Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via the onerror handler in src/virtualenv/util/path/sync.py, which previously called os.chmod on a path without first checking whether it is a symbolic link. On Windows, when a read-only file cannot be deleted during a tr...

CVE-2026-113721 virtualenv: Generated files can follow existing destination links

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator.generate removes an existing output only when Path.exists is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write opens pyvenv.cfg...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via ViaTemplateActivator.generate in src/virtualenv/activation/viatemplate.py, which checks whether a destination file exists with Path.exists before unlinking it and writing new content. A local attacker who can race the...

CVE-2026-113720 virtualenv: Seeded files retain permissions from an older cache

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data copy seeder uses shutil.copy to copy cached package files into later environments, causing cached source modes to override the current run's umask. A cache populated under a permissive umask can...

CVE-2026-113720

The virtualenv tool (prior to version 21.14.9 ) contains a vulnerability where the app-data copy seeder uses shutil.copy() to move cached package files into new environments. This causes files to retain source modes from a previous cache, potentially overriding the current run's umask . If the ca...

CVE-2026-80353

A flaw was found in Apache Tomcat. A local attacker can gain unauthorized access to Unix domain communication sockets due to a time-of-check to time-of-use TOCTOU race condition in the APR/Native connector. When the connector initializes a socket, a brief timing window exists before restrictive...

CVE-2026-111925

A flaw was found in Mopidy. A remote, unauthenticated attacker can access local files outside the configured media directories due to missing path containment checks in the file library component. By sending requests with manipulated file paths over network interfaces, an attacker can determine...

CVE-2026-113716

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the builtin creator calls ensuredir for executable, library, and package directories, and ensuredir accepts an existing symlink to a directory because exists follows it. Interpreter creation, seed...

CVE-2026-113716 virtualenv: Builtin creation follows linked environment directories

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the builtin creator calls ensuredir for executable, library, and package directories, and ensuredir accepts an existing symlink to a directory because exists follows it. Interpreter creation, seed...

CVE-2026-113716

The virtualenv tool, prior to version 21.14.9 , is vulnerable to a symlink following issue during builtin environment creation. The ensure_dir() function improperly follows existing symlinks for executable, library, and package directories. If a local attacker prepares a tree containing a symlink...

CVE-2026-113716

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the builtin creator calls ensuredir for executable, library, and package directories, and ensuredir accepts an existing symlink to a directory because exists follows it. Interpreter creation, seed...

CVE-2026-113716 virtualenv: Builtin creation follows linked environment directories

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the builtin creator calls ensuredir for executable, library, and package directories, and ensuredir accepts an existing symlink to a directory because exists follows it. Interpreter creation, seed...

CVE-2026-113716 virtualenv: Builtin creation follows linked environment directories

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the builtin creator calls ensuredir for executable, library, and package directories, and ensuredir accepts an existing symlink to a directory because exists follows it. Interpreter creation, seed...

CVE-2026-113643

A vulnerability was found in EspoCRM up to 9.3.10/10.0.10. This affects the function ImageSourceProvider::get of the file application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.php of the component PDF Rendering Pipeline. Performing a manipulation of the argument ID results in authorization bypass...

CVE-2026-113867 Stanza injection in XMPP chat

Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request that caused Thunderbird to inject arbitrary stanzas into the user's connection, which th...

CVE-2026-113867 Stanza injection in XMPP chat

Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request that caused Thunderbird to inject arbitrary stanzas into the user's connection, which th...

EUVD-2026-105294

Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request that caused Thunderbird to inject arbitrary stanzas into the user's connection, which th...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via the FromAppData seed mechanism in src/virtualenv/seed/embed/viaappdata/viaappdata.py, when symlinkappdata is enabled against a transient temporary app-data store. In this configuration, virtualenv creates symlinks fro...

CVE-2026-112936

A flaw was found in filelock. The ReadWriteLock component does not properly reject symbolic links shortcuts pointing to another file path when resolving lock paths. A local user with write permissions in the lock directory can exploit this vulnerability to redirect lock file creation and database...

CVE-2026-112941

A flaw was found in filelock. The SoftReadWriteLock and AsyncSoftReadWriteLock mechanisms cache an initial directory check but resolve path names again during subsequent record operations. A local attacker can exploit this behavior by replacing the lock directory structure after its initial...