74603 matches found
CVE-2026-108597: Improper Limitation of a Pathname to a Restricted Directory
Cohere Python SDK 5.11.0 through 7.2.0 contains a path traversal tar slip vulnerability in s3modelsdirtotarfile that allows arbitrary file write via unvalidated tarfile.extractall calls. Attackers who can write model archives to the victim's S3 prefix can include absolute paths or ../ members to...
PT-2026-109738
Name of the Vulnerable Software and Affected Versions Cohere Python SDK versions 5.11.0 through 7.2.0 Description A path traversal tar slip issue exists in the s3 models dir to tarfile function. This occurs due to unvalidated tarfile.extractall calls, which allow arbitrary file writes. An attacke...
ail-typo-squatting
ail-typo-squatting ail-typo-squatting è una libreria Python per generare un elenco di potenziali domini typosquatting con un motore di permutazione dei nomi di dominio, per alimentare AIL e altri sistemi. Lo strumento può essere utilizzato come strumento autonomo o per alimentare altri sistemi. S...
CVE-2026-108264
Wizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other media servers. Prior to 2026.9.1, wizard step Markdown supplied through the editor or imported bundles was evaluated by app/blueprints/wizard/routes.py in the application's non-sandboxed Jinja2...
CVE-2026-108258
Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied stateid and joins it into the server-side shinybookmarks directory without validating that it is a single safe path segment. An unauthenticated...
Shiny for Python has path traversal in bookmark restore
Impact Shiny for Python's bookmark-restore path accepted a client-supplied stateid query-string value and joined it into the server-side bookmark directory /shinybookmarks/ without validating it. A value containing .. path segments, or an absolute path, could therefore cause the server to open an...
GHSA-47C3-HPMG-7J6P Shiny for Python has path traversal in bookmark restore
Impact Shiny for Python's bookmark-restore path accepted a client-supplied stateid query-string value and joined it into the server-side bookmark directory /shinybookmarks/ without validating it. A value containing .. path segments, or an absolute path, could therefore cause the server to open an...
CVE-2026-108264
Wizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other media servers. Prior to 2026.9.1, wizard step Markdown supplied through the editor or imported bundles was evaluated by app/blueprints/wizard/routes.py in the application's non-sandboxed Jinja2...
CVE-2026-108264 Wizarr: Authenticated Server-Side Template Injection (SSTI) in wizard step rendering leads to Remote Code Execution (RCE)
Wizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other media servers. Prior to 2026.9.1, wizard step Markdown supplied through the editor or imported bundles was evaluated by app/blueprints/wizard/routes.py in the application's non-sandboxed Jinja2...
CVE-2026-108258 Shiny for Python - Path traversal in bookmark restore
Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied stateid and joins it into the server-side shinybookmarks directory without validating that it is a single safe path segment. An unauthenticated...
CVE-2026-108258 Shiny for Python - Path traversal in bookmark restore
Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied stateid and joins it into the server-side shinybookmarks directory without validating that it is a single safe path segment. An unauthenticated...
EUVD-2026-95986
Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied stateid and joins it into the server-side shinybookmarks directory without validating that it is a single safe path segment. An unauthenticated...
CVE-2026-108258
Shiny for Python versions 1.4.0 through 1.6.4 are vulnerable to a path traversal flaw in the bookmark restore functionality. The application fails to validate that the client-supplied state_id is a single safe path segment before joining it with the server-side shiny_bookmarks directory. This all...
CVE-2026-108258
Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied stateid and joins it into the server-side shinybookmarks directory without validating that it is a single safe path segment. An unauthenticated...
CVE-2026-108258 Shiny for Python - Path traversal in bookmark restore
Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied stateid and joins it into the server-side shinybookmarks directory without validating that it is a single safe path segment. An unauthenticated...
creepy-plugins
creepy-plugins Descrizione Plugin per cree.py L'architettura di cree.py consente di utilizzare più sorgenti definite dall'utente per le informazioni di geolocalizzazione. Queste sorgenti sono definite come plugin e possono essere installate in creepy copiandole nella cartella plugins sotto la...
usbkill
« usbkill » è un kill-switch anti-forense che attende un cambiamento sulle porte USB e poi spegne immediatamente il computer. Per eseguirlo: sudo python usbkill.py oppure sudo python3 usbkill.py Progetto correlato; stessa idea, ma implementata come driver Linux:...
linux-explorer
¡Este proyecto ya no recibe mantenimiento! Linux Expl0rer Caja de herramientas de análisis forense en vivo fácil de usar para endpoints Linux, escrita en Python y Flask. Capacidades ps Ver lista completa de procesos Inspeccionar el mapa de memoria del proceso y obtener cadenas de memoria fácilmen...