AZL-105681 CVE-2026-102598 affecting package python-werkzeug 3.0.3-2

Werkzeug is a comprehensive WSGI web application library. Prior to 3.1.9, the safejoin function used by sendfromdirectory can allow a NUL: special-device path because safejoin checks the Windows device name without first removing an empty NTFS ADS marker. The trigger is that an application runs o...

AZL-105654 CVE-2026-102598 affecting package python-tensorboard 2.16.2-6

Werkzeug is a comprehensive WSGI web application library. Prior to 3.1.9, the safejoin function used by sendfromdirectory can allow a NUL: special-device path because safejoin checks the Windows device name without first removing an empty NTFS ADS marker. The trigger is that an application runs o...

CVE-2026-97687

The urllib3 Python HTTP client library (versions 1.26.0 through 2.8.0 ) contains a vulnerability where target-server TLS settings are incorrectly applied to HTTPS proxy connections. Specifically, configurations like proxy_ssl_context, ssl_context, and cert_reqs fail to remain separated, allowing ...

com.webank.wedatasphere.dss:dolphinscheduler-prod-metrics (>=1.1.0, <=1.2.2), org.apache.dolphinscheduler:dolphinscheduler-dist (>=2.0.0-alpha, <=3.4.2) +2 more potentially affected by CVE-2026-81569 via org.apache.dolphinscheduler:dolphinscheduler-api (>=1.3.9, <=3.4.2)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =1.3.9, =1.1.0, =2.0.0-alpha, =2.0.2, =1.3.9, =3.0.6 Source cves: CVE-2026-81569 Source advisory: MEND:CVE-2026-81569...

Capability Probe (Python)

Detect OS, architecture, runtime, privileges, writable directory, and network capabilities before callback !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "capabilityprobe" info = "name": "Capability Probe Python",...

Signed Config (Python)

Embed encrypted and signed operator config separate from the payload body !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import from core.payloadgeneration.prestage.signedconfigcontext import resolvesignedconfigcontext class ModulePrestage: PRESTAGEID =...

Stage Verify (Python)

Verify staged artifact SHA256 before callback uses stagecache when present !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "stageverify" info = "name": "Stage Verify Python", "description": "Verify staged artifact...

Stage Cache (Python)

Verified local stage cache with TTL expiration and interrupted download resume !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import from core.payloadgeneration.prestage.stagecachecontext import resolvestagecachecontext class ModulePrestage: PRESTAGEID =...

Resource Guard (Python)

Exit early when memory or disk looks too constrained for the intended target !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "resourceguard" info = "name": "Resource Guard Python", "description": "Exit early when...

Network Preflight (Python)

Probe callback reachability before entering the main implant loop !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "networkpreflight" info = "name": "Network Preflight Python", "description": "Probe callback...

Scope Guard (Python)

Exit when the callback host is outside the embedded lab scope !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict, List from kittysploit import class ModulePrestage: PRESTAGEID = "scopeguard" info = "name": "Scope Guard Python", "description": "Exit when the callback host is...

Telemetry Buffer (Python)

Persist bootstrap errors locally and flush them after the first C2 poll !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import from core.payloadgeneration.prestage.telemetrycontext import resolvetelemetrycontext class ModulePrestage: PRESTAGEID =...

vantic-breach

Vantic Breach Every wall has a way in. A full-suite author...

sqli-xss-detection

How to run it Open a terminal in the project root: sqlixssdete...

Official MCP Python SDK Flaw Can Let Malicious Servers Steal OAuth Credentials

A malicious MCP server could trick an application built on the official MCP Python SDK into handing over the OAuth credentials it uses to log in to a real service, the SDK's maintainers said in a security advisory. Affected versions sent the client secret, the authorization code, and the PKCE pro...

[SECURITY] Fedora 44 Update: python-streamlink-8.4.0-2.fc44

Streamlink is a command-line utility that pipes video streams from various services into a video player, such as VLC. The main purpose of Streamlink is to allow the user to avoid buggy and CPU heavy flash plugins but still be able to enjoy various streamed content. There is also an API available...

[SECURITY] Fedora 44 Update: python-urllib3-2.8.0-1.fc44

urllib3 is a powerful, user-friendly HTTP client for Python. urllib3 brings many critical features that are missing from the Python standard libraries: =E2=80=A2 Thread safety. =E2=80=A2 Connection pooling. =E2=80=A2 Client-side SSL/TLS verification. =E2=80=A2 File uploads with multipart encoding...

CLEANSTART-2026-QT13587 Tornado is a Python web framework and asynchronous networking library

CVE-2026-82397 affects multiple packages. Tornado is a Python web framework and asynchronous networking library. See references for individual vulnerability details...

CLEANSTART-2026-VD54989 sqlparse is a non-validating SQL parser module for Python

CVE-2026-59893 affects multiple packages. sqlparse is a non-validating SQL parser module for Python. See references for individual vulnerability details...

CLEANSTART-2026-XN67293 sqlparse is a non-validating SQL parser module for Python

CVE-2026-54284 affects multiple packages. sqlparse is a non-validating SQL parser module for Python. See references for individual vulnerability details...