CVE-2026-114663

Vyper versions 0.4.0b1 through 0.5.0b1 are vulnerable to a name shadowing issue affecting unfoldable constants and omitted default arguments from imported modules. The root cause is that the parse_Name function resolves these names within the using function's scope instead of at the point of decl...

RestrictedPython guard hooks can be shadowed via positional-only arguments

ImpactRestrictedPython rewrites sensitive operations to go through guard hooks. Attribute access becomes getattrobj, name, item access becomes getitemobj, key, writes go through write, and print goes through print. The embedding application supplies these hooks to enforce its policy.Argument-name...

CVE-2020-26284

Hugo is a fast and Flexible Static Site Generator built in Go. Hugo depends on Go's os/exec for certain features, e.g. for rendering of Pandoc documents if these binaries are found in the system %PATH% on Windows. In Hugo before version 0.79.1, if a malicious file with the same name exe or bat is...