tinyshell

tinyshell Small PHP shell, Controlled by Python Client , connecting over protocol method features connect with direct session with no need for reverse connection . support password protection . can be binded to any file with no damage . using GET/POST request with error handling . usage the proje...

grr

GRR Rapid Response는 원격 라이브 포렌식에 중점을 둔 침해 대응 프레임워크입니다. GRR은 대상 시스템에 설치되는 파이썬 클라이언트에이전트와 클라이언트를 관리하고 통신할 수 있는 파이썬 서버 인프라로 구성되어 있습니다. 문서 GRR에 대해 더 알아보려면 문서 웹사이트를 방문해 주세요. 문의 GitHub 이슈: github.com/google/grr/issues GRR 사용자 메일링 리스트: grr-users GRR 사용자 밋업 공지는 트위터에서 팔로우하세요. 밋업 중에는 gitter 채팅방을 사용합니다. 스크린샷...

pybatfish

질문, 피드백 또는 기능 요청이 있으신가요? Slack 커뮤니티에 참여하세요! Pybatfish Pybatfish는 Batfish를 위한 Python 클라이언트입니다. Batfish란 무엇인가요? Batfish는 네트워크 장치의 구성을 분석하여 보안, 신뢰성, 규정 준수에 대한 정확성 보장을 제공하는 네트워크 검증 도구입니다. 장치 구성으로부터 네트워크 동작의 완전한 모델을 구축하고 네트워크 정책기본 제공, 사용자 정의, 모범 사례의 위반을 찾아냅니다. Batfish의 주요 사용 사례는 구성 변경을 배포 전 에 검증하는...

ASPX_WebShell_COFFLoader

COFF 로더를 사용한 ASPX 웹 셸 TrustedSec의 CSCOFFLoader를 기반으로 함 설명 이 ASPX 웹 셸은 반-대화형 Python 클라이언트를 사용하여 대상 서버에서 Beacon Object Files BOFs 를 실행할 수 있게 합니다. TrustedSec의 CSCOFFLoader에서 파생된 COFF 로더 구현을 활용합니다. 이 프로젝트는 보안 연구 및 승인된 침투 테스트용 으로만 제공됩니다. 이 프로젝트를 사용함으로써 귀하는 모든 관련 법률 및 규정을 준수하는 데 동의합니다. 사전 요구 사항 사용 전에 다...

dnspython

dnspython INTRODUCTION dnspython is a DNS toolkit for Python. It supports almost all record types. It can be used for queries, zone transfers, and dynamic updates. It supports TSIG-authenticated messages and EDNS0. dnspython provides both high- and low-level access to DNS. The high-level classes...

vt-py

vt-py これは VirusTotal 公式の Python クライアントライブラリです。このライブラリを使うと、VirusTotal REST API v3 と連携して、ワークフローを迅速かつ効率的に自動化できます。 vt-py でできること ファイルと URL のスキャン ファイル、URL、ドメインなどの情報の取得 VirusTotal Intelligence 検索の実行 LiveHunt ルールセットと通知の管理 Retrohunt ジョブの起動とマッチ結果の取得 VirusTotal Graphs の操作 その他多数 ... vt-py の使用方法の詳細については、ドキュメン...

CVE-2026-84378

HTTPX2 is a next generation HTTP client for Python. From 2.5.0 until 2.10.0, the HTTPX2 Server-Sent Events parser in src/httpx2/httpx2/sse.py repeatedly copies and rescans buffered text in SSELineDecoder.decode when an attacker-controlled or compromised SSE endpoint splits one unterminated line...

CVE-2026-84379

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.renderheaders in src/httpx2/httpx2/multipart.py directly interpolates attacker-controlled contenttype values and custom headers from the files= three-element filename, content, contenttype tuple and the files=...

CVE-2026-84380 HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request.prepare in src/httpx2/httpx2/models.py can add a body-derived Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header because its setdefault processing checks each default head...

CVE-2026-84380

HTTPX2 , a next-generation HTTP client for Python, contains a request-smuggling vulnerability prior to version 2.11.0 . The flaw resides in Request._prepare() in _models.py, where its setdefault() logic checks Content-Length and Transfer-Encoding headers independently instead of treating them as ...

CVE-2026-84378

HTTPX2 , a next-generation HTTP client for Python, is affected by a quadratic CPU denial-of-service vulnerability in its Server-Sent Events (SSE) parser. Versions from 2.5.0 through 2.10.0 are impacted. The root cause lies in _SSELineDecoder.decode() in src/httpx2/httpx2/_sse.py, which repeatedly...

TencentOS Server 3: python3.12-urllib3 (TSSA-2026:0623)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0623 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

CVE-2026-50271 dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS

Datadog dd-trace-py is the Datadog Python APM client. Prior to 4.8.2, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES limits on the extract path. A remote, unauthenticated...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection through PythonConventionService.RemoveInvalidDescriptionCharacters and KiotaBuilder enum description handling in src/Kiota.Builder/Writers/Python and src/Kiota.Builder/KiotaBuilder.cs. An attacker can execute...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection through PythonConventionService.RemoveInvalidDescriptionCharacters and KiotaBuilder enum description handling in src/Kiota.Builder/Writers/Python and src/Kiota.Builder/KiotaBuilder.cs. An attacker can execute...

PT-2026-59067

Summary AWS Encryption SDK ESDK for Python is a client-side encryption library. An issue exists where, under certain circumstances, a specific cryptographic algorithm downgrade in the caching layer might allow an authenticated local threat actor to bypass key commitment policy enforcement via a...

PYSEC-2026-2323

Zeep is a Python SOAP client. From 4.0.0 before 4.3.3, Settings.forbidexternal is defined but not enforced when parsing WSDL or XSD documents, allowing transitive xsd:import, xsd:include, wsdl:import, and lxml entity or DTD references to fetch attacker-chosen HTTP or HTTPS URLs. This issue is fix...

PYSEC-2026-2000 Universal Tool Calling Protocol (UTCP) client library for Python vulnerable to Trust Boundary Violation through Manual JSON specification

The vulnerability arises when a client fetches a tools’ JSON specification, known as a Manual, from a remote Manual Endpoint. While a provider may initially serve a benign manual e.g., one defining an HTTP tool call, earning the clients’ trust, a malicious provider can later change the manual to...

Apache Pulsar Disabled Certificate Validation for OAuth Client Credential Requests makes C++/Python Clients vulnerable to MITM attack

The Apache Pulsar C++ Client does not verify peer TLS certificates when making HTTPS calls for the OAuth2.0 Client Credential Flow, even when tlsAllowInsecureConnection is disabled via configuration. This vulnerability allows an attacker to perform a man in the middle attack and intercept and/or...

PYSEC-2026-901 Apache Pulsar Disabled Certificate Validation for OAuth Client Credential Requests makes C++/Python Clients vulnerable to MITM attack

The Apache Pulsar C++ Client does not verify peer TLS certificates when making HTTPS calls for the OAuth2.0 Client Credential Flow, even when tlsAllowInsecureConnection is disabled via configuration. This vulnerability allows an attacker to perform a man in the middle attack and intercept and/or...