SUSE SLES15: kubernetes1.37-client / kubernetes1.37-client-bash-completion / etc (SUSE-SU-2026:4901-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4901-1 advisory. This update for kubernetes rebuilds it against the current go security release. Tenable has extracted the preceding description block direct...

Linux Distros Unpatched Vulnerability : CVE-2026-115586

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. From 21.14.9 until 21.14.13, the bash bin/activate script can copy an attacker-controlle...

C-A-S

C.A.S-Exploit CVE-2017-5689 research and validation toolkit Crypto Anarchy Squad C.A.S @anarchysquad An archived Python/Bash proof of concept for investigating the Intel AMT authentication-bypass issue tracked as CVE-2017-5689. Use only against devices and networks you own or are explicitly...

UBUNTU-CVE-2026-115586

virtualenv is a tool for creating isolated virtual python environments. From 21.14.9 until 21.14.13, the bash bin/activate script can copy an attacker-controlled --prompt value into PS1 without escaping dollar signs or backticks when both promptvars and POSIX mode are disabled during activation...

CVE-2018-7600

Proof-Of-Concept for CVE-2018-7600 / SA-CORE-2018-002 codebeat badge Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations. H...

openSUSE 16: docker / docker-bash-completion / docker-buildx / etc (openSUSE-SU-2026:22158-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22158-1 advisory. Security issues fixed: - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc126578...

PHP Session Upload Progress Mitigation

A Bash utility that audits common PHP configuration layouts and can disable session upload progress as a temporary mitigation for an unlikely remote code execution vector...

SUSE CVE-2026-113725

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.7, the bash activate script escapes the environment name for only one of the two passes bash makes over PS1, so a backslash in the name undoes the escaping and a name containing $... runs as commands in the...

SUSE CVE-2026-113726

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASHVERSION is set, so zsh...

SUSE CVE-2026-113776

virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiatetemplate replaces placeholders one key at a time across the complete activation template, so trigger names such as VIRTUALNAME, VIRTUALENV, or VIRTUALPROMPT inside a...

virtualenv: Bash prompt values can change meaning under older compatibility modes

Summary Caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt. Affected area Bash runs with compatibility level 4.2 and draws the...

GHSA-6W3R-XR62-4XCP virtualenv: Bash prompt values can change meaning under older compatibility modes

Summary Caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt. Affected area Bash runs with compatibility level 4.2 and draws the...

EUVD-2026-105271

virtualenv: Bash prompt values can change meaning under older compatibility modes...

virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)

Summary The bash activator puts the caller-supplied prompt value into PS1 unescaped whenever promptvars is off at activation time, and assumes prompt expansion can never run afterwards. promptvars and posix mode are runtime shell state, not a property of the activation moment: re-enabling prompt...

CVE-2026-115586

virtualenv is a tool for creating isolated virtual python environments. From 21.14.9 until 21.14.13, the bash bin/activate script can copy an attacker-controlled --prompt value into PS1 without escaping dollar signs or backticks when both promptvars and POSIX mode are disabled during activation...

CVE-2026-115586

virtualenv is a tool for creating isolated virtual python environments. From 21.14.9 until 21.14.13, the bash bin/activate script can copy an attacker-controlled --prompt value into PS1 without escaping dollar signs or backticks when both promptvars and POSIX mode are disabled during activation...

CVE-2026-115586

A flaw was found in virtualenv. This vulnerability allows a local attacker to achieve arbitrary code execution by supplying a crafted prompt name during virtual environment creation. Due to insufficient sanitization of special shell characters in the bash activation script, the prompt value can...

CVE-2026-115586

virtualenv is a tool for creating isolated virtual python environments. From 21.14.9 until 21.14.13, the bash bin/activate script can copy an attacker-controlled --prompt value into PS1 without escaping dollar signs or backticks when both promptvars and POSIX mode are disabled during activation...

CVE-2026-115586 virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)

virtualenv is a tool for creating isolated virtual python environments. From 21.14.9 until 21.14.13, the bash bin/activate script can copy an attacker-controlled --prompt value into PS1 without escaping dollar signs or backticks when both promptvars and POSIX mode are disabled during activation...

CVE-2026-115586

The virtualenv tool (versions 21.14.9 through 21.14.13 ) contains a regression where the bash bin/activate script fails to escape dollar signs or backticks in the --prompt value when promptvars and POSIX mode are disabled. This allows an attacker to inject command substitutions into the PS1 promp...