CVE-2026-111443

Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in production, by supplying an X-Wheels-Test-Context header or WHEELSTESTCONTEXT cookie with any value, or including a test-runner path anywhere in the URL, even the quer...

CVE-2026-111443

Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in production, by supplying an X-Wheels-Test-Context header or WHEELSTESTCONTEXT cookie with any value, or including a test-runner path anywhere in the URL, even the quer...

clearml-agent (>=0.17.0, <=0.17.2), manven (>=0.1.0, <=0.2.0) +4 more potentially affected by CVE-2026-102925 via virtualenv (16.7.12)

virtualenv PYPI version 16.7.12 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - clearml-agent =0.17.0, =0.1.0, =0.4.0, =0.0.1, =0.3.0.dev0, =0.13.2rc2, =0.16.3 Source cves: CVE-2026-102925 Source advisory:...

clearml-agent (>=0.17.0, <=0.17.2), manven (>=0.1.0, <=0.2.0) +4 more potentially affected by CVE-2026-102937 via virtualenv (16.7.12)

virtualenv PYPI version 16.7.12 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - clearml-agent =0.17.0, =0.1.0, =0.4.0, =0.0.1, =0.3.0.dev0, =0.13.2rc2, =0.16.3 Source cves: CVE-2026-102937 Source advisory:...

clearml-agent (>=0.17.0, <=0.17.2), manven (>=0.1.0, <=0.2.0) +4 more potentially affected by CVE-2026-102930 via virtualenv (16.7.12)

virtualenv PYPI version 16.7.12 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - clearml-agent =0.17.0, =0.1.0, =0.4.0, =0.0.1, =0.3.0.dev0, =0.13.2rc2, =0.16.3 Source cves: CVE-2026-102930 Source advisory:...

clearml-agent (>=0.17.0, <=0.17.2), manven (>=0.1.0, <=0.2.0) +4 more potentially affected by CVE-2026-102938 via virtualenv (16.7.12)

virtualenv PYPI version 16.7.12 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - clearml-agent =0.17.0, =0.1.0, =0.4.0, =0.0.1, =0.3.0.dev0, =0.13.2rc2, =0.16.3 Source cves: CVE-2026-102938 Source advisory:...

clearml-agent (>=0.17.0, <=0.17.2), manven (>=0.1.0, <=0.2.0) +4 more potentially affected by CVE-2026-102925 via virtualenv (16.7.12)

virtualenv PYPI version 16.7.12 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - clearml-agent =0.17.0, =0.1.0, =0.4.0, =0.0.1, =0.3.0.dev0, =0.13.2rc2, =0.16.3 Source cves: CVE-2026-102925 Source advisory:...

clearml-agent (>=0.17.0, <=0.17.2), manven (>=0.1.0, <=0.2.0) +4 more potentially affected by CVE-2026-102937 via virtualenv (16.7.12)

virtualenv PYPI version 16.7.12 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - clearml-agent =0.17.0, =0.1.0, =0.4.0, =0.0.1, =0.3.0.dev0, =0.13.2rc2, =0.16.3 Source cves: CVE-2026-102937 Source advisory:...

clearml-agent (>=0.17.0, <=0.17.2), manven (>=0.1.0, <=0.2.0) +4 more potentially affected by CVE-2026-102930 via virtualenv (16.7.12)

virtualenv PYPI version 16.7.12 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - clearml-agent =0.17.0, =0.1.0, =0.4.0, =0.0.1, =0.3.0.dev0, =0.13.2rc2, =0.16.3 Source cves: CVE-2026-102930 Source advisory:...

clearml-agent (>=0.17.0, <=0.17.2), manven (>=0.1.0, <=0.2.0) +4 more potentially affected by CVE-2026-102938 via virtualenv (16.7.12)

virtualenv PYPI version 16.7.12 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - clearml-agent =0.17.0, =0.1.0, =0.4.0, =0.0.1, =0.3.0.dev0, =0.13.2rc2, =0.16.3 Source cves: CVE-2026-102938 Source advisory:...

CVE-2026-7730

A weakness has been identified in privsim mcp-test-runner 0.2.0. Impacted is the function childprocess.spawn of the file src/index.ts of the component MCP Interface. Executing a manipulation of the argument command can lead to os command injection. The attack may be launched remotely. The exploit...

camp (15.2.23), directdetect (>=1.0.0, <=1.2.0) +3 more potentially affected by unknown CVE via localeval (>=13.12.11, <=15.2.3)

localeval NPM version =13.12.11, =1.0.0, =1.0.0, =1.0.1 - mocha-test-runner 0.4.3 Source cves: unknown CVE Source advisory: MEND:WS-2020-0086...

CVE-2026-7730 privsim mcp-test-runner MCP index.ts child_process.spawn os command injection

A weakness has been identified in privsim mcp-test-runner 0.2.0. Impacted is the function childprocess.spawn of the file src/index.ts of the component MCP Interface. Executing a manipulation of the argument command can lead to os command injection. The attack may be launched remotely. The exploit...

CVE-2026-7730

CVE-2026-7730 affects privsim mcp-test-runner 0.2.0. The vulnerability is in the MCP Interface’s src/index.ts where the function child_process.spawn mishandles the argument command, enabling an os command injection. Impact may be remote; exploit publicly available. Documents do not provide remedi...

CVE-2026-7730

A weakness has been identified in privsim mcp-test-runner 0.2.0. Impacted is the function childprocess.spawn of the file src/index.ts of the component MCP Interface. Executing a manipulation of the argument command can lead to os command injection. The attack may be launched remotely. The exploit...

CVE-2026-7730 privsim mcp-test-runner MCP index.ts child_process.spawn os command injection

A weakness has been identified in privsim mcp-test-runner 0.2.0. Impacted is the function childprocess.spawn of the file src/index.ts of the component MCP Interface. Executing a manipulation of the argument command can lead to os command injection. The attack may be launched remotely. The exploit...

EUVD-2026-26884

A weakness has been identified in privsim mcp-test-runner 0.2.0. Impacted is the function childprocess.spawn of the file src/index.ts of the component MCP Interface. Executing a manipulation of the argument command can lead to os command injection. The attack may be launched remotely. The exploit...

Test Runner MCP Command Injection Vulnerability

Test Runner MCP is a multi-framework testing and result-analysis tool for PrivSim individual developers. Version 0.2.0 of Test Runner MCP contains a command injection vulnerability. This vulnerability stems from the use of the childprocess.spawn function in the MCP Interface component, which allo...

CVE-2026-7730: Improper Neutralization of Special Elements used in an OS Command

A weakness has been identified in privsim mcp-test-runner 0.2.0. Impacted is the function childprocess.spawn of the file src/index.ts of the component MCP Interface. Executing a manipulation of the argument command can lead to os command injection. The attack may be launched remotely. The exploit...

Unsafe Deserialization in PHPT Code Coverage Handling

Overview A vulnerability has been discovered involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the cleanupForCoverage method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious...