CVE-2026-113718 virtualenv: Xonsh activation literals depend on the script decoding codec

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, POSIX xonsh activation quote uses repr to write printable non-ASCII prompt or destination data into UTF-8 activate.xsh, while xonsh can read that script using $XONSHENCODING. Under a legacy multibyte codec...

CVE-2026-113718 virtualenv: Xonsh activation literals depend on the script decoding codec

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, POSIX xonsh activation quote uses repr to write printable non-ASCII prompt or destination data into UTF-8 activate.xsh, while xonsh can read that script using $XONSHENCODING. Under a legacy multibyte codec...

CVE-2026-113718

The virtualenv tool is vulnerable to code injection in versions prior to 21.14.9 . The issue exists in the POSIX xonsh activation quote() function, which uses repr() to write non-ASCII data into the UTF-8 activate.xsh script. When using legacy multibyte codecs like GBK or Big5 , a UTF-8 trail byt...

DEBIAN-CVE-2026-113681

OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causing a heap out-of-bounds read. Attackers can supply a crafted Cineon file with a huge declared width that wraps the size...

CVE-2026-113681

OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causing a heap out-of-bounds read. Attackers can supply a crafted Cineon file with a huge declared width that wraps the size...

CVE-2026-113681 OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 Cineon Reader Heap Out-of-Bounds Read

OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causing a heap out-of-bounds read. Attackers can supply a crafted Cineon file with a huge declared width that wraps the size...

CVE-2026-113681

OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causing a heap out-of-bounds read. Attackers can supply a crafted Cineon file with a huge declared width that wraps the size...

CVE-2026-113681

The OpenImageIO library (versions before 3.0.20.0 , 3.1.x before 3.1.15.0 , and 3.2.x before 3.2.0.3-beta1 ) contains an integer overflow in the cineon::Codec::Read function. A maliciously crafted Cineon file with an excessively large declared width can cause the size calculation to wrap to zero,...

EUVD-2026-105097

OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causing a heap out-of-bounds read. Attackers can supply a crafted Cineon file with a huge declared width that wraps the size...

CVE-2026-113681 OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 Cineon Reader Heap Out-of-Bounds Read

OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causing a heap out-of-bounds read. Attackers can supply a crafted Cineon file with a huge declared width that wraps the size...

CVE-2026-113681 OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 Cineon Reader Heap Out-of-Bounds Read

OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causing a heap out-of-bounds read. Attackers can supply a crafted Cineon file with a huge declared width that wraps the size...

PT-2026-118479

OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causing a heap out-of-bounds read. Attackers can supply a crafted Cineon file with a huge declared width that wraps the size...

plex2shell

plex2shell Unauth RCE chain for Plex Media Server 1.43.3.10828. Fixed in 1.43.3.10861. Update ASAP. CVSS 3.1: 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Write-up: https://zmain.info/blog/plex2shell Disclaimer This tool is published for authorized security testing, academic research, and defensive...

CVE-2026-85246

CVE-2026-85246 — camel-mina: consumer information disclosure exception written over the socket Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the Mina consumer wroteexchange.getException straight back over the socket to the remote peer when processing of an exchange...

Academy Software Foundation OpenImageIO Digital Error Vulnerability

The Academy Software Foundation’s OpenImageIO versions prior to 3.0.20.0, as well as versions 3.1.15.0 and earlier i.e., 3.1.x series, and 3.2.0.3-beta1 and earlier i.e., 3.2.x series, contain a numerical error vulnerability. This vulnerability stems from an integer overflow in the...

CVE-2026-85246

Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Mina component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When processing of an exchange failed, the Mina consumer wrote exchange.getException straight back over...

Exploit for CVE-2026-85246

CVE-2026-85246 — camel-mina: consumer information disclosure...

EUVD-2026-104187

Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Mina component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When processing of an exchange failed, the Mina consumer wrote exchange.getException straight back over...

CVE-2026-85246 Apache Camel: Camel-Mina Information Disclosure via Unmuted Consumer Exceptions

Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Mina component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When processing of an exchange failed, the Mina consumer wrote exchange.getException straight back over...

CVE-2026-85246

The Apache Camel Mina component is vulnerable to information disclosure (CWE-209) because it writes exchange.getException() directly back to the remote peer when processing fails. Depending on the codec, this leaks the exception's class name and message (textline codec) or the serialized exceptio...