•27 minutes ago•CVE-2026-113719
4.5CVE-2026-113719: Arbitrary File Deletion via Path Traversal in virtualenv Seed Package Metadata
A path traversal vulnerability in PyPA virtualenv prior to version 21.14.9 allows local attackers to cause arbitrary file and directory deletion when a virtual environment target directory containing untrusted distribution metadata is reused or reseeded.
2 views•6 min read
•about 1 hour ago•CVE-2026-113715
2.0CVE-2026-113715: Configuration Key Injection via Unicode Line Boundary in virtualenv
In virtualenv versions prior to 21.14.9, creating isolated Python virtual environments using the standard library creator (`--creator venv`) allows configuration key injection into `pyvenv.cfg` if an attacker can control or influence the destination directory path containing Unicode line break characters.
4 views•5 min read
•about 2 hours ago•CVE-2026-113723
7.1CVE-2026-113723: OS Command Injection via Unsafe Prompt Expansion in PyPA virtualenv
A command injection vulnerability in PyPA virtualenv prior to version 21.14.9 allows local attackers to execute arbitrary commands when a user sources a generated shell activation script containing a crafted prompt value.
4 views•5 min read
•about 3 hours ago•CVE-2026-113720
4.4CVE-2026-113720: Local Permission Inheritance Vulnerability in virtualenv
virtualenv prior to version 21.14.9 contains a local permission inheritance vulnerability in its app-data copy seeder. Due to the reliance on Python's standard shutil.copy() function, permissions from cached packages are replicated directly onto newly created virtual environment files, ignoring the active process umask and allowing unprivileged local attackers to inject code.
7 views•5 min read
•about 4 hours ago•CVE-2026-113718
7.1CVE-2026-113718: Code Injection in pypa/virtualenv XonshActivator via Multibyte Encoding Misalignment
A code injection vulnerability in pypa/virtualenv prior to version 21.14.9 allows arbitrary command execution in xonsh shells using legacy multibyte encodings when sourcing activate.xsh.
6 views•5 min read
•about 5 hours ago•CVE-2026-113714
2.3CVE-2026-113714: Cache Poisoning and Unvalidated Wheel Download in virtualenv
Prior to version 21.14.9, virtualenv downloads wheel files directly into its reusable persistent cache directory prior to verifying PyPI digests or compatibility. Combined with unsanitized stdout parsing from pip, a controlled package index can cause virtualenv to calculate digests against pre-existing local files while leaving unverified archives in the shared persistent cache.
6 views•5 min read
•about 6 hours ago•CVE-2026-113717
2.3CVE-2026-113717: Package Digest Verification Bypass in virtualenv Pip Seeder
A verification bypass vulnerability in virtualenv allows unverified Python wheel installation when using pip seeding with the download flag. Affected versions fail to perform SHA-256 digest validation against PyPI metadata before invoking pip.
7 views•5 min read
•about 7 hours ago•CVE-2026-113713
4.4CVE-2026-113713: Insecure Temporary File Symlink Handling in PyPA virtualenv
Insecure temporary file usage (CWE-377) in virtualenv app-data seeder creates dangling symlinks pointing to deleted temporary directories, allowing local attackers on shared systems to execute arbitrary code.
5 views•4 min read
•about 8 hours ago•CVE-2026-112937
6.1CVE-2026-112937: Arbitrary Directory Deletion via TOCTOU Race Condition in filelock ReadWriteLock
A Time-of-Check Time-of-Use (TOCTOU) race condition in the Python `filelock` library (versions 4.1.0 to 4.2.0) allows local unprivileged attackers to cause arbitrary directory deletion by swapping file system targets during lock cleanup or dead owner sweeps.
7 views•5 min read
•about 9 hours ago•CVE-2026-112906
4.7CVE-2026-112906: Mutual Exclusion Bypass via Inode Recycling and Time Tracking Race in filelock
A local race condition and mutual exclusion bypass vulnerability exists in filelock versions 4.1.0 through 4.2.0. On Linux filesystems with rapid inode reuse, a local attacker can manipulate modification timestamps and lock files to cause waiting processes to falsely evict active soft lock markers.
9 views•6 min read
•about 10 hours ago•CVE-2026-114055
7.5CVE-2026-114055: Uncontrolled Resource Consumption in vLLM via Unvalidated Multimodal Kwargs
vLLM prior to version 0.31.0 contains an uncontrolled resource consumption vulnerability (CWE-400) in its HTTP API request handling logic. Unauthenticated remote attackers can transmit per-request keyword arguments (`mm_processor_kwargs` and `media_io_kwargs`) that are passed directly into internal multimodal preprocessing pipelines, causing CPU/GPU memory exhaustion and crashing the engine process.
8 views•5 min read
•about 11 hours ago•CVE-2026-62204
6.6CVE-2026-62204: Arbitrary Bazaar Package Overwrite in SiYuan via Parameter Mismatch
An insufficient verification of data authenticity vulnerability in SiYuan prior to version 3.7.4 allows an attacker to overwrite arbitrary installed marketplace packages (plugins, widgets, themes, and templates). By providing a mismatched package name and package archive repository URL during a Bazaar installation request, arbitrary file write into trusted plugin directories can be achieved, enabling persistence and execution across application restarts.
7 views•5 min read