virtualenv: Pip seeding with download omits wheel digest verification
CVE-2026-113717
## Summary The pip seeder acquires bundled wheels with download=False and lets pip access the index when --download is
2026-10-24 归档
今日共收录 814 条安全情报，包含 0 个 CVE，421 篇安全通告，以及 100 篇研究论文。
← 返回归档列表virtualenv: Downloaded wheel selection and caching precede verification
CVE-2026-113714
## Summary Wheel downloads go directly into the reusable wheelhouse, while the verification target is selected from pip
virtualenv: Xonsh activation literals depend on the script decoding codec
CVE-2026-113718
## Summary Caller-supplied prompt text can become executable syntax in the xonsh activation script. An attacker must in
virtualenv: Seeded files retain permissions from an older cache
CVE-2026-113720
## Summary The app-data copy seeder uses shutil.copy, which preserves cached file modes independently of the current um
virtualenv: Bash prompt values can change meaning under older compatibility modes
CVE-2026-113723
## Summary Caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must inf
virtualenv: Venv configuration readback can reinterpret path boundaries
CVE-2026-113715
## Summary The venv creator reads the standard library's generated pyvenv.cfg with splitlines() and merges all resultin
virtualenv: Seed replacement does not contain metadata deletion paths
CVE-2026-113719
## Summary The app-data seeder joins paths from existing distribution metadata to site-packages and deletes the resulti
MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint
CVE-2026-109461
### Impact Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attack
undici vulnerable to Denial of Service via unhandled error on excessive content-encodings
CVE-2026-109869
### Impact undici's `fetch()` crashes the Node.js process when a malicious server returns a response with more than fiv
undici vulnerable to Denial of Service via unbounded memory in the EventSource parser
CVE-2026-109924
### Impact undici's `EventSource` client can be driven to exhaust process memory by a malicious or compromised Server-S
undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens
CVE-2026-109841
### Impact undici's `fetch()` verifies Subresource Integrity (SRI) metadata by looking up the algorithm token in a lowe
Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body
CVE-2026-115897
### Impact `serialize-javascript` escapes its output so it is safe to embed inside a `` element. Before 7.1.3 that guar
multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown
CVE-2026-113872
### Impact When `multer` is configured with an asynchronous `fileFilter`, a single request can crash the Node.js proces
Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution
CVE-2026-115895
## Summary The ESM compiler in `happy-dom@20.14.5` does not validate imported local binding aliases before interpolatin
Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type
CVE-2026-115892
### Summary Wasmtime may panic when the host lowers a component model `stream` or `future` into a guest, if the host cr
filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files
CVE-2026-112940
`ReadWriteLock` and `AsyncReadWriteLock` (the SQLite-backed reader/writer lock) hand SQLite a name they do not control.
Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root
CVE-2026-115569
### Impact Fallow reads the Jest and Vitest configs of the repository that it analyzes. A Jest `projects` entry or a Vi
Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution
CVE-2026-112398
### Credits **Researcher**: Alex Bouffard (mixbo@pebwalker.com) ### Summary A heap buffer overflow in Pillow's FlashP
Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1
CVE-2026-114501
### Summary When [`PILLOW_ALIGNMENT`](https://pillow.readthedocs.io/en/stable/reference/block_allocator.html#memory-poo
Laravel relationship inclusion can trigger unauthorized data destruction
CVE-2026-114508
A vulnerability in how relationship inclusion is processed on certain read endpoints. Under specific conditions, a reque