omnistrike

OmniStrike v2 Modular pentest framework for Termux. Pure Pyth...

CVE-2026-79310

A flaw was found in webpy. This vulnerability, known as Server-Side Template Injection SSTI, allows a remote attacker to execute malicious code on the server. By exploiting how the application precompiles and renders templates, an attacker can bypass security measures and run arbitrary Python cod...

Dnsplit

Dnsplit - Sub-Domain Enumeration Tool 🕵️‍♂️ Dnsplit is a Python-based tool designed for efficiently discovering sub-domains. 🚀 It's a project that's close to my heart as I'm still relatively new to both coding and the ethical hacking field. Despite my beginner status, I've put in the effort to...

HttpStrike

HttpStrike A fast DDoS script written in Python, it will send a lot of get requests if you increase the requests however you please...

MGASA-2026-0452 Updated python-webob packages fix a security vulnerability

Location header normalization during redirect leads to open redirect - again...

MGASA-2026-0450 Updated python-gitpython packages fix security vulnerabilities

Denial of Service via catastrophic backtracking ReDoS in Actor.nameemailregex — commit author/committer field parsing Repository content can impersonate the git directory, leading to arbitrary code execution Residual of GHSA-hmq2-w58f-27jc: the fix validates the .gitmodules name but the sibling...

Updated python-webob packages fix a security vulnerability

Location header normalization during redirect leads to open redirect - again...

Updated python-gitpython packages fix security vulnerabilities

Denial of Service via catastrophic backtracking ReDoS in Actor.nameemailregex — commit author/committer field parsing Repository content can impersonate the git directory, leading to arbitrary code execution Residual of GHSA-hmq2-w58f-27jc: the fix validates the .gitmodules name but the sibling...

MAL-2026-17179 Malicious code in wallet-connect-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4135dd91724bdca6fc36f3a49906d219acc67afde7802cb1bd114d128984ca3d The package's postinstall hook runs node./loader.js, which base64-decodes an 8 KB embedded blob, XOR-decrypts it with a hardcoded 32-byte key, and...

Malicious code in wallet-connect-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4135dd91724bdca6fc36f3a49906d219acc67afde7802cb1bd114d128984ca3d The package's postinstall hook runs node./loader.js, which base64-decodes an 8 KB embedded blob, XOR-decrypts it with a hardcoded 32-byte key, and...

Langflow AI - Unauthenticated Remote Code Execution

Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint.A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code. id: CVE-2025-3248 info: name: Langflow AI - Unauthenticated Remote Code Execution author: nvn172...

OESA-2026-4080 python-jupyter-server security update

The backend for Jupyter web applications Security Fixes: Jupyter Server is the backend for Jupyter web applications. In jupyterserver versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in LoginFormHandler.redirectsafe, which allows redirects to arbitra...

OESA-2026-4066 python-jwcrypto security update

Implements JWK, JWS, JWE specifications with python-cryptography Security Fixes: A flaw was found in jwcrypto. The JWK.importkey function validates the keyops JWK member for duplicate values using an algorithm with On^2 time complexity, and the length of keyops is not bounded. A remote,...

OESA-2026-4064 python-black security update

The uncompromising code formatter Security Fixes: Black is the uncompromising Python code formatter. Starting in version 24.3.0 and prior to version 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was...

OESA-2026-4052 python-Keras security update

Keras is a high-level neural networks API for Python. Security Fixes: A vulnerability in keras-team/keras versions = 3.15.0 allows for a denial of service DoS attack when loading malicious .keras model files via the keras.models.loadmodel function. The H5IOStore.getitem method in...

OESA-2026-4009 python3 security update

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C...

EUVD-2026-86479

IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL. The generatecertificate runs a Python script saved as a certificate file. The pyhton script attempts to retrieve code from a hardcoded http URL that is obfuscated with base6...

Python-daphne HTTP Request Smuggling

The vulnerability of the asynchronous Python-daphne web server is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a malicious actor to send hidden HTTP requests remotely a type of HTTP request smuggling attack...

python-cryptography security update

43.0.0-4 - Fix CVE-2026-69249: add X.509 signature validation budget...

Linux Distros Unpatched Vulnerability : CVE-2026-57177

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the LoginRadius backend did not validate OAuth state during the...