CVE-2026-92390

When invoked with "--remote-header-name" "-J", curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an "ETag" header is processed before "Content-Disposition" under "--etag-save". This flaw allows an...

CVE-2026-92390

The curl command-line tool fails to maintain its documented anti-clobbering protection when the --remote-header-name (-J) option is used. A malicious HTTP(S) server can bypass this protection by providing an intermediate 103 Early Hints response or by processing an ETag header before a Content-Di...

EUVD-2026-105320

When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTPS serve...

CVE-2026-113721

A flaw was found in virtualenv. A local attacker can exploit this issue by pre-creating symbolic or hard links in a destination directory before an environment is set up. Because virtualenv does not properly check or replace existing links when writing configuration and activation files, it can...

DEBIAN-CVE-2026-113721

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator.generate removes an existing output only when Path.exists is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write opens pyvenv.cfg...

AZL-110121 CVE-2026-113719 affecting package python-virtualenv 20.36.1-6

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall.uninstallpreviousversion accepts existing seed-package metadata and uninstalldist joins entries from toplevel.txt and RECORD to site-packages without checking containment. When a reused destinatio...

DEBIAN-CVE-2026-113719

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall.uninstallpreviousversion accepts existing seed-package metadata and uninstalldist joins entries from toplevel.txt and RECORD to site-packages without checking containment. When a reused destinatio...

CVE-2026-113719

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall.uninstallpreviousversion accepts existing seed-package metadata and uninstalldist joins entries from toplevel.txt and RECORD to site-packages without checking containment. When a reused destinatio...

CVE-2026-113721

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator.generate removes an existing output only when Path.exists is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write opens pyvenv.cfg...

CVE-2026-113719

A flaw was found in virtualenv. This vulnerability allows a local attacker to cause arbitrary file deletion outside the target environment directory. When creating an isolated environment in a reused directory, virtualenv processes existing package metadata during cleanup without verifying that...

CVE-2026-113716

A flaw was found in virtualenv. When creating an isolated environment, directory validation resolves existing symbolic links symlinks rather than verifying the intended target destination. A local attacker could exploit this vulnerability by pre-creating a directory tree containing symlinks...

CVE-2026-112948

A flaw was found in vitest. Vitest development servers fail to properly enforce file access restrictions, permitting access to paths that should be denied. An attacker who can reach an affected development server or who tricks a user into visiting a malicious website can exploit this flaw to read...

CVE-2026-112942

A flaw was found in launch-editor. This vulnerability can allow a remote attacker to achieve arbitrary command execution on Windows systems. By submitting a specially crafted file path containing line and column suffixes, an attacker can bypass file existence checks due to improper path validatio...

Exploit for CVE-2026-87690

CVE-2026-87690 Path traversal CWE-22 in Metasploit Framewor...

CVE-2026-112940

A flaw was found in filelock. When utilizing the ReadWriteLock mechanism, the component reopens SQLite database and auxiliary files by file path rather than retaining secure file descriptors. A local attacker with file renaming permissions in a shared directory can swap these filenames during...

CVE-2026-113672

A flaw was found in Argo CD. When processing Jsonnet files, the application does not restrict file imports to the intended repository, allowing files outside of it to be read. This can lead to disclosure of sensitive information, such as credentials and access tokens, and may also result in a...

EUVD-2026-104482

AIOHTTP: File descriptor exhaustion in multipart requests...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via multipart message handling in aiohttp/webrequest.py, where each body part in a multipart request previously opened a dedicated temporary file descriptor. An attacker can send a...

org.ow2.asm/asm: OW2 ASM: Denial of Service via infinite loop in Label.resolve()

A flaw was found in OW2 ASM. An attacker can cause a Denial of Service DoS by supplying a specially crafted Java class file with methods that grow beyond 64 kilobytes during transformation. When processing this file, an offset truncation error triggers an infinite loop within the method resolutio...

CVE-2026-113721

The virtualenv tool is vulnerable to a link-following issue prior to version 21.14.9 . The root cause lies in ViaTemplateActivator._generate() only removing existing output if Path.exists() is true, which allows a dangling symlink to persist and redirect generated activation content. Additionally...