exploit-chain

exploit-chain — UBI Stage 6 Exploit Chain as Code Custom Pyth...

vajra

██╗ ██╗ █████╗ ██╗██████╗ █████╗ ██║ ██║██...

Exploit for CVE-2026-19286

Description Proof of...

MGASA-2026-0340 Updated python-nltk packages fix security vulnerabilities

Updated packages fix security vulnerabilities. Please see the links...

Updated python-nltk packages fix security vulnerabilities

Updated packages fix security vulnerabilities. Please see the links...

SecureForce

SecureForce - Penetration Testing Framework A simplified but...

MHDDoS v2.4.5

MHDDoS - DDoS Attack Script With 57 Methods Programming Language - Python 3 Please Don't Attack websites without the owner's consent. Features And Methods 💣 Layer7 GET | GET Flood POST | POST Flood OVH | Bypass OVH !ov...

Unity Linux 20.1070e Security Update: python-lxml (UTSA-2026-104952)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104952 advisory. lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in lxml.html.defs.linkattrs were missing xlink:href, which can ...

python313-Authlib-1.7.2-3.1 on GA media (moderate)

python313-Authlib-1.7.2-3.1 on GA media Announcement ID: openSUSE-SU-2026:11614-1 Rating: moderate Cross-References: CVE-2024-37568 CVSS scores: CVE-2024-37568 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Tumbleweed An update that solves one vulnerability ca...

VulnCheck KEV: CVE-2026-0768

Langflow code Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the code...

Unity Linux 20.1070e Security Update: python-setuptools (UTSA-2026-104947)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104947 advisory. setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude,...

Security Bulletin: Langflow is vulnerable to remote code execution due to authorization policy bypass in the authenticated flow-build endpoint

Summary Langflow contains an authorization policy bypass vulnerability that allows a non-superuser authenticated attacker to execute arbitrary Python code as the Langflow service identity despite the LANGFLOWCUSTOMCOMPONENTADMINONLY=true security control. The dedicated custom component API...

CVE-2026-55520

Protego is a pure-Python robots.txt parser with support for modern conventions. Prior to 0.6.2, protego.urlpattern.URLPattern.preparepatternforregex translates every asterisk in an Allow or Disallow directive into a lazy regular-expression wildcard, so a directive containing many asterisks create...

CVE-2026-55485

Piccolo Admin is an admin interface and content management system for Python, built on top of Piccolo. Prior to 1.14.0, piccoloadmin/endpoints.py uses superuservalidators to block PUT, PATCH, DELETE, and POST requests by non-superusers but permits GET requests to configured user and session table...

baotool (1.0.1), clutch-co-scraper (1.0.0) +11 more potentially affected by CVE-2026-55520 via protego (>=0.1.16, <=0.6.0)

protego PYPI version =0.1.16, =0.1.5, =0.3.0a0, =1.0.0, =0.7.2, =0.1.0, =0.1.0, =0.0.1, =0.1.0 - scrapy-plus 1.0.5 - scrapydartx 1.3.2 - shuirouyan-package-test 0.0.3 Source cves: CVE-2026-55520 Source advisory: OSV:GHSA-WJMF-P669-5M5P...

CVE-2026-55520 Protego: Exponential backtracking ReDoS in robots.txt URL wildcard matching

Protego is a pure-Python robots.txt parser with support for modern conventions. Prior to 0.6.2, protego.urlpattern.URLPattern.preparepatternforregex translates every asterisk in an Allow or Disallow directive into a lazy regular-expression wildcard, so a directive containing many asterisks create...

CLSA-2026-1787934757 Fix CVE(s): CVE-2024-7254, CVE-2026-0994

SECURITY UPDATE: Unbounded recursion when parsing nested groups in protobuf-java - debian/patches/CVE-2024-7254.patch: bound the depth of the skipMessage/skipField recursion in CodedInputStream and of the nested-group recursion in UnknownFieldSetLite with the existing recursion limit, so a stream...

CVE-2026-82278 BISHENG Authenticated Arbitrary Python Code Execution via Workflow run_once

BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow runonce endpoint that allows authenticated users to execute arbitrary Python code. Attackers can submit crafted Code node definitions to the POST /api/v1/workflow/runonce endpoint, which executes them with exec...

CVE-2026-82278 BISHENG Authenticated Arbitrary Python Code Execution via Workflow run_once

BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow runonce endpoint that allows authenticated users to execute arbitrary Python code. Attackers can submit crafted Code node definitions to the POST /api/v1/workflow/runonce endpoint, which executes them with exec...

CVE-2026-82278 BISHENG Authenticated Arbitrary Python Code Execution via Workflow run_once

BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow runonce endpoint that allows authenticated users to execute arbitrary Python code. Attackers can submit crafted Code node definitions to the POST /api/v1/workflow/runonce endpoint, which executes them with exec...