GHSA-4F8H-VR72-P32C virtualenv: Temporary app-data can leave dangling seed package links

Summary The app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlinkappdata can enable this state even though the command-line flag is disabled for temporary app-data...

GHSA-CX28-75Q4-X26Q virtualenv: Pip seeding with download omits wheel digest verification

Summary The pip seeder acquires bundled wheels with download=False and lets pip access the index when --download is selected. Index candidates on that path do not pass through virtualenv's wheel digest verification. Anthropic's OSS Scanner reported this as ANT-2026-74ALJBUF in...

GHSA-494P-63J8-28P3 virtualenv: Downloaded wheel selection and caching precede verification

Summary Wheel downloads go directly into the reusable wheelhouse, while the verification target is selected from pip's textual output. A verification failure does not remove the downloaded file from that cache. Anthropic's OSS Scanner reported this as ANT-2026-ST00DRO3 in virtualenv-20261015-005,...

GHSA-394H-QWMC-48PF virtualenv: Xonsh activation literals depend on the script decoding codec

Summary Caller-supplied prompt text can become executable syntax in the xonsh activation script. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment. Affected area Xonsh reads a UTF-8 activation script using a legacy multibyte encoding...

GHSA-FC2G-4W5P-6WHM virtualenv: Seeded files retain permissions from an older cache

Summary The app-data copy seeder uses shutil.copy, which preserves cached file modes independently of the current umask. A cache populated under permissive permissions can therefore produce files with wider access in later environments. Anthropic's OSS Scanner reported this as ANT-2026-487MH6OW i...

GHSA-6W3R-XR62-4XCP virtualenv: Bash prompt values can change meaning under older compatibility modes

Summary Caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and draw the prompt. Affected area Bash runs with compatibility level 4.2 and draws the...

GHSA-QMX5-4P3X-WVQF virtualenv: Venv configuration readback can reinterpret path boundaries

Summary The venv creator reads the standard library's generated pyvenv.cfg with splitlines and merges all resulting keys over virtualenv's configuration. Line-boundary characters from destination data can therefore become configuration structure before output sanitization. Anthropic's OSS Scanner...

CVE-2026-115938

Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper, outside Twig’s SecurityPolicy. Repeated single-segment...

CVE-2026-115883

LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and agents. Prior to langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2, PostgresStore, AsyncPostgresStore, SqliteStore, and AsyncSqliteStore flatten namespace labels...

CVE-2026-115885

The LangGraph CLI is the official command-line interface for LangGraph. From 0.4.15 until 0.4.32, langgraph deploy --verbose passes a temporary registry push token on standard input to docker login --password-stdin, but the CLI subprocess helper prints command input in verbose mode. Anyone who ca...

Storm-Breaker

⚡ Storm-Breaker v4.0 Advanced Social Engineering & Browse...

GHSA-6HMW-9432-67QQ LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores

Summary The Postgres and SQLite stores save a namespace as its labels joined with ., so "tenant", "bob" and "tenant.bob", map to the same stored namespace. put rejected labels containing ., but get, search, delete, listnamespaces, their async versions, and ops passed directly to batch/abatch did...

filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse

SoftFileLock and MarkerSoftFileLock evict an unparsable marker the lock file at , whose presence says a process holds the lock once a waiting contender has watched it unchanged for two seconds. SoftFileLease expires a lease the same way. The watch tells two looks apart by the marker's modificatio...

filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory

When a soft-lock stale break finds that the marker the lock file at it renamed aside was a live one recreated by a successor, the restore branch of breaklockfile checks the break name with lstat a check that reads a name without following a symbolic link and then calls os.linkbreakpath, lockfile ...

GHSA-CRV4-6MHJ-J5JH filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory

When a soft-lock stale break finds that the marker the lock file at it renamed aside was a live one recreated by a successor, the restore branch of breaklockfile checks the break name with lstat a check that reads a name without following a symbolic link and then calls os.linkbreakpath, lockfile ...

CVE-2026-115938

Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper, outside Twig’s SecurityPolicy. Repeated single-segment...

CVE-2026-115938 Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE

Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper, outside Twig’s SecurityPolicy. Repeated single-segment...

GHSA-5X8W-8JJ5-Q52H Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution

Credits Researcher: Alex Bouffard [email protected] Summary A heap buffer overflow in Pillow's FlashPix FPX JPEG-tile decoder lets an attacker achieve arbitrary code execution by getting an application to open a single crafted file with Image.open. The file is recognized by content the OLE2...

Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution

Credits Researcher: Alex Bouffard [email protected] Summary A heap buffer overflow in Pillow's FlashPix FPX JPEG-tile decoder lets an attacker achieve arbitrary code execution by getting an application to open a single crafted file with Image.open. The file is recognized by content the OLE2...

GHSA-VQQP-X5QM-5QP4 FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization server

Maintainer assessment and remediation This report is accepted as a FastMCP credential-binding vulnerability. Affected versions of the OAuth client credentials providers do not expose the authorization-server issuer that owns pre-registered credentials. An untrusted or compromised MCP server can...