Arbitrary Code Execution (ACE)

hydraoptunasweeper is vulnerable to arbitrary code execution. The vulnerability is due to improper validation of configuration-controlled dotted paths in hydra-optuna-sweeper, which allows an attacker to execute arbitrary importable Python code with the application's privileges by manipulating...

libtalloc

libtalloc libtalloc è uno script python per l'uso con GDB che può essere utilizzato per analizzare l'"allocatore banale" talloc. Un'introduzione su talloc si può trovare qui: https://talloc.samba.org/talloc/doc/html/index.html libtalloc è stato ispirato da altri script python per GDB per l'analis...

CLSA-2026-1791493216 Fix CVE(s): CVE-2026-74860

SECURITY UPDATE: double free in the Python bindings' SAX attributeDecl callback - debian/patches/CVE-2026-74860.patch: do not PyDECREF the attribute name string after PyListSetItem has stolen its reference in pythonAttributeDecl in python/libxml.c - CVE-2026-74860...

K000163608: Python vulnerability CVE-2026-0994

Security Advisory Description A denial-of-service DoS vulnerability exists in google.protobuf.jsonformat.ParseDict in Python, where the maxrecursiondepth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the internal...

bip

Bip Bip è un progetto che mira a semplificare l'uso di Python per interagire con IDA. I suoi obiettivi principali sono facilitare l'uso di Python nella console interattiva di IDA e la scrittura di plugin. In modo più generale l'obiettivo è automatizzare i compiti ricorrenti svolti tramite l'API...

CVE-2026-106435

The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...

CVE-2026-106435 Application denial of service via out-of-bounds read in BSON Regex decoding in MongoDB Python Driver

The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...

CVE-2026-106435 Application denial of service via out-of-bounds read in BSON Regex decoding in MongoDB Python Driver

The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...

Application denial of service via out-of-bounds read in BSON Regex decoding in MongoDB Python Driver

The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...

CVE-2026-106435 Application denial of service via out-of-bounds read in BSON Regex decoding in MongoDB Python Driver

The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...

CVE-2026-106435

The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...

CVE-2026-106435

The MongoDB Python Driver contains an out-of-bounds read vulnerability in its binary accelerator. This occurs when an application decodes malformed BSON containing a truncated regular-expression element missing a trailing NUL byte. An attacker who can supply BSON to the decode or decode_all APIs ...

CLSA-2026-1791489916 Fix CVE(s): CVE-2026-74860

SECURITY UPDATE: double free in the Python bindings' SAX attributeDecl callback - debian/patches/CVE-2026-74860.patch: do not PyDECREF the attribute name string after PyListSetItem has stolen its reference in pythonAttributeDecl in python/libxml.c - CVE-2026-74860...

Exploit for Incorrect Default Permissions in Supervisord Supervisor

Supervisord XML-RPC RCE CVE-2017-11610 Vulhubhttps://vul...

EUVD-2026-44640

PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source...

PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source

API deploy code generator embeds unescaped YAML fields into Python source Summary PraisonAI's API deployment generator copies deploy.api.host from agents.yaml directly into generated Python source without safe literal encoding. A malicious PraisonAI project can set that host value to a Python...

gcat

Gcat Una backdoor furtiva basata su Python che utilizza Gmail come server di comando e controllo Questo progetto è ispirato al codice PoC originale di Benjamin Donnelly Questo è codice PoC... ... che è stato rilasciato per consentire alle organizzazioni di testare le proprie difese contro questi...

EUVD-2026-44646

PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification...

PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification

Summary The plugin manager loads and executes arbitrary .py files from .praisonai/plugins/ directories both project-level and user home via importlib.util.specfromfilelocation + execmodule with zero code signing, integrity verification, or sandboxing. Any attacker who can write a file to the...

GHSA-M6WP-H223-4C8G PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification

Summary The plugin manager loads and executes arbitrary .py files from .praisonai/plugins/ directories both project-level and user home via importlib.util.specfromfilelocation + execmodule with zero code signing, integrity verification, or sandboxing. Any attacker who can write a file to the...