calendruparser (0.1.0), edx-repo-tools (0.8.2) +3 more potentially affected by CVE-2026-102930 via virtualenv (20.23.1)

virtualenv PYPI version 20.23.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - calendruparser 0.1.0 - edx-repo-tools 0.8.2 - engr131-2024 =0.0.1, =0.0.19, =0.1.5, =0.2.0 Source cves: CVE-2026-102930 Source advisory:...

create-fastapi (>=0.0.1, <=0.0.11), questionbankgenerator (1.0.0) potentially affected by CVE-2026-102930 via virtualenv (20.24.7)

virtualenv PYPI version 20.24.7 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - create-fastapi =0.0.1, =0.0.11 - questionbankgenerator 1.0.0 Source cves: CVE-2026-102930 Source advisory: OSV:GHSA-94P9-XGH2-XP45...

distill-trainer (>=0.1.0, <=0.1.1), edx-repo-tools (>=0.7.4, <=0.8.1) +4 more potentially affected by CVE-2026-102930 via virtualenv (20.23.0)

virtualenv PYPI version 20.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - distill-trainer =0.1.0, =0.7.4, =1.0.0b4, =1.0.1 - pytoil 0.38.2 - wolf-core 2.0.1 Source cves: CVE-2026-102930 Source advisory:...

5gasp-cli (>=0.1.0, <=0.4.0), appcensus-dynamic-repos (0.6.1.91) +33 more potentially affected by CVE-2026-102930 via virtualenv (20.21.1)

virtualenv PYPI version 20.21.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - 5gasp-cli =0.1.0, =1.1.2, =1.3.0rc1, =1.5.9, =2.3.0, =0.0.88, =0.7.7, =1.0.3, =24.9.958497, =0.5.2, =0.6.0, =0.6.4 and more Source cves:...

ablator (0.0.1b3), apollo-sdk (>=0.2.0, <=0.2.11) +29 more potentially affected by CVE-2026-102930 via virtualenv (20.21.0)

virtualenv PYPI version 20.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - ablator 0.0.1b3 - apollo-sdk =0.2.0, =0.8.3b20231012, =0.8.3b20231012, =0.6.1, =1.2.1, =0.1.3, =0.7.2, =0.2.8, =0.0.1, =1.7.16, =0.4.0rc6,...

dreem (>=0.0.0, <=0.1.16), riot (>=0.17.2, <=0.18.0) potentially affected by CVE-2026-102930 via virtualenv (20.20.0)

virtualenv PYPI version 20.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - dreem =0.0.0, =0.17.2, =0.18.0 Source cves: CVE-2026-102930 Source advisory: OSV:GHSA-94P9-XGH2-XP45...

dreamai (>=0.10.0, <=0.12.0), nb-cli (>=1.0.0, <=1.2.4) +5 more potentially affected by CVE-2026-102930 via virtualenv (20.17.1)

virtualenv PYPI version 20.17.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - dreamai =0.10.0, =1.0.0, =1.0.0, =0.1.0, =0.0.1, =0.0.1, =0.0.4 Source cves: CVE-2026-102930 Source advisory: OSV:GHSA-94P9-XGH2-XP45...

GHSA-94P9-XGH2-XP45 virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use

downloadwheel runs pip download and hands the result straight to the seeder, with nothing checking the bytes it gets back. The embedded pip and setuptools wheels carry a BUNDLESHA256 that virtualenv checks on every load, but a wheel fetched over the network for the periodic-update feature or the...

virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use

downloadwheel runs pip download and hands the result straight to the seeder, with nothing checking the bytes it gets back. The embedded pip and setuptools wheels carry a BUNDLESHA256 that virtualenv checks on every load, but a wheel fetched over the network for the periodic-update feature or the...

EUVD-2026-89462

virtualenv: Downloaded seed wheels pip/setuptools are not integrity-checked before use...

doopass (>=2.7.0, <=2.9.0), dran2 (>=0.0.5, <=0.0.6) +6 more potentially affected by CVE-2026-102930 via virtualenv (20.26.2)

virtualenv PYPI version 20.26.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - doopass =2.7.0, =0.0.5, =1.0.1, =1.0.0, =0.1.4, =0.1.0, =0.2.0 - openpy-ts-clu 0.1.0 Source cves: CVE-2026-102930 Source advisory:...

hatch (1.9.7) potentially affected by CVE-2026-102930 via virtualenv (20.25.3)

virtualenv PYPI version 20.25.3 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - hatch 1.9.7 Source cves: CVE-2026-102930 Source advisory: OSV:GHSA-94P9-XGH2-XP45...

geotify (>=0.1.0, <=0.2.0), plutomanager (0.2.0) potentially affected by CVE-2026-102930 via virtualenv (20.25.2)

virtualenv PYPI version 20.25.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - geotify =0.1.0, =0.2.0 - plutomanager 0.2.0 Source cves: CVE-2026-102930 Source advisory: OSV:GHSA-94P9-XGH2-XP45...

bblib (>=0.1.1, <=3.1.0), beambusters (>=1.0.0, <=3.1.0) +7 more potentially affected by CVE-2026-102930 via virtualenv (20.25.1)

virtualenv PYPI version 20.25.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - bblib =0.1.1, =1.0.0, =1.0.1, =0.8.4, =0.0.2, =0.0.1, =0.7.30, =1.0.0, =1.0.3, =1.0.8 Source cves: CVE-2026-102930 Source advisory:...

cashu (0.15.1), cfg-analysis-tool-py (0.1.0) +7 more potentially affected by CVE-2026-102930 via virtualenv (20.25.0)

virtualenv PYPI version 20.25.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cashu 0.15.1 - cfg-analysis-tool-py 0.1.0 - edx-repo-tools 0.8.3 - mamba-toolbox =1.2.5.22, =0.2.1, =2.0.2, =0.1.15, =0.0.7, =0.0.8 Source...

chemscad (>=2.0.1.post4, <=2.0.2) potentially affected by CVE-2026-102930 via virtualenv (20.0.31)

virtualenv PYPI version 20.0.31 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - chemscad =2.0.1.post4, =2.0.2 Source cves: CVE-2026-102930 Source advisory: OSV:GHSA-94P9-XGH2-XP45...

ciscoconfparse (>=1.6.53, <=1.7.3), pytoil (0.37.0) potentially affected by CVE-2026-102930 via virtualenv (20.16.7)

virtualenv PYPI version 20.16.7 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - ciscoconfparse =1.6.53, =1.7.3 - pytoil 0.37.0 Source cves: CVE-2026-102930 Source advisory: OSV:GHSA-94P9-XGH2-XP45...

hip-data-ml-utils (>=1.0.1, <=1.0.2), pytoil (0.35.0) potentially affected by CVE-2026-102930 via virtualenv (20.16.3)

virtualenv PYPI version 20.16.3 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - hip-data-ml-utils =1.0.1, =1.0.2 - pytoil 0.35.0 Source cves: CVE-2026-102930 Source advisory: OSV:GHSA-94P9-XGH2-XP45...

hlvox (0.3.10), python-whiteprint (0.7.0) +2 more potentially affected by CVE-2026-102930 via virtualenv (20.16.5)

virtualenv PYPI version 20.16.5 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - hlvox 0.3.10 - python-whiteprint 0.7.0 - traffic-guardian =1.0.1, =0.1.9, =0.3.7 Source cves: CVE-2026-102930 Source advisory:...

ducktape (0.7.16), gym-simplifiedtetris-avela (0.1.6) +3 more potentially affected by CVE-2026-102930 via virtualenv (20.16.2)

virtualenv PYPI version 20.16.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - ducktape 0.7.16 - gym-simplifiedtetris-avela 0.1.6 - pgsync =2.4.0, =1.66.5, =2.3.3 Source cves: CVE-2026-102930 Source advisory:...