1095 matches found
exploit-js2py
CVE-2024-28397 - الهروب من الصندوق الرملي في js2py الوصف تؤثر ثغرة CVE-2024-28397 على إصدارات js2py حتى v0.74، وهي مكتبة بايثون تتيح تنفيذ كود جافا سكريبت داخل مفسّر بايثون. يكمن الخلل في تنفيذ الطريقة disablepyimport، التي يفترض أن تمنع كود جافا سكريبت من الوصول إلى كائنات بايثون. ومع ذلك، وبسبب...
GitPython Command Execution
The vulnerability of the Python library for interacting with git repositories, GitPython, is related to the implementation or modification of arguments. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...
CLEANSTART-2026-JQ90440 joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards
Security vulnerability affects the airflow-3 package. joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards...
PT-2026-105234
Security vulnerability affects the airflow-3 package. joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards...
ROOT-APP-PYPI-CVE-2026-84382 CVE-2026-84382 in httpx2 - Patched by Root
Root has patched CVE-2026-84382 in the httpx2 package for Root:PyPI. Multiple fixed versions available...
[SECURITY] Fedora 43 Update: GitPython-3.1.62-1.fc43
GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing. It provides abstractions of git objects for easy access of repository data, a nd additionally allows you to access the git repository more directly using eith er a...
[SECURITY] Fedora 45 Update: GitPython-3.1.62-1.fc45
GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing. It provides abstractions of git objects for easy access of repository data, a nd additionally allows you to access the git repository more directly using eith er a...
DEBIAN-CVE-2026-91990
Tornado before 6.5.8 contains a memory amplification vulnerability in parsemultipartformdata that splits multipart data before validating the maxparts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing denial ...
CVE-2023-54397 Tornado before 6.3.3 HTTP Request Smuggling via Content-Length
Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain...
giskard-oss giskard-checks/v1.0.4
Evals, Red Teaming and Test Generation for Agentic Systems Modular, Lightweight, Dynamic and Async-first Docs • Website • Community !IMPORTANT Giskard v3 is a fresh rewrite designed for dynamic, multi-turn testing of AI agents. This release drops heavy dependencies for better efficiency while...
CVE-2026-90808 HKUDS nanobot ExecTool shell.py ExecTool._spawn incomplete blacklist
A vulnerability was determined in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool.guardcommand/ExecTool.spawn of the file nanobot/agent/tools/shell.py of the component ExecTool. This manipulation causes incomplete blacklist. It is possible to initiate the attack remotely. Patch name:...
Astra Linux – Vulnerability in python-py
A denial of service attack via regular expressions in the py.path.svnwc component of py also known as python-py in versions up to 1.9.0 could be exploited by attackers to trigger a compute-time denial of service attack by providing malicious input to the blame functionality...
ROOT-APP-PYPI-GHSA-93GM-QMQ6-W238 GHSA-93gm-qmq6-w238 in starlette - Patched by Root
Root has patched GHSA-93gm-qmq6-w238 in the starlette package for Root:PyPI. Multiple fixed versions available...
CLSA-2026-1789365078 TuxCare security update for cryptography (2 CVEs)
TuxCare rebuilt cryptography to address 2 CVEs. Fixed in 44.0.3.post4+tuxcare...
CVE-2026-90621 ipa-lab HackingBuddyGPT ssh_run_command.py ssh_run_command os command injection
A vulnerability was identified in ipa-lab HackingBuddyGPT up to 0.5.0. This affects the function sshruncommand of the file src/hackingBuddyGPT/extensions/sshruncommand.py. Such manipulation leads to os command injection. The attack can be launched remotely. The exploit is publicly available and...
CAPE-parsers v0.1.69
CAPE-parsers CAPE core and community parsers Configs structure CNCs: campaign: str botnet: str dgaseed: hex str version: str mutex: str useragent: str build: str cryptokey: str cryptokeytype: str algorithm. Ex: RC4, RSA public key. salsa20, xchacha20 raw: any other data goes here All CNC entries...
DEBIAN-CVE-2026-87910
When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was...
UBUNTU-CVE-2026-87910
When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was...
CVE-2026-87910 tarfile hardlink fallback ignores custom extraction filter rejection via None
When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was...
PSF-2026-40
When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was...