CVE-2026-114663

Vyper versions 0.4.0b1 through 0.5.0b1 are vulnerable to a name shadowing issue affecting unfoldable constants and omitted default arguments from imported modules. The root cause is that the parse_Name function resolves these names within the using function's scope instead of at the point of decl...

CVE-2026-114663 Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments

Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parseName resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name,...

RestrictedPython guard hooks can be shadowed via positional-only arguments

ImpactRestrictedPython rewrites sensitive operations to go through guard hooks. Attribute access becomes getattrobj, name, item access becomes getitemobj, key, writes go through write, and print goes through print. The embedding application supplies these hooks to enforce its policy.Argument-name...

CVE-2020-26284

Hugo is a fast and Flexible Static Site Generator built in Go. Hugo depends on Go's os/exec for certain features, e.g. for rendering of Pandoc documents if these binaries are found in the system %PATH% on Windows. In Hugo before version 0.79.1, if a malicious file with the same name exe or bat is...