CVE-2026-102925 virtualenv bash and fish activation scripts execute commands embedded in paths

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate bash and zsh and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path...

CVE-2026-102925

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate bash and zsh and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path...

CVE-2026-102925 virtualenv bash and fish activation scripts execute commands embedded in paths

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate bash and zsh and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path...

CVE-2026-102925

The virtualenv tool (prior to version 21.7.13 ) contains a vulnerability where the generated activate (bash/zsh) and activate.fish scripts incorrectly nest values already escaped by shlex.quote within an additional quoted context. Specifically, a crafted virtual environment path can reach __VIRTU...

CVE-2026-102925 virtualenv bash and fish activation scripts execute commands embedded in paths

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate bash and zsh and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path...

gawk: Gawk: Buffer overflow in ftype() routine may lead to code execution or denial of service

A flaw was found in gawk. A buffer overflow vulnerability exists in the ftype routine, located in the extension/readdir.c program file. This vulnerability could allow an attacker to crash the program, resulting in a denial of service. It may also potentially lead to arbitrary code execution, thou...

Moderate: Red Hat Security Advisory: gawk security update

An update for gawk is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

gawk: Gawk: Buffer overflow in ftype() routine may lead to code execution or denial of service

A flaw was found in gawk. A buffer overflow vulnerability exists in the ftype routine, located in the extension/readdir.c program file. This vulnerability could allow an attacker to crash the program, resulting in a denial of service. It may also potentially lead to arbitrary code execution, thou...

Moderate: Red Hat Security Advisory: gawk security update

An update for gawk is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

[SECURITY] [DSA 6529-1] libwebsockets security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6529-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 29, 2026 https://www.debian.org/security/faq -...

Arbitrary Command Injection

Overview simple-git is a light weight interface for running git commands in any node.js application. Affected versions of this package are vulnerable to Arbitrary Command Injection via the blockUnsafeOperationsPlugin, which fails to block dangerous git options such as --upload-pack, --receive-pac...

Security Bulletin: InfoSphere Data Replication - Data Replication for Availability is affected by arbitrary code execution, cross-site scripting, and denial of service

Summary IBM has released the below fix for IBM InfoSphere Data Replication - Data Replication for Availability Db2U Qreplication container in response to multiple vulnerabilities. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2026-33916...

CVE-2026-102316

A flaw was found in chromium-browser. A use-after-free issue in the Views framework allows a remote attacker to execute arbitrary code outside the browser sandbox by tricking a user into visiting a specially crafted HTML page. Exploitation of this vulnerability occurs when the application...

CVE-2026-102306

A flaw was found in chromium-browser's Bluetooth component. A remote attacker could exploit this vulnerability by enticing a user to visit a specially crafted HTML page. This triggers a use-after-free condition—where the application accesses memory that has already been deallocated—potentially...

CVE-2026-79538

metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution in the internal MCP inspector proxy endpoint GET /mcp-proxy/server/stdio createTransport, STDIO branch, routers/mcp-proxy/server.ts...

CVE-2026-79403

An issue in Kilo Code before v7.4.1 allows a local attacker to execute arbitrary code via the permission/allow-everything endpoint...

CVE-2026-76732

A local privilege-escalation vulnerability has been discovered in the affected daemon of HPE Networking Instant ON. Successful exploitation of this vulnerability could allow a local attacker to achieve arbitrary code execution with root privileges if certain preconditions are met outside of the...

CVE-2026-76729

A format string vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to cause memory corruption with a modified input. Successful exploitation could allow an attacker to provoke a denial-of-service condition or remote...

CVE-2026-76722

Uncontrolled Format string vulnerabilities exist in the affected interface of HPE Networking Instant ON APs that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host. Successful exploitation could result in a Denial-of-service or potential remote code...

CVE-2026-76725

A vulnerability has been identified in a management protocol of HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could result in a complete bypass of security restrictions, potentially leadi...