CVE-2026-114110

Astral uv versions before 0.11.6 are vulnerable to a path traversal vulnerability (CWE-23). An attacker can craft a malicious wheel package containing RECORD entries with relative traversal paths. When a user uninstalls the affected package, uv may delete arbitrary files located outside the insta...

CVE-2026-113717 virtualenv: Pip seeding with download omits wheel digest verification

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInvoke.getpipinstallcmd handles --seeder pip --download by calling getwheeldownload=False and then allowing pip to consult the configured index, bypassing virtualenv's downloadwheel and verifywheeldigest...

CVE-2026-113717

The virtualenv tool for creating isolated Python environments is vulnerable to a digest verification bypass in versions prior to 21.14.9 . The root cause lies in the PipInvoke.get_pip_install_cmd() function, which handles --seeder pip --download by calling get_wheel(download=False). This allows p...

EUVD-2026-105260

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, downloadwheel writes package-index downloads directly into the reusable wheel/house cache before selecting a verification target from pip's textual Saved output. With default-index digest comparison enabled,...

CVE-2026-113714 virtualenv: Downloaded wheel selection and caching precede verification

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, downloadwheel writes package-index downloads directly into the reusable wheel/house cache before selecting a verification target from pip's textual Saved output. With default-index digest comparison enabled,...

CVE-2026-113714

The virtualenv tool, versions 21.14.8 through 21.14.9 , contains a vulnerability in the download_wheel() function. The root cause is that downloaded package-index data is written directly into the reusable wheel/house cache before the verification target is selected from pip's textual output. If ...

wheelaudit

wheelaudit Python Wheel File Security Scanner — scan .whl files for security issues before installation. Motivated by recent CVEs in Python wheel handling: CVE-2026-24049 : Path traversal in wheel unpack allows permission manipulation of system files CVE-2026-1703 : Path traversal when pip instal...

sashay

Sashay Introduction ℹ️ Sashay is an all in one automatic installer for useful Linux based tools.There are over 340 tools available. Installation⬇️ pip install -U sashay Tool Categories Information Gathering Vulnerability Scanner Exploitation Tools Wireless Testing Forensics Tools Web Hacking Stress...

CVE-2026-98707

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: shut down RX BA session timer on teardown Tearing down an RX BA session can leave the session timer queued on a freed tidrx. Later timer-wheel processing and the timer callback itself then run against freed memory...

EUVD-2026-103961

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: shut down RX BA session timer on teardown Tearing down an RX BA session can leave the session timer queued on a freed tidrx. Later timer-wheel processing and the timer callback itself then run against freed memory...

Security update for python-virtualenv (important)

openSUSE security update: security update for python-virtualenv ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22100-1 Rating: important References: bsc1283890 bsc1283904 Cross-References: CVE-2026-102930 CVE-2026-102938 CVSS scores: CVE-2026-10293...

ROOT-APP-PYPI-CVE-2026-24049 CVE-2026-24049 in setuptools - Patched by Root

Root has patched CVE-2026-24049 in the setuptools package for Root:PyPI. Multiple fixed versions available...

uv: Path traversal on Windows through wheel extraction

ImpactIn versions of uv from 0.12.7 to 0.12.18 on Windows, uv could be induced into writing a file outside of the installation prefix during wheel installation.A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present on...

PYSEC-2026-4305 uv: Path traversal on Windows through wheel extraction

Impact In versions of uv from 0.12.7 to 0.12.18 on Windows, uv could be induced into writing a file outside of the installation prefix during wheel installation. A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present o...

CVE-2026-106031

The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones...

CVE-2026-106031

The Spin Wheel WordPress plugin, in versions prior to 2.2.1 , is vulnerable to Unauthenticated Coupon Code Disclosure due to a lack of verification that a visitor performed a legitimate spin. Attackers can forge spin results to disclose and drain stored prize coupon codes from any campaign, inclu...

CVE-2026-106031 Spin Wheel < 2.2.1 - Unauthenticated Coupon Code Disclosure via Forged Spin Result

The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones...

EUVD-2026-101851

The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones...

CVE-2026-106031 Spin Wheel < 2.2.1 - Unauthenticated Coupon Code Disclosure via Forged Spin Result

The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones...

WordPress Spin Wheel plugin < 2.2.1 - Unauthenticated Coupon Code Disclosure vulnerability

Unauthenticated Coupon Code Disclosure vulnerability discovered by Aditya Gurav in WordPress Plugin Spin Wheel versions 2.2.1...