-2026-33017-Langflow-RCE

CVE-2026-33017 - Langflow RCE 취약점 xpl0ited by infrar3d 이 개념 증명 익스플로잇은 1.9.0 이전 버전의 Langflow에서 발견된 중요한 원격 코드 실행RCE 취약점을 대상으로 합니다. 이 취약점은 인증되지 않은 공격자가 플로우 빌딩 API 엔드포인트를 통해 악성 Python 코드를 주입하여 임의의 시스템 명령을 실행할 수 있게 합니다. 취약점은 /api/v1/buildpublictmp/flowid/flow 엔드포인트에 존재하며, 이 엔드포인트는 컴포넌트 템플릿의 코드 필드에서 사용...

Wazuh - Unsafe Deserialization Remote Code Execution

A critical Remote Code Execution RCE vulnerability exists in Wazuh server versions = 4.4.0 and = 4.4.0 and 4.9.1. The vulnerability occurs due to unsafe deserialization in the wazuh-manager package, specifically in the DistributedAPI where parameters are serialized as JSON and deserialized using...

CVE-2025-3248

CVE-2025-3248 Документация инструмента эксплуатации уязвимости Введение Данный инструмент предназначен для использования уязвимости CVE-2025-3248 уязвимость внедрения кода на Python путем создания вредоносной полезной нагрузки для удаленного выполнения команд RCE на целевой сервере. Уязвимость...

CVE-2026-86169

Axolotl (through 0.18.0 ), a Python-based LLM fine-tuning framework, contains a remote code execution vulnerability in its multipack patch code path. The root cause is that the trust_remote_code parameter defaults to None instead of False, effectively bypassing the security guard. An attacker who...

VulnCheck KEV: CVE-2026-0768

Langflow code Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the code...

EUVD-2026-53580

PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code...

Security Bulletin: Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling

Summary Langflow OSS supports Agentic Assistant generated components and user-supplied custom Python components for workflow development. Weaknesses in code security scanning, runtime validation, custom component execution paths, and trusted code enforcement could allow authenticated users to...

Exploit for Eval Injection in Langflow

CVE-2026-33017 Langflow RCE ★ CVE-2026-33017 Langflow Remote...

CVE-2026-18287

Aeon loadtimeseriessegmentationbenchmark Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aeon. User interaction is required to exploit this vulnerability in that the target must visit a malicious...

CVE-2026-34789

A flaw was found in FreeCAD, a 3D parametric modeler. A remote attacker could exploit this vulnerability by tricking a user into opening a specially crafted FCStd document. When the document is restored, attacker-controlled module attributes are processed, leading to the execution of arbitrary...

CVE-2026-34398

A flaw was found in FreeCAD, a 3D parametric modeler. The BIM Project Manager's Load Template function does not properly validate certain properties within a project template. This vulnerability allows a remote attacker to embed malicious Python code into a specially crafted BIM project template...

Linux Distros Unpatched Vulnerability : CVE-2026-59894

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in...

DEBIAN-CVE-2026-34399

FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, FreeCAD's BIM Workbench contains an eval call on untrusted data from SVG template files. When a user creates a TechDraw page from a malicious SVG template, arbitrary Python code executes. The vulnerable...

DEBIAN-CVE-2026-34398

FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, src/Mod/BIM/bimcommands/BimProjectManager.py in the BIM Project Manager Load Template flow passes attacker-controlled FCStd Meta property values for wpposition, wpu, wpv, and wpaxis directly to eval,...