hexora

hexora Hexora 是一款静态分析工具，旨在检测 Python 代码中的恶意和有害模式。它结合了基于规则的静态分析引擎与机器学习模型，对整个源文件进行评分，将其分类为恶意或良性。 它可以用于： 审计项目依赖，以发现潜在的供应链攻击 检测在 Pastebin、GitHub 或开放目录等平台上发现的恶意脚本 分析过去安全事件中的 IoC 文件 审计上传到 PyPi 的新包 示例 如需输出示例，请参见 docs/examples.md 文件。 安装 使用 Python 需要 Python 3.9+。 root@kitploit: pip install hexora 使用 uv：...

CVE-2025-0868

Informe de Proyecto de Pruebas de Penetración: Explotación de CVE-2025-0868 DocsGPT RCE mediante Eval JSON 1. Introducción El 20 de febrero de 2025 se reveló una vulnerabilidad crítica de ejecución remota de código RCE CVE-2025-0868 en la biblioteca de código abierto DocsGPT, causada por el uso...

w3af

w3af - Web Application Attack and Audit Framework w3af is an open source web application security scanner which helps developers and penetration testers identify and exploit vulnerabilities in their web applications. The scanner is able to identify 200+ vulnerabilities, including Cross-Site...

CVE-2025-3248

CVE-2025-3248: Langflow Ejecución Remota de Código RCE Sin Autenticación Este repositorio contiene dos scripts de Python: LangflowCheck.py: Un escáner que verifica instancias de Langflow AI vulnerables a CVE-2025-3248. exploit.py: Un exploit funcional de reverse shell para objetivos Langflow...

CVE-2025-3248

CVE-2025-3248 – Ejecutar código Python arbitrario en un servidor Langflow vulnerable. Descubierto por: Naveen Sunkavally, Horizon3.ai Estado: Divulgación pública Fecha de reporte: 2025-04-07 ID de CVE: CVE-2025-3248 🧾 Captura de pantalla 🧩 Resumen Se ha descubierto una falla crítica en Langflow q...

CVE-2026-33017-PoC-Reverse-Shell

CVE-2026-33017 - Langflow Unauthenticated RCE Exploit 📋 Overview CVE-2026-33017 is an unauthenticated Remote Code Execution RCE vulnerability in Langflow versions This exploit is for educational and authorized testing purposes only. Unauthorized access to computer systems is illegal. Use this too...

CVE-2026-33017-Langflow-RCE

CVE-2026-33017 - Langflow RCE 漏洞 xpl0ited by infrar3d 本概念验证利用针对 Langflow 1.9.0 之前版本中的一个严重远程代码执行（RCE）漏洞。该漏洞允许未经身份验证的攻击者通过向流程构建 API 端点注入恶意 Python 代码来执行任意系统命令。漏洞存在于 /api/v1/buildpublictmp/flowid/flow 端点中，该端点未能正确清理组件模板中 code 字段的用户提供代码。 使用方法： root@kitploit: python3 CVE-2026-33017.py --help usage:...

Wazuh - Unsafe Deserialization Remote Code Execution

A critical Remote Code Execution RCE vulnerability exists in Wazuh server versions = 4.4.0 and = 4.4.0 and 4.9.1. The vulnerability occurs due to unsafe deserialization in the wazuh-manager package, specifically in the DistributedAPI where parameters are serialized as JSON and deserialized using...

CVE-2025-3248

CVE-2025-3248 漏洞利用工具文档 简介 本工具用于利用 CVE-2025-3248 漏洞（基于Python的代码注入漏洞），通过构造恶意payload实现目标服务器的远程命令执行（RCE）。该漏洞存在于某Web应用的API接口中，攻击者可利用未验证的代码执行点注入任意Python代码。 重要提示： 本工具仅用于授权安全测试，未经授权的渗透测试可能违反法律。请确保您拥有目标系统的明确授权。 功能特点 ✅ 通过/api/v1/validate/code接口注入恶意Python代码 ✅ 支持执行任意系统命令（如whoami、ls等） ✅ 自定义超时时间（默认10秒） ✅...

CVE-2026-86169

Axolotl (through 0.18.0 ), a Python-based LLM fine-tuning framework, contains a remote code execution vulnerability in its multipack patch code path. The root cause is that the trust_remote_code parameter defaults to None instead of False, effectively bypassing the security guard. An attacker who...

VulnCheck KEV: CVE-2026-0768

Langflow code Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the code...

EUVD-2026-53580

PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code...

Security Bulletin: Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling

Summary Langflow OSS supports Agentic Assistant generated components and user-supplied custom Python components for workflow development. Weaknesses in code security scanning, runtime validation, custom component execution paths, and trusted code enforcement could allow authenticated users to...

Exploit for Eval Injection in Langflow

CVE-2026-33017 Langflow RCE ★ CVE-2026-33017 Langflow Remote...

CVE-2026-18287

Aeon loadtimeseriessegmentationbenchmark Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aeon. User interaction is required to exploit this vulnerability in that the target must visit a malicious...

CVE-2026-34789

A flaw was found in FreeCAD, a 3D parametric modeler. A remote attacker could exploit this vulnerability by tricking a user into opening a specially crafted FCStd document. When the document is restored, attacker-controlled module attributes are processed, leading to the execution of arbitrary...

CVE-2026-34398

A flaw was found in FreeCAD, a 3D parametric modeler. The BIM Project Manager's Load Template function does not properly validate certain properties within a project template. This vulnerability allows a remote attacker to embed malicious Python code into a specially crafted BIM project template...

Linux Distros Unpatched Vulnerability : CVE-2026-59894

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in...

DEBIAN-CVE-2026-34399

FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, FreeCAD's BIM Workbench contains an eval call on untrusted data from SVG template files. When a user creates a TechDraw page from a malicious SVG template, arbitrary Python code executes. The vulnerable...

DEBIAN-CVE-2026-34398

FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, src/Mod/BIM/bimcommands/BimProjectManager.py in the BIM Project Manager Load Template flow passes attacker-controlled FCStd Meta property values for wpposition, wpu, wpv, and wpaxis directly to eval,...