193395 matches found
CVE-2026-113951
Versions of the Apple container prior to 1.5.0 are vulnerable to a security flaw where an attacker with write access to a container's filesystem can plant an exec credential plugin in /etc/kubernetes/admin.conf. When a user later pulls the cluster's kubeconfig onto a macOS host and runs kubectl, ...
CVE-2026-113951
If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes/admin.conf. kubectl will run that plugin as the macOS host user the next time someone pulls the cluster's kubeconfig onto the host with container k8s...
EUVD-2026-109181
If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes/admin.conf. kubectl will run that plugin as the macOS host user the next time someone pulls the cluster's kubeconfig onto the host with container k8s...
CVE-2026-113951
If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes/admin.conf. kubectl will run that plugin as the macOS host user the next time someone pulls the cluster's kubeconfig onto the host with container k8s...
CVE-2026-115774
A flaw was found in Twisted. An authenticated remote attacker can send a specially crafted search command with a negative size to the Internet Message Access Protocol IMAP service, triggering an infinite processing loop. This flaw leads to a Denial of Service DoS, freezing the application and...
Command Injection
Overview Affected versions of this package are vulnerable to Command Injection via insufficient escaping of the virtual environment prompt string in activate.sh when constructing PS1. When a virtualenv is created with a prompt value containing shell metacharacters such as $ or backticks, the...
GHSA-CX6F-VJHG-G3CC virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)
Summary The bash activator puts the caller-supplied prompt value into PS1 unescaped whenever promptvars is off at activation time, and assumes prompt expansion can never run afterwards. promptvars and posix mode are runtime shell state, not a property of the activation moment: re-enabling prompt...
virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)
Summary The bash activator puts the caller-supplied prompt value into PS1 unescaped whenever promptvars is off at activation time, and assumes prompt expansion can never run afterwards. promptvars and posix mode are runtime shell state, not a property of the activation moment: re-enabling prompt...
Infinite loop
Overview Twisted is an event-based network programming and multi-protocol integration framework. Affected versions of this package are vulnerable to Infinite loop via parseNestedParens in twisted/mail/imap4.py when processing an IMAP SEARCH command containing a literal with a negative octet count...
CVE-2026-115586
virtualenv is a tool for creating isolated virtual python environments. From 21.14.9 until 21.14.13, the bash bin/activate script can copy an attacker-controlled --prompt value into PS1 without escaping dollar signs or backticks when both promptvars and POSIX mode are disabled during activation...
CVE-2026-115586
virtualenv is a tool for creating isolated virtual python environments. From 21.14.9 until 21.14.13, the bash bin/activate script can copy an attacker-controlled --prompt value into PS1 without escaping dollar signs or backticks when both promptvars and POSIX mode are disabled during activation...
CVE-2026-115774 Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.mail.imap4.IMAP4Server reaches twisted.mail.imap4.parseNestedParens with a negative literal size in an authenticated SEARCH command after the client enters the selected mailbox stat...
CVE-2026-115774 Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.mail.imap4.IMAP4Server reaches twisted.mail.imap4.parseNestedParens with a negative literal size in an authenticated SEARCH command after the client enters the selected mailbox stat...
EUVD-2026-109148
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.mail.imap4.IMAP4Server reaches twisted.mail.imap4.parseNestedParens with a negative literal size in an authenticated SEARCH command after the client enters the selected mailbox stat...
CVE-2026-115774
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.mail.imap4.IMAP4Server reaches twisted.mail.imap4.parseNestedParens with a negative literal size in an authenticated SEARCH command after the client enters the selected mailbox stat...
CVE-2026-115774 Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.mail.imap4.IMAP4Server reaches twisted.mail.imap4.parseNestedParens with a negative literal size in an authenticated SEARCH command after the client enters the selected mailbox stat...
CVE-2026-115774
The Twisted framework (Python 3.6+) contains a Denial of Service vulnerability in the twisted.mail.imap4.IMAP4Server component prior to version 26.10.0rc1 . An authenticated client can send a SEARCH command with a negative literal size , which causes the parser cursor to move below zero. Due to P...
CVE-2026-115774
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.mail.imap4.IMAP4Server reaches twisted.mail.imap4.parseNestedParens with a negative literal size in an authenticated SEARCH command after the client enters the selected mailbox stat...
CVE-2026-115586
A flaw was found in virtualenv. This vulnerability allows a local attacker to achieve arbitrary code execution by supplying a crafted prompt name during virtual environment creation. Due to insufficient sanitization of special shell characters in the bash activation script, the prompt value can...
CVE-2026-115586
virtualenv is a tool for creating isolated virtual python environments. From 21.14.9 until 21.14.13, the bash bin/activate script can copy an attacker-controlled --prompt value into PS1 without escaping dollar signs or backticks when both promptvars and POSIX mode are disabled during activation...