com.webank.wedatasphere.dss:dolphinscheduler-prod-metrics (>=1.1.0, <=1.2.2), org.apache.dolphinscheduler:dolphinscheduler-dist (>=2.0.0-alpha, <=3.4.2) +2 more potentially affected by CVE-2026-81569 via org.apache.dolphinscheduler:dolphinscheduler-api (>=1.3.9, <=3.4.2)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =1.3.9, =1.1.0, =2.0.0-alpha, =2.0.2, =1.3.9, =3.0.6 Source cves: CVE-2026-81569 Source advisory: MEND:CVE-2026-81569...

Stage Cache (Python)

Verified local stage cache with TTL expiration and interrupted download resume !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import from core.payloadgeneration.prestage.stagecachecontext import resolvestagecachecontext class ModulePrestage: PRESTAGEID =...

Stage Verify (Python)

Verify staged artifact SHA256 before callback uses stagecache when present !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "stageverify" info = "name": "Stage Verify Python", "description": "Verify staged artifact...

Telemetry Buffer (Python)

Persist bootstrap errors locally and flush them after the first C2 poll !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import from core.payloadgeneration.prestage.telemetrycontext import resolvetelemetrycontext class ModulePrestage: PRESTAGEID =...

vantic-breach

Vantic Breach Every wall has a way in. A full-suite author...

sqli-xss-detection

How to run it Open a terminal in the project root: sqlixssdete...

Official MCP Python SDK Flaw Can Let Malicious Servers Steal OAuth Credentials

A malicious MCP server could trick an application built on the official MCP Python SDK into handing over the OAuth credentials it uses to log in to a real service, the SDK's maintainers said in a security advisory. Affected versions sent the client secret, the authorization code, and the PKCE pro...

[SECURITY] Fedora 44 Update: python-streamlink-8.4.0-2.fc44

Streamlink is a command-line utility that pipes video streams from various services into a video player, such as VLC. The main purpose of Streamlink is to allow the user to avoid buggy and CPU heavy flash plugins but still be able to enjoy various streamed content. There is also an API available...

[SECURITY] Fedora 44 Update: python-urllib3-2.8.0-1.fc44

urllib3 is a powerful, user-friendly HTTP client for Python. urllib3 brings many critical features that are missing from the Python standard libraries: =E2=80=A2 Thread safety. =E2=80=A2 Connection pooling. =E2=80=A2 Client-side SSL/TLS verification. =E2=80=A2 File uploads with multipart encoding...

CLEANSTART-2026-QT13587 Tornado is a Python web framework and asynchronous networking library

CVE-2026-82397 affects multiple packages. Tornado is a Python web framework and asynchronous networking library. See references for individual vulnerability details...

CLEANSTART-2026-VX89697 sqlparse is a non-validating SQL parser module for Python

CVE-2026-59894 affects multiple packages. sqlparse is a non-validating SQL parser module for Python. See references for individual vulnerability details...

CLEANSTART-2026-HH21892 sqlparse is a non-validating SQL parser module for Python

CVE-2026-71491 affects multiple packages. sqlparse is a non-validating SQL parser module for Python. See references for individual vulnerability details...

CLEANSTART-2026-VD54989 sqlparse is a non-validating SQL parser module for Python

CVE-2026-59893 affects multiple packages. sqlparse is a non-validating SQL parser module for Python. See references for individual vulnerability details...

CLEANSTART-2026-XN67293 sqlparse is a non-validating SQL parser module for Python

CVE-2026-54284 affects multiple packages. sqlparse is a non-validating SQL parser module for Python. See references for individual vulnerability details...

CLEANSTART-2026-SC86417 setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages

CVE-2025-47273 affects multiple packages. setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. See references for individual vulnerability details...

CLEANSTART-2026-IT04262 Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings

Security vulnerability affects the grafana-alloy package. Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings...

CLEANSTART-2026-LK90655 Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node

Security vulnerability affects the grafana-alloy package. Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node...

CLEANSTART-2026-WG08246 sqlparse is a non-validating SQL parser module for Python

Security vulnerability affects the airflow-3 package. sqlparse is a non-validating SQL parser module for Python...

CLEANSTART-2026-LF94693 AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework

Security vulnerability affects the airflow-3 package. AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework...

CLEANSTART-2026-CW84944 Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings

Security vulnerability affects the spark-sc212-jdk17-py311 package. Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings...