hip-data-ml-utils (>=1.0.1, <=1.0.2), pytoil (0.35.0) potentially affected by CVE-2026-113723 via virtualenv (20.16.3)

virtualenv PYPI version 20.16.3 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - hip-data-ml-utils =1.0.1, =1.0.2 - pytoil 0.35.0 Source cves: CVE-2026-113723 Source advisory: OSV:GHSA-6W3R-XR62-4XCP...

bitdust-p2p (>=0.0.2, <=0.0.3), dweather-client (>=1.1.0, <=1.3.0) +1 more potentially affected by CVE-2026-113715 via virtualenv (20.0.21)

virtualenv PYPI version 20.0.21 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - bitdust-p2p =0.0.2, =1.1.0, =0.2.3, =0.2.5 Source cves: CVE-2026-113715 Source advisory: OSV:GHSA-QMX5-4P3X-WVQF...

aptos-verify (1.0.4), halludetector (0.0.2) +3 more potentially affected by CVE-2026-113715 via virtualenv (20.24.6)

virtualenv PYPI version 20.24.6 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - aptos-verify 1.0.4 - halludetector 0.0.2 - kit-big-data-to-do-list =1.1.0, =1.2.3, =2.2.1 - pytoil 0.40.0 Source cves: CVE-2026-113715...

hip-data-ml-utils (>=1.0.1, <=1.0.2), pytoil (0.35.0) potentially affected by CVE-2026-113715 via virtualenv (20.16.3)

virtualenv PYPI version 20.16.3 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - hip-data-ml-utils =1.0.1, =1.0.2 - pytoil 0.35.0 Source cves: CVE-2026-113715 Source advisory: OSV:GHSA-QMX5-4P3X-WVQF...

Roundcube-webmail-1.6.11-SQLi-PoC

Roundcube 1.6.11 — Pre-Authentication Blind SQL Injection CVE...

hip-data-ml-utils (>=1.0.1, <=1.0.2), pytoil (0.35.0) potentially affected by CVE-2026-113719 via virtualenv (20.16.3)

virtualenv PYPI version 20.16.3 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - hip-data-ml-utils =1.0.1, =1.0.2 - pytoil 0.35.0 Source cves: CVE-2026-113719 Source advisory: OSV:GHSA-HHXQ-47XX-J5XX...

aptos-verify (1.0.4), halludetector (0.0.2) +3 more potentially affected by CVE-2026-113719 via virtualenv (20.24.6)

virtualenv PYPI version 20.24.6 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - aptos-verify 1.0.4 - halludetector 0.0.2 - kit-big-data-to-do-list =1.1.0, =1.2.3, =2.2.1 - pytoil 0.40.0 Source cves: CVE-2026-113719...

EUVD-2026-105300

virtualenv: Seed replacement does not contain metadata deletion paths...

bitdust-p2p (>=0.0.2, <=0.0.3), dweather-client (>=1.1.0, <=1.3.0) +1 more potentially affected by CVE-2026-113719 via virtualenv (20.0.21)

virtualenv PYPI version 20.0.21 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - bitdust-p2p =0.0.2, =1.1.0, =0.2.3, =0.2.5 Source cves: CVE-2026-113719 Source advisory: OSV:GHSA-HHXQ-47XX-J5XX...

CVE-2026-89915

A flaw was found in the Kernel-based Virtual Machine KVM for ARM64 architectures. The VM-wide VNCR mapping counter, a mechanism designed to optimize Translation Lookaside Buffer TLB invalidations, contained several issues. These flaws could lead to situations where TLB entries are not correctly...

LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores

Summary The Postgres and SQLite stores save a namespace as its labels joined with ., so "tenant", "bob" and "tenant.bob", map to the same stored namespace. put rejected labels containing ., but get, search, delete, listnamespaces, their async versions, and ops passed directly to batch/abatch did...

GHSA-6HMW-9432-67QQ LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores

Summary The Postgres and SQLite stores save a namespace as its labels joined with ., so "tenant", "bob" and "tenant.bob", map to the same stored namespace. put rejected labels containing ., but get, search, delete, listnamespaces, their async versions, and ops passed directly to batch/abatch did...

CVE-2026-98844

A flaw was found in the Linux kernel's network filesystem netfs subsystem. When a file is extended through write operations after previous writes were performed via memory mapping, the system fails to clear stale cache data located beyond the original end of the file. A local user could exploit...

CVE-2026-98843

A flaw was found in the Linux kernel's Network Filesystem netfs subsystem. When reading data gaps around modified memory regions during streaming write operations, truncated or incomplete read responses from a remote server fail to clear unread memory buffers. As a result, stale memory contents c...

Laravel relationship inclusion can trigger unauthorized data destruction

A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data. Impact A user with only read access...

EUVD-2026-107582

Laravel relationship inclusion can trigger unauthorized data destruction...

GHSA-5WCM-3V2W-8362 Laravel relationship inclusion can trigger unauthorized data destruction

A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a request to a read-only endpoint can be crafted to trigger a destructive database operation on a related table, rather than simply retrieving data. Impact A user with only read access...

CVE-2026-115886

A flaw was found in MLflow. An unauthenticated remote attacker can conduct Server-Side Request Forgery SSRF, where the application is tricked into making unauthorized network requests to arbitrary internal or external systems. By submitting crafted serialized scorer data to affected endpoints, an...

Malicious code in @greenlake/mfe-login-url (npm)

@greenlake/mfe-login-url is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 2.0.0, 1.0.0, 3.0.0 has a postinstall script that runs node beacon.cjs on np...

MAL-2026-18318 Malicious code in @greenlake/mfe-login-url (npm)

@greenlake/mfe-login-url is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 2.0.0, 1.0.0, 3.0.0 has a postinstall script that runs node beacon.cjs on np...