EUVD-2026-77692

OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs. Prior to 0.154.0, the Sentry exporter reads the remote OTLP sender-controlled service.name resource...

CVE-2026-55846 Allure: Path Traversal in Allure Report HTTP Server Allows Arbitrary File Read

Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the HTTP server started by allure serve and allure open uses URI.getPath in Commands.setUpServer in allure-commandline/src/main/java/io/qameta/allure/Commands.java and passes the...

CVE-2026-55073

WeasyPrint prior to 70.0 contains a url_fetcher bypass in two write_pdf() code paths. The xmp_metadata parameter in weasyprint/pdf/__init__.py calls select_source() without passing the document's fetcher, enabling arbitrary local file read with contents embedded verbatim in the output PDF. The st...

CVE-2026-55073 WeasyPrint restrictive URL fetcher bypass allows local file read and SSRF

WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive urlfetcher and pass attacker-influenced values to HTML.writepdf can have the restriction bypassed through the xmpmetadata or stylesheets options. In weasyprint/pdf/init.py...

CVE-2021-41773

CVE-2021-41773 演练场 这是一个小型 Docker 搭建方案，用于创建基于 Debian bookworm 的容器，其中运行着存在 CVE-2021-41773 漏洞的 Apache HTTPd 2.4.49 实例。 已显式启用 CGI，因此可用于测试/验证本地文件泄露行为以及远程命令执行行为。 用法 root@kitploit: $ docker-compose build && docker-compose-up 本地文件泄露 root@kitploit: $ curl -s --path-as-is...

CVE-2026-55235 langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication

langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, langgraph-api permits a run or cron to specify a relative webhook target that is delivered through an in-process loopback transport, and the authentication middleware treats that transport as internal...

CVE-2025-32778

CVE-2025-32778 - Web-Check コマンドインジェクションエクスプロイト 説明 CVE-2025-32778 は、Lissy93 による Web-Check OSINT ツールにおける重大なコマンドインジェクションの脆弱性です。 認証されていない攻撃者が、スクリーンショット API の url パラメータを介して任意のシステムコマンドを実行することを可能にします。 この Python スクリプトは、エクスプロイトを自動化し、リバースシェルを生成したり、カスタムシェルペイロードを受け入れたりできます。 警告...

-CVE-2025-0133-GlobalProtect-XSS

mitsecvpnxssexploit 🔓 针对 GlobalProtect SSL VPN 端点 /ssl-vpn/getconfig.esp 的漏洞利用工具，将构造的 XSS 载荷追加到 URL 中。 用法 root@kitploit: python3 exploit.py -u https://target.com 参数 -u, --url: 基础目标 URL（不要 包含查询参数） 载荷预览 root@kitploit: prompt"mitsec" 作者 GitHub: ynsmroztas Twitter: @ynsmroztas...

CVE-2023-30777

CVE-2023-30777 Advanced Custom Fields WordPressプラグインにおける反射型XSS脆弱性のProof of Concept（PoC）URL生成ツール。 PoC 生成者: Alucard0x1 エクスプロイトのクレジット: https://patchstack.com/articles/reflected-xss-in-advanced-custom-fields-plugins-affecting-2-million-sites/...

Important: Red Hat Security Advisory: python-lxml security update

An update for python-lxml is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href

A flaw was found in lxml, a library for processing XML and HTML in Python. The lxml.html.defs.linkattrs were missing xlink:href, which could allow an attacker to bypass URL filtering mechanisms. This vulnerability enables URL bypass attacks in embedded content such as Scalable Vector Graphics SVG...

lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href

A flaw was found in lxml, a library for processing XML and HTML in Python. The lxml.html.defs.linkattrs were missing xlink:href, which could allow an attacker to bypass URL filtering mechanisms. This vulnerability enables URL bypass attacks in embedded content such as Scalable Vector Graphics SVG...

Important: Red Hat Security Advisory: python-lxml security update

An update for python-lxml is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

Important: Red Hat Security Advisory: python-lxml security update

An update for python-lxml is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href

A flaw was found in lxml, a library for processing XML and HTML in Python. The lxml.html.defs.linkattrs were missing xlink:href, which could allow an attacker to bypass URL filtering mechanisms. This vulnerability enables URL bypass attacks in embedded content such as Scalable Vector Graphics SVG...

CVE-2026-57126

PraisonAI 's multi-agent system (packages praisonaiagents ≤ 1.6.39 / PraisonAI ≤ 4.6.39) is affected by a CWE-918 SSRF in SpiderTools._validate_url (praisonaiagents/tools/spider_tools.py). The guard (_host_is_blocked) checks only literal IP encodings and never resolves DNS names , so an attacker-...

CVE-2019-8451

CVE-2019-8451 https://jira.atlassian.com/browse/JRASERVER-69793 root@kitploit: http://host:port/plugins/servlet/gadgets/makeRequest?url=http://:@'.formathost, port, target https://host:port/plugins/servlet/gadgets/makeRequest?url=https://:@'.formathost, port, target...

CVE-2026-90790 a2aproject a2a-python Push Notification Sender base_push_notification_sender.py _dispatch_notification server-side request forgery

A security vulnerability has been detected in a2aproject a2a-python up to 1.1.3. This affects the function dispatchnotification of the file src/a2a/server/tasks/basepushnotificationsender.py of the component Push Notification Sender. The manipulation of the argument pushinfo.url leads to...

EUVD-2026-77535

A security vulnerability has been detected in a2aproject a2a-python up to 1.1.3. This affects the function dispatchnotification of the file src/a2a/server/tasks/basepushnotificationsender.py of the component Push Notification Sender. The manipulation of the argument pushinfo.url leads to...