CVE-2026-113672

A flaw was found in Argo CD. When processing Jsonnet files, the application does not restrict file imports to the intended repository, allowing files outside of it to be read. This can lead to disclosure of sensitive information, such as credentials and access tokens, and may also result in a...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via multipart message handling in aiohttp/webrequest.py, where each body part in a multipart request previously opened a dedicated temporary file descriptor. An attacker can send a...

EUVD-2026-104482

AIOHTTP: File descriptor exhaustion in multipart requests...

org.ow2.asm/asm: OW2 ASM: Denial of Service via infinite loop in Label.resolve()

A flaw was found in OW2 ASM. An attacker can cause a Denial of Service DoS by supplying a specially crafted Java class file with methods that grow beyond 64 kilobytes during transformation. When processing this file, an offset truncation error triggers an infinite loop within the method resolutio...

CVE-2026-113721 virtualenv: Generated files can follow existing destination links

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator.generate removes an existing output only when Path.exists is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write opens pyvenv.cfg...

CVE-2026-113721

The virtualenv tool is vulnerable to a link-following issue prior to version 21.14.9 . The root cause lies in ViaTemplateActivator._generate() only removing existing output if Path.exists() is true, which allows a dangling symlink to persist and redirect generated activation content. Additionally...

CVE-2026-113721

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator.generate removes an existing output only when Path.exists is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write opens pyvenv.cfg...

CVE-2026-113721 virtualenv: Generated files can follow existing destination links

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator.generate removes an existing output only when Path.exists is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write opens pyvenv.cfg...

CVE-2026-113721

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator.generate removes an existing output only when Path.exists is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write opens pyvenv.cfg...

CVE-2026-113720 virtualenv: Seeded files retain permissions from an older cache

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data copy seeder uses shutil.copy to copy cached package files into later environments, causing cached source modes to override the current run's umask. A cache populated under a permissive umask can...

CVE-2026-113719 virtualenv: Seed replacement does not contain metadata deletion paths

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall.uninstallpreviousversion accepts existing seed-package metadata and uninstalldist joins entries from toplevel.txt and RECORD to site-packages without checking containment. When a reused destinatio...

CVE-2026-113719

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall.uninstallpreviousversion accepts existing seed-package metadata and uninstalldist joins entries from toplevel.txt and RECORD to site-packages without checking containment. When a reused destinatio...

CVE-2026-113719

The virtualenv tool is vulnerable to a path traversal issue prior to version 21.14.9 . The PipInstall._uninstall_previous_version() function accepts existing seed-package metadata, and _uninstall_dist() joins entries from top_level.txt and RECORD without verifying directory containment. If a reus...

CVE-2026-113719 virtualenv: Seed replacement does not contain metadata deletion paths

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall.uninstallpreviousversion accepts existing seed-package metadata and uninstalldist joins entries from toplevel.txt and RECORD to site-packages without checking containment. When a reused destinatio...

CVE-2026-113719 virtualenv: Seed replacement does not contain metadata deletion paths

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall.uninstallpreviousversion accepts existing seed-package metadata and uninstalldist joins entries from toplevel.txt and RECORD to site-packages without checking containment. When a reused destinatio...

CVE-2026-113719

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall.uninstallpreviousversion accepts existing seed-package metadata and uninstalldist joins entries from toplevel.txt and RECORD to site-packages without checking containment. When a reused destinatio...

CVE-2026-111925

A flaw was found in Mopidy. A remote, unauthenticated attacker can access local files outside the configured media directories due to missing path containment checks in the file library component. By sending requests with manipulated file paths over network interfaces, an attacker can determine...

CVE-2026-112944

A flaw was found in launch-editor. This vulnerability can lead to arbitrary command execution or unintended file overwrite due to improper handling of file paths when invoking external text editors. An attacker capable of creating files with leading special characters in the working directory can...

CVE-2026-109831

A flaw was found in UnRTF. By tricking a user into opening a specially crafted Rich Text Format RTF file, a remote attacker can trigger an out-of-bounds write. This issue can cause the application to crash, resulting in a Denial of Service DoS condition...

CVE-2026-113708

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.7.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Kustomize passes ref or version query values from remote resource, base, or component URLs to git fetch without an end-of-options separator. A leading-hyphen value can ...