AZL-110091 CVE-2026-113732 affecting package python-virtualenv 20.36.1-9

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote, which uses POSIX shlex.quote even though fish interprets backslashes and single quotes differently. An attacker-influenced environment path, --prompt, or...

AZL-110106 CVE-2026-113776 affecting package python-virtualenv 20.36.1-9

virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiatetemplate replaces placeholders one key at a time across the complete activation template, so trigger names such as VIRTUALNAME, VIRTUALENV, or VIRTUALPROMPT inside a...

CVE-2026-113731

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. From 0.9.0 until 1.0.10, 1.1.7, 1.2.4, and 1.3.0rc8, the findhandlersfortemplate MCP tool in python/djust/mcp/server.py accepts an existing absolute templatepath and reads it without...

AZL-110100 CVE-2026-113726 affecting package python-virtualenv 20.36.1-9

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASHVERSION is set, so zsh...

CVE-2026-113731 djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. From 0.9.0 until 1.0.10, 1.1.7, 1.2.4, and 1.3.0rc8, the findhandlersfortemplate MCP tool in python/djust/mcp/server.py accepts an existing absolute templatepath and reads it without...

CVE-2026-113731

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. From 0.9.0 until 1.0.10, 1.1.7, 1.2.4, and 1.3.0rc8, the findhandlersfortemplate MCP tool in python/djust/mcp/server.py accepts an existing absolute templatepath and reads it without...

CVE-2026-113731

The djust framework (versions 0.9.0 through 1.0.10, 1.1.7, 1.2.4, and 1.3.0rc8) contains an arbitrary absolute-path file read vulnerability in the find_handlers_for_template MCP tool located in python/djust/mcp/server.py. The root cause is that the tool accepts an absolute template_path and reads...

CVE-2026-83404

A vulnerability exists in the Connector/Python component of the Oracle MySQL Connectors product (affected version 26.7.0 ). This easily exploitable flaw allows an unauthenticated attacker with network access via multiple protocols to compromise the connectors. Successful exploitation can lead to ...

CVE-2026-83404

Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/Python. The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attac...

CVE-2026-83404

Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/Python. The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attac...

helperpy (>=0.0.1, <=0.0.4), higlass-python (0.4.6) +4 more potentially affected by CVE-2026-112397 via pillow (8.3.0)

pillow PYPI version 8.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - helperpy =0.0.1, =0.0.2, =0.0.22 - seleniumbase 1.63.14 - workflow-nodes 0.7.0 Source cves: CVE-2026-112397 Source advisory: OSV:GHSA-58R4-6RV3-GFH8...

helperpy (>=0.0.1, <=0.0.4), higlass-python (0.4.6) +4 more potentially affected by CVE-2026-112896 via pillow (8.3.0)

pillow PYPI version 8.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - helperpy =0.0.1, =0.0.2, =0.0.22 - seleniumbase 1.63.14 - workflow-nodes 0.7.0 Source cves: CVE-2026-112896 Source advisory: OSV:GHSA-PCHR-8J38-3X4P...

helperpy (>=0.0.1, <=0.0.4), higlass-python (0.4.6) +4 more potentially affected by CVE-2026-112403 via pillow (8.3.0)

pillow PYPI version 8.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - helperpy =0.0.1, =0.0.2, =0.0.22 - seleniumbase 1.63.14 - workflow-nodes 0.7.0 Source cves: CVE-2026-112403 Source advisory: OSV:GHSA-8G5G-8VMR-9782...

AZL-110115 CVE-2026-113725 affecting package python-virtualenv 20.36.1-9

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.7, the bash activate script escapes the environment name for only one of the two passes bash makes over PS1, so a backslash in the name undoes the escaping and a name containing $... runs as commands in the...

AZL-111521 CVE-2026-113724 affecting package python-virtualenv 20.36.1-9

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the safedelete deletion error handler responds to a failed removal by reading mode bits with os.lstatpath and applying owner-write permission with os.chmodpath, ..., which follows a symlink. A planted link...

AZL-110118 CVE-2026-113720 affecting package python-virtualenv 20.36.1-9

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data copy seeder uses shutil.copy to copy cached package files into later environments, causing cached source modes to override the current run's umask. A cache populated under a permissive umask can...

AZL-110112 CVE-2026-113722 affecting package python-virtualenv 20.36.1-9

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, virtualenv's ScriptMakerCustom and pip pass an incompletely quoted interpreter path to distlib ScriptMaker when generating POSIX console scripts. When the path contains a space or produces a shebang longer...

AZL-110097 CVE-2026-113723 affecting package python-virtualenv 20.36.1-9

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and dr...

AZL-110124 CVE-2026-113721 affecting package python-virtualenv 20.36.1-9

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator.generate removes an existing output only when Path.exists is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write opens pyvenv.cfg...

AZL-110121 CVE-2026-113719 affecting package python-virtualenv 20.36.1-9

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall.uninstallpreviousversion accepts existing seed-package metadata and uninstalldist joins entries from toplevel.txt and RECORD to site-packages without checking containment. When a reused destinatio...