Astra Linux – vulnerability in python-git

GitPython versions prior to 3.1.50 fail to validate newline characters in the section parameter of configwriter, enabling attackers to inject arbitrary section headers into .git/config. By inserting newlines, attackers can craft a forged core section with hooksPath pointing to directories under...

Astra Linux – Vulnerability in python-ipaddress

The Lib/ipaddress.py module in Python up to version 3.8.3 incorrectly calculates hash values for the IPv4Interface and IPv6Interface classes. This may allow a remote attacker to cause a denial of service if an application relies on the performance of a dictionary containing IPv4Interface or...

Astra Linux – Vulnerability in Python-Werkzeug

Werkzeug is a comprehensive WSGI web application library. Browsers may allow “nameless” cookies that look like =value instead of key=value. A vulnerable browser may allow a compromised application on a neighboring subdomain to exploit this to set a cookie like =Host-test=bad for another subdomain...

Astra Linux – Vulnerability in python-git

GitPython before version 3.1.58 fails to validate the names of submodules from the .gitmodules file. This allows attackers to create Git repositories at arbitrary filesystem paths outside of the intended clone directory. Attackers can create malicious repositories with traversal sequences in the...

hackingtool

AI-guided, all-in-one toolkit for authorized security testing 219 curated tools across 21 categories — recon, OSINT, web, wireless, phishing, forensics, post-exploitation and more — with an AI layer that turns plain English into the right tool and the exact command. Built for penetration testers ...

G0BurpSQLmaPI

Kousei こうせい Author: nu11secur1ty Years: 2023–2026 Language: Python with optional Go modules Purpose: Generate SQLi Proof-of-Concept requests, automate sqlmap attacks, and manage attack modules with ease. Description Kousei こうせい is an aggressive framework for sqlmap that can work with any web...

Exegol

Exegol — Cybersecurity CTF Write-ups !Statushttps://img.sh...

CVE-2026-79824

A flaw was found in Python. An attacker can exploit this directory traversal vulnerability by providing a specially crafted TAR archive containing relative path sequences, such as dot-dot notation. When the archive is extracted, files can be written outside the intended extraction directory,...

Shiny for Python has path traversal in bookmark restore

ImpactShiny for Python's bookmark-restore path accepted a client-supplied stateidquery-string value and joined it into the server-side bookmark directory/shinybookmarks/ without validating it. A value containing ..path segments, or an absolute path, could therefore cause the server to open andpar...

PYSEC-2026-4300 Shiny for Python has path traversal in bookmark restore

Impact Shiny for Python's bookmark-restore path accepted a client-supplied stateid query-string value and joined it into the server-side bookmark directory /shinybookmarks/ without validating it. A value containing .. path segments, or an absolute path, could therefore cause the server to open an...

PYSEC-2026-4251 PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source

API deploy code generator embeds unescaped YAML fields into Python source Summary PraisonAI's API deployment generator copies deploy.api.host from agents.yaml directly into generated Python source without safe literal encoding. A malicious PraisonAI project can set that host value to a Python...

PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source

API deploy code generator embeds unescaped YAML fields into Python source SummaryPraisonAI's API deployment generator copies deploy.api.host from agents.yaml directly into generated Python source without safe literal encoding. A malicious PraisonAI project can set that host value to a Python...

PYSEC-2026-4221 Hydra logging configuration permits unsafe callable resolution

Summary Hydra passed its Python logging configuration to logging.config.dictConfig. Python's logging configurator can resolve and invoke importable classes and factories named by configuration, including handler class values and formatter, filter, handler, queue, and listener factories. This...

PYSEC-2026-4224 Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method

Summary hydra-optuna-sweeper accepted a configuration-controlled dotted path in hydra.sweeper.customsearchspace, resolved it with the lower-level hydra.utils.getmethod API, and later invoked the returned callable. Hydra's object-lookup helpers intentionally trust their input and do not apply the...

echelon-client-agent (>=0.0.3, <=0.0.5), echelon-client-echelon (0.0.3) +1 more potentially affected by CVE-2026-106454 via twisted (18.4.0)

twisted PYPI version 18.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - echelon-client-agent =0.0.3, =0.7.2, =0.7.3 Source cves: CVE-2026-106454 Source advisory: OSV:PYSEC-2026-4304...

golemrpc (>=0.3.4, <=0.3.6), neo-python (>=0.5.7, <=0.7.1) +5 more potentially affected by CVE-2026-106454 via twisted (17.9.0)

twisted PYPI version 17.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - golemrpc =0.3.4, =0.5.7, =0.1.0, =0.2.0, =0.2.1 - txwerewolves 0.6.1 - yy-spider 1.0.0 Source cves: CVE-2026-106454 Source advisory:...

bitdust (0.0.2), kaze-python (>=0.7.8, <=0.8.9) +2 more potentially affected by CVE-2026-106454 via twisted (18.7.0)

twisted PYPI version 18.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - bitdust 0.0.2 - kaze-python =0.7.8, =0.7.5, =0.4.0.post2, =0.7.1 Source cves: CVE-2026-106454 Source advisory: OSV:PYSEC-2026-4304...

carly (>=0.1.0, <=0.10.1), carml (>=18.4.0, <=19.0.0) +10 more potentially affected by CVE-2026-106454 via twisted (18.9.0)

twisted PYPI version 18.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - carly =0.1.0, =18.4.0, =2019.5.0, =0.1.0a2, =0.0.12, =0.100.2rc4, =1.2.1.0, =0.1.0, =0.1.1 - tx 0.0.2 Source cves: CVE-2026-106454 Source advisor...

sd-python-wrapper (>=0.1.2, <=0.1.26) potentially affected by CVE-2026-96749 via pymongo (3.2.0)

pymongo PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - sd-python-wrapper =0.1.2, =0.1.26 Source cves: CVE-2026-96749 Source advisory: OSV:PYSEC-2026-4296...

openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation

ImpactA malicious OpenAPI document processed by any openapi-python-client prior to 0.29.1 can generate arbitrary Python code. When anyone imports the malicious client, that arbitrary Python code will execute. PatchesVersions starting with 0.29.1 have updated with guardrails to prevent arbitrary...