CVE-2026-113731 djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. From 0.9.0 until 1.0.10, 1.1.7, 1.2.4, and 1.3.0rc8, the findhandlersfortemplate MCP tool in python/djust/mcp/server.py accepts an existing absolute templatepath and reads it without...

CVE-2026-83404

A vulnerability exists in the Connector/Python component of the Oracle MySQL Connectors product (affected version 26.7.0 ). This easily exploitable flaw allows an unauthenticated attacker with network access via multiple protocols to compromise the connectors. Successful exploitation can lead to ...

CVE-2026-83404

Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/Python. The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attac...

CVE-2026-83404

Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/Python. The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attac...

helperpy (>=0.0.1, <=0.0.4), higlass-python (0.4.6) +4 more potentially affected by CVE-2026-112397 via pillow (8.3.0)

pillow PYPI version 8.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - helperpy =0.0.1, =0.0.2, =0.0.22 - seleniumbase 1.63.14 - workflow-nodes 0.7.0 Source cves: CVE-2026-112397 Source advisory: OSV:GHSA-58R4-6RV3-GFH8...

helperpy (>=0.0.1, <=0.0.4), higlass-python (0.4.6) +4 more potentially affected by CVE-2026-112896 via pillow (8.3.0)

pillow PYPI version 8.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - helperpy =0.0.1, =0.0.2, =0.0.22 - seleniumbase 1.63.14 - workflow-nodes 0.7.0 Source cves: CVE-2026-112896 Source advisory: OSV:GHSA-PCHR-8J38-3X4P...

helperpy (>=0.0.1, <=0.0.4), higlass-python (0.4.6) +4 more potentially affected by CVE-2026-112403 via pillow (8.3.0)

pillow PYPI version 8.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - helperpy =0.0.1, =0.0.2, =0.0.22 - seleniumbase 1.63.14 - workflow-nodes 0.7.0 Source cves: CVE-2026-112403 Source advisory: OSV:GHSA-8G5G-8VMR-9782...

AZL-110115 CVE-2026-113725 affecting package python-virtualenv 20.36.1-6

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.7, the bash activate script escapes the environment name for only one of the two passes bash makes over PS1, so a backslash in the name undoes the escaping and a name containing $... runs as commands in the...

AZL-110121 CVE-2026-113719 affecting package python-virtualenv 20.36.1-6

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall.uninstallpreviousversion accepts existing seed-package metadata and uninstalldist joins entries from toplevel.txt and RECORD to site-packages without checking containment. When a reused destinatio...

AZL-110112 CVE-2026-113722 affecting package python-virtualenv 20.36.1-6

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, virtualenv's ScriptMakerCustom and pip pass an incompletely quoted interpreter path to distlib ScriptMaker when generating POSIX console scripts. When the path contains a space or produces a shebang longer...

AZL-110097 CVE-2026-113723 affecting package python-virtualenv 20.36.1-6

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and dr...

AZL-110118 CVE-2026-113720 affecting package python-virtualenv 20.36.1-6

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data copy seeder uses shutil.copy to copy cached package files into later environments, causing cached source modes to override the current run's umask. A cache populated under a permissive umask can...

AZL-110124 CVE-2026-113721 affecting package python-virtualenv 20.36.1-6

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator.generate removes an existing output only when Path.exists is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write opens pyvenv.cfg...

AZL-110094 CVE-2026-113716 affecting package python-virtualenv 20.36.1-6

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the builtin creator calls ensuredir for executable, library, and package directories, and ensuredir accepts an existing symlink to a directory because exists follows it. Interpreter creation, seed...

AZL-110109 CVE-2026-113715 affecting package python-virtualenv 20.36.1-6

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv creator reads generated pyvenv.cfg with str.splitlines and merges parsed keys over virtualenv's selected configuration. An untrusted caller who influences the destination pathname can include...

EUVD-2026-104484

AIOHTTP: Absolute-form request targets can spoof Request.scheme...

GHSA-PQXQ-W44R-73XW AIOHTTP: Pure-Python parser request smuggling

Summary The pure Python parser is vulnerable to an HTTP request smuggling attack. Impact If users are using the Python parser AIOHTTPNOEXTENSIONS, or not a standard wheel installed, then an application may be vulnerable to a request smuggling attack. Workaround Switch to the default C parser...

AIOHTTP: Pure-Python parser request smuggling

Summary The pure Python parser is vulnerable to an HTTP request smuggling attack. Impact If users are using the Python parser AIOHTTPNOEXTENSIONS, or not a standard wheel installed, then an application may be vulnerable to a request smuggling attack. Workaround Switch to the default C parser...

CVE-2026-113719 virtualenv: Seed replacement does not contain metadata deletion paths

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall.uninstallpreviousversion accepts existing seed-package metadata and uninstalldist joins entries from toplevel.txt and RECORD to site-packages without checking containment. When a reused destinatio...

CVE-2026-113714

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, downloadwheel writes package-index downloads directly into the reusable wheel/house cache before selecting a verification target from pip's textual Saved output. With default-index digest comparison enabled,...