w3af

w3af - Web Application Attack and Audit Framework w3af is an open source web application security scanner which helps developers and penetration testers identify and exploit vulnerabilities in their web applications. The scanner is able to identify 200+ vulnerabilities, including Cross-Site...

CVE-2025-0868

प्रवेश परीक्षण परियोजना रिपोर्ट: CVE-2025-0868 का शोषण JSON Eval के माध्यम से DocsGPT RCE 1. परिचय 20 फरवरी 2025 को ओपन-सोर्स DocsGPT लाइब्रेरी में एक गंभीर रिमोट कोड निष्पादन RCE दोष CVE-2025-0868 का खुलासा किया गया था, जो JSON पेलोड को पार्स करते समय eval के असुरक्षित उपयोग के कारण हुआ। मुख्य...

CVE-2026-33017-Langflow-RCE

CVE-2026-33017 - Langflow RCE भेद्यता द्वारा शोषित infrar3d यह प्रूफ-ऑफ-कॉन्सेप्ट एक्सप्लॉइट Langflow के 1.9.0 से पहले के संस्करणों में एक गंभीर रिमोट कोड निष्पादन RCE भेद्यता को लक्षित करता है। यह भेद्यता अप्रमाणित हमलावरों को फ्लो बिल्डिंग API एंडपॉइंट के माध्यम से दुर्भावनापूर्ण Python कोड...

CVE-2025-3248

CVE-2025-3248 – Выполнение произвольного кода Python на уязвимом сервере Langflow. Обнаружено: Naveen Sunkavally, Horizon3.ai Статус: Публичное раскрытие Дата сообщения: 2025-04-07 ID CVE: CVE-2025-3248 🧾 Скриншот 🧩 Краткое описание Критическая уязвимость была обнаружена в Langflow, которая...

hexora

hexora Hexora è uno strumento di analisi statica progettato per rilevare pattern dannosi e nocivi nel codice Python. Combina un motore di analisi statica basato su regole con un modello di machine learning che assegna un punteggio ai file sorgente per classificarli come dannosi o benigni. Può...

CVE-2025-3248

CVE-2025-3248 Exploit-Tool-Dokumentation Einleitung Dieses Tool dient der Ausnutzung der Schwachstelle CVE-2025-3248 eine Python-basierte Code-Injection-Sicherheitslücke, um durch die Konstruktion eines bösartigen Payloads eine Remote-Codeausführung RCE auf dem Zielserver zu erreichen. Die...

EUVD-2026-53580

PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code...

CVE-2025-3248

CVE-2025-3248: Langflow Nicht authentifizierte Remote-Code-Ausführung RCE Dieses Repository enthält zwei Python-Skripte: LangflowCheck.py: Ein Scanner, der nach Langflow-AI-Instanzen sucht, die anfällig für CVE-2025-3248 sind. exploit.py: Ein funktionierender Reverse-Shell-Exploit für verwundbare...

Wazuh - Unsafe Deserialization Remote Code Execution

A critical Remote Code Execution RCE vulnerability exists in Wazuh server versions = 4.4.0 and = 4.4.0 and 4.9.1. The vulnerability occurs due to unsafe deserialization in the wazuh-manager package, specifically in the DistributedAPI where parameters are serialized as JSON and deserialized using...

Security Bulletin: Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling

Summary Langflow OSS supports Agentic Assistant generated components and user-supplied custom Python components for workflow development. Weaknesses in code security scanning, runtime validation, custom component execution paths, and trusted code enforcement could allow authenticated users to...

CVE-2026-18287

Aeon loadtimeseriessegmentationbenchmark Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aeon. User interaction is required to exploit this vulnerability in that the target must visit a malicious...

CVE-2026-34789

A flaw was found in FreeCAD, a 3D parametric modeler. A remote attacker could exploit this vulnerability by tricking a user into opening a specially crafted FCStd document. When the document is restored, attacker-controlled module attributes are processed, leading to the execution of arbitrary...

CVE-2026-34398

A flaw was found in FreeCAD, a 3D parametric modeler. The BIM Project Manager's Load Template function does not properly validate certain properties within a project template. This vulnerability allows a remote attacker to embed malicious Python code into a specially crafted BIM project template...

Linux Distros Unpatched Vulnerability : CVE-2026-59894

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in...

DEBIAN-CVE-2026-34399

FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, FreeCAD's BIM Workbench contains an eval call on untrusted data from SVG template files. When a user creates a TechDraw page from a malicious SVG template, arbitrary Python code executes. The vulnerable...

DEBIAN-CVE-2026-34398

FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, src/Mod/BIM/bimcommands/BimProjectManager.py in the BIM Project Manager Load Template flow passes attacker-controlled FCStd Meta property values for wpposition, wpu, wpv, and wpaxis directly to eval,...

CVE-2026-73485

Flowise before version 3.1.3 contains a code injection vulnerability in the Airtable Agent node that lets unauthenticated attackers bypass the pythonCodeValidator blocklist via obfuscation and inject malicious Python code. The injected code can run in an unsandboxed pyodide environment with full ...

EUVD-2026-57800

Flowise before 3.1.3 contains a sandbox escape vulnerability in pythonCodeValidator.ts that fails to block native Pandas DataFrame methods like tocsv, tojson, pipe, and query. Authenticated attackers can exploit this to exfiltrate uploaded CSV data or write arbitrary files to the server filesyste...

DEBIAN-CVE-2026-73233

FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the FEM Displacement Constraint task dialog in src/Mod/Fem/Gui/TaskFemConstraintDisplacement.cpp passes the xDisplacementFormula, yDisplacementFormula, and zDisplacementFormula fields of a...

CVE-2026-73233

FreeCAD CVE-2026-73233 affects the FEM Displacement Constraint dialog prior to version 1.1.2. The escaping helper fails to neutralize backslashes, letting crafted x/y/zDisplacementFormula text terminate the generated Python string and execute arbitrary Python code with the FreeCAD process privile...