CVE-2023-44487

HTTP2 Rapid Reset Attack: CVE-2023-44487 Quick exploit to test out rapid reset attack CVE-2023-44487. Note: For education purpose only Exploit: Quick exploit to test out rapid reset attack CVE-2023-44487. Note: For education purpose only Table of Contents Installation Usage Installation Clone the...

autocleus (0.1.1), poetry (>=1.2.0a1, <=1.2.0a2) +2 more potentially affected by CVE-2026-102925 via virtualenv (20.4.4)

virtualenv PYPI version 20.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - autocleus 0.1.1 - poetry =1.2.0a1, =0.1.2, =0.0.1, =0.4.1 Source cves: CVE-2026-102925 Source advisory: OSV:GHSA-P58F-9548-MPM2...

appcensus-dynamic-repos (>=2.0.113, <=2.1.117), microscopemetrics (0.2.4) +11 more potentially affected by CVE-2026-102925 via virtualenv (20.32.0)

virtualenv PYPI version 20.32.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - appcensus-dynamic-repos =2.0.113, =0.6.0, =1.0.0, =0.1.1, =0.5.4, =1.0.1, =1.0.119 Source cves: CVE-2026-102925 Source advisory:...

autocleus (0.1.1), poetry (>=1.2.0a1, <=1.2.0a2) +2 more potentially affected by CVE-2026-102937 via virtualenv (20.4.4)

virtualenv PYPI version 20.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - autocleus 0.1.1 - poetry =1.2.0a1, =0.1.2, =0.0.1, =0.4.1 Source cves: CVE-2026-102937 Source advisory: OSV:GHSA-X78J-V8H9-3J2Q...

autocleus (0.1.1), poetry (>=1.2.0a1, <=1.2.0a2) +2 more potentially affected by CVE-2026-102930 via virtualenv (20.4.4)

virtualenv PYPI version 20.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - autocleus 0.1.1 - poetry =1.2.0a1, =0.1.2, =0.0.1, =0.4.1 Source cves: CVE-2026-102930 Source advisory: OSV:GHSA-94P9-XGH2-XP45...

autocleus (0.1.1), poetry (>=1.2.0a1, <=1.2.0a2) +2 more potentially affected by CVE-2026-102938 via virtualenv (20.4.4)

virtualenv PYPI version 20.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - autocleus 0.1.1 - poetry =1.2.0a1, =0.1.2, =0.0.1, =0.4.1 Source cves: CVE-2026-102938 Source advisory: OSV:GHSA-9H9J-4VRJ-GF7G...

autocleus (0.1.1), poetry (>=1.2.0a1, <=1.2.0a2) +2 more potentially affected by CVE-2026-102925 via virtualenv (20.4.4)

virtualenv PYPI version 20.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - autocleus 0.1.1 - poetry =1.2.0a1, =0.1.2, =0.0.1, =0.4.1 Source cves: CVE-2026-102925 Source advisory: OSV:PYSEC-2026-4013...

autocleus (0.1.1), poetry (>=1.2.0a1, <=1.2.0a2) +2 more potentially affected by CVE-2026-102930 via virtualenv (20.4.4)

virtualenv PYPI version 20.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - autocleus 0.1.1 - poetry =1.2.0a1, =0.1.2, =0.0.1, =0.4.1 Source cves: CVE-2026-102930 Source advisory: OSV:PYSEC-2026-4011...

autocleus (0.1.1), poetry (>=1.2.0a1, <=1.2.0a2) +2 more potentially affected by CVE-2026-102937 via virtualenv (20.4.4)

virtualenv PYPI version 20.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - autocleus 0.1.1 - poetry =1.2.0a1, =0.1.2, =0.0.1, =0.4.1 Source cves: CVE-2026-102937 Source advisory: OSV:PYSEC-2026-4014...

autocleus (0.1.1), poetry (>=1.2.0a1, <=1.2.0a2) +2 more potentially affected by CVE-2026-102938 via virtualenv (20.4.4)

virtualenv PYPI version 20.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - autocleus 0.1.1 - poetry =1.2.0a1, =0.1.2, =0.0.1, =0.4.1 Source cves: CVE-2026-102938 Source advisory: OSV:PYSEC-2026-4012...

appcensus-dynamic-repos (>=2.0.113, <=2.1.117), microscopemetrics (0.2.4) +11 more potentially affected by CVE-2026-102938 via virtualenv (20.32.0)

virtualenv PYPI version 20.32.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - appcensus-dynamic-repos =2.0.113, =0.6.0, =1.0.0, =0.1.1, =0.5.4, =1.0.1, =1.0.119 Source cves: CVE-2026-102938 Source advisory:...

PDM wheel installation leads to Path Traversal via overridden write_to_fs

InstallDestination.writetofs in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces the safe pathwithdestdir which validates via Path.resolve + isrelativeto with a bare os.path.join that performs no path validation. A malicious wheel with travers...

Poetry has Path Traversal in tar extraction on Python 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4

SummaryThe extractall function in src/poetry/utils/helpers.py:410-426 extracts sdist tarballs without path traversal protection on Python versions where tarfile.datafilter is unavailable. Considering only Python versions which are still supported by Poetry, these are 3.10.0 - 3.10.12 and 3.11.0 -...

PYSEC-2026-2890 Poetry has Path Traversal in tar extraction on Python 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4

Summary The extractall function in src/poetry/utils/helpers.py:410-426 extracts sdist tarballs without path traversal protection on Python versions where tarfile.datafilter is unavailable. Considering only Python versions which are still supported by Poetry, these are 3.10.0 - 3.10.12 and 3.11.0 ...

distill-trainer (>=0.1.0, <=0.1.1), poetry-plugin-export (1.3.1) +1 more potentially affected by CVE-2026-41140 via poetry (1.5.0)

poetry PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on poetry and may be impacted: - distill-trainer =0.1.0, =0.1.1 - poetry-plugin-export 1.3.1 - wolf-core 2.0.1 Source cves: CVE-2026-41140 Source advisory: OSV:PYSEC-2026-2890...

calendruparser (0.1.0), dbt-scandal (>=0.0.2, <=0.1.2) +12 more potentially affected by CVE-2026-41140 via poetry (1.5.1)

poetry PYPI version 1.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on poetry and may be impacted: - calendruparser 0.1.0 - dbt-scandal =0.0.2, =0.0.1, =0.1.5, =1.4.0, =0.2.1, =0.2.5 Source cves: CVE-2026-41140 Source advisory: OSV:PYSEC-2026-2890...

api-buddy (0.5.0) potentially affected by CVE-2026-41140 via poetry (1.6.0)

poetry PYPI version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on poetry and may be impacted: - api-buddy 0.5.0 Source cves: CVE-2026-41140 Source advisory: OSV:PYSEC-2026-2890...

kit-big-data-to-do-list (>=1.1.0, <=1.3.0), novelaillmwrapper (>=0.103.0, <=0.105.0) +7 more potentially affected by CVE-2026-41140 via poetry (1.6.1)

poetry PYPI version 1.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on poetry and may be impacted: - kit-big-data-to-do-list =1.1.0, =0.103.0, =1.1.0, =0.1.1, =0.3.3, =1.0.0, =1.3.1 Source cves: CVE-2026-41140 Source advisory: OSV:PYSEC-2026-2890...

aptos-verify (1.0.4) potentially affected by CVE-2026-41140 via poetry (1.7.0)

poetry PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on poetry and may be impacted: - aptos-verify 1.0.4 Source cves: CVE-2026-41140 Source advisory: OSV:PYSEC-2026-2890...

fate-client (>=1.9.0, <=1.11.3), harken-checker (0.1.0) +11 more potentially affected by CVE-2026-41140 via poetry (1.7.1)

poetry PYPI version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on poetry and may be impacted: - fate-client =1.9.0, =0.1.0, =0.1.0, =0.0.1, =0.2.1, =0.2.5 - pandoc-latex-tip 2.3.1.0 - poetry-plugin-pypi-mirror 0.4.1 -...