azure-devops-artifacts-helpers (>=1.0.8, <=1.0.9), hip-data-ml-utils (>=0.3.7, <=1.0.0) +2 more potentially affected by CVE-2026-113721 via virtualenv (20.4.2)

virtualenv PYPI version 20.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - azure-devops-artifacts-helpers =1.0.8, =0.3.7, =8.2.1, =0.9.2, =1.1.0 Source cves: CVE-2026-113721 Source advisory: OSV:GHSA-558C-9HV2-4PRJ...

hip-data-ml-utils (>=1.0.1, <=1.0.2), pytoil (0.35.0) potentially affected by CVE-2026-113721 via virtualenv (20.16.3)

virtualenv PYPI version 20.16.3 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - hip-data-ml-utils =1.0.1, =1.0.2 - pytoil 0.35.0 Source cves: CVE-2026-113721 Source advisory: OSV:GHSA-558C-9HV2-4PRJ...

clearml-agent (>=0.17.0, <=0.17.2), manven (>=0.1.0, <=0.2.0) +4 more potentially affected by CVE-2026-113721 via virtualenv (16.7.12)

virtualenv PYPI version 16.7.12 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - clearml-agent =0.17.0, =0.1.0, =0.4.0, =0.0.1, =0.3.0.dev0, =0.13.2rc2, =0.16.3 Source cves: CVE-2026-113721 Source advisory:...

@0day-network/mod-renderer (>=0.1.0, <=0.1.1), @0day-network/react-sdk (>=0.0.1, <=0.2.1) +2119 more potentially affected by CVE-2026-114604 via @graphql-tools/utils (>=10.10.1, <=12.0.2-alpha-20260930213106-001ad6da4923b8bb612d81d5418e51f7365e603b)

@graphql-tools/utils NPM version =10.10.1, =0.1.0, =0.0.1, =1.0.21, =0.9.0, =2.1.2, =0.3.6, =0.4.0, =1.0.0-alpha.0, =1.0.0, =1.1.14, =0.1.1, =0.1.0, =2.10.0, =2.7.0, =2.7.0, =2.12.2 and more Source cves: CVE-2026-114604 Source advisory: SNYK:JS-GRAPHQLTOOLSUTILS-21460660...

@0day-network/mod-renderer (>=0.1.0, <=0.1.1), @0day-network/react-sdk (>=0.0.1, <=0.2.1) +2119 more potentially affected by CVE-2026-114604 via @graphql-tools/utils (>=10.10.1, <=12.0.1)

@graphql-tools/utils NPM version =10.10.1, =0.1.0, =0.0.1, =1.0.21, =0.9.0, =2.1.2, =0.3.6, =0.4.0, =1.0.0-alpha.0, =1.0.0, =1.1.14, =0.1.1, =0.1.0, =2.10.0, =2.7.0, =2.7.0, =2.12.2 and more Source cves: CVE-2026-114604 Source advisory: GHSA-C4QX-W738-7HR3...

@0day-network/mod-renderer (>=0.1.0, <=0.1.1), @0day-network/react-sdk (>=0.0.1, <=0.2.1) +2119 more potentially affected by CVE-2026-114604 via @graphql-tools/utils (>=10.10.1, <=12.0.2-alpha-20260930213106-001ad6da4923b8bb612d81d5418e51f7365e603b)

@graphql-tools/utils NPM version =10.10.1, =0.1.0, =0.0.1, =1.0.21, =0.9.0, =2.1.2, =0.3.6, =0.4.0, =1.0.0-alpha.0, =1.0.0, =1.1.14, =0.1.1, =0.1.0, =2.10.0, =2.7.0, =2.7.0, =2.12.2 and more Source cves: CVE-2026-114604 Source advisory: OSV:GHSA-C4QX-W738-7HR3...

GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments

Report metadata | Field | Value | | --- | --- | | Package | @graphql-tools/utils npm, pkg:github/ardatan/graphql-tools | | Repository | https://github.com/ardatan/graphql-tools | | Component | mergeIncrementalResult / setObjectKeyPath packages/utils/src/mergeIncrementalResult.ts | | Vulnerability...

GHSA-C4QX-W738-7HR3 GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments

Report metadata | Field | Value | | --- | --- | | Package | @graphql-tools/utils npm, pkg:github/ardatan/graphql-tools | | Repository | https://github.com/ardatan/graphql-tools | | Component | mergeIncrementalResult / setObjectKeyPath packages/utils/src/mergeIncrementalResult.ts | | Vulnerability...

Prototype Pollution

Overview @graphql-tools/utils is a Common package containing utils and types for GraphQL tools Affected versions of this package are vulnerable to Prototype Pollution via mergeIncrementalResult when path segments are processed by setObjectKeyPath. An attacker can supply a path containing a...

SUSE CVE-2026-114731

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy the utils/modcss action. The fetched stylesheet was read into memory in full, with no size limit and no read timeout, so a stylesheet URL referencing an...

autonomy-dev (>=0.2.40, <=0.2.70), cluster-experiment-utils (>=0.0.1, <=0.0.20) +26 more potentially affected by CVE-2026-114134 via black (23.1.0)

black PYPI version 23.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on black and may be impacted: - autonomy-dev =0.2.40, =0.0.1, =0.1.2, =0.1.0, =0.0.3, =0.1.0, =0.13.0b0, =2.57.0, =0.7.0, =0.0.1, =0.1.0rc0, =0.1.1 - openai-assistants-cli 0.1.1 and...

badger-utils (0.1.0), bpystubgen (>=0.1.1, <=0.1.8) +3 more potentially affected by CVE-2026-114134 via black (21.8.0b0)

black PYPI version 21.8.0b0 is affected by a known vulnerability. The following packages have a transitive dependency on black and may be impacted: - badger-utils 0.1.0 - bpystubgen =0.1.1, =0.1.0.dev20211019, =0.2.0.dev20211210 - eth-brownie 1.16.3 - hikaru 0.8.0b0 Source cves: CVE-2026-114134...

EUVD-2026-107548

Django REST framework: Accept header with many large quoted parameters burns 19s of CPU per request in content negotiation...

DEBIAN-CVE-2026-114731

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy the utils/modcss action. The fetched stylesheet was read into memory in full, with no size limit and no read timeout, so a stylesheet URL referencing an...

CVE-2026-114731

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy the utils/modcss action. The fetched stylesheet was read into memory in full, with no size limit and no read timeout, so a stylesheet URL referencing an...

CVE-2026-114731

Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 are vulnerable to an uncontrolled resource consumption vulnerability (CWE-770) within the CSS proxy (utils/modcss action). The root cause is that fetched stylesheets are read into memory in full without a size limit or read timeout, ...

CVE-2026-114731

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy the utils/modcss action. The fetched stylesheet was read into memory in full, with no size limit and no read timeout, so a stylesheet URL referencing an...

CVE-2026-114731

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy the utils/modcss action. The fetched stylesheet was read into memory in full, with no size limit and no read timeout, so a stylesheet URL referencing an...

EUVD-2026-107998

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy the utils/modcss action. The fetched stylesheet was read into memory in full, with no size limit and no read timeout, so a stylesheet URL referencing an...

CVE-2026-114731

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy the utils/modcss action. The fetched stylesheet was read into memory in full, with no size limit and no read timeout, so a stylesheet URL referencing an...