Medium
CVE-2026-113724
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 18
Reset filters
Medium
CVE-2026-113716
virtualenv: Builtin creation follows linked environment directories
High
CVE-2026-113732
virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote
A command injection vulnerability in virtualenv's activate.fish script allows arbitrary command execution if an environment path or prompt contains a backslash before a quote. Fixed in version 21.14.2.
High
CVE-2026-113776
virtualenv activation scripts run code from a path that contains a placeholder name
A vulnerability in virtualenv activation scripts allows arbitrary code execution if an environment path or prompt contains placeholder names. Activating a maliciously crafted virtual environment can cause the generated script to execute unintended commands.
High
ghsa-889w-m37p-88m5
pyLoad: Api.set_user_permission never invalidates the target's session
High
CVE-2026-102925
virtualenv bash and fish activation scripts execute commands embedded in paths
High
CVE-2026-102937
Command injection via --prompt in activate.bat (batch activator)
High
CVE-2026-102930
Downloaded seed wheels (pip/setuptools) are not integrity-checked before use
Medium
CVE-2026-102938
virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection
Medium
CVE-2026-81724
NLTK: Uncontrolled recursion in nltk.featstruct.FeatStructReader causes unhandled RecursionError (DoS) via deeply nested feature-structure input
Medium
CVE-2026-22702
virtualenv Has TOCTOU Vulnerabilities in Directory Creation
Medium
CVE-2025-68146
filelock has a TOCTOU race condition which allows symlink attacks during lock file creation
High
CVE-2025-54140
`pyLoad` has Path Traversal Vulnerability in `json/upload` Endpoint that allows Arbitrary File Write
Medium
CVE-2026-41479
Authlib OAuth 2.0 has Open Redirect in Authorization API that allows attacker-controlled redirect_uri through unsupported response_type
High
CVE-2024-53899
virtualenv allows command injection through activation scripts for a virtual environment
Medium
CVE-2024-29735
Apache Airflow Improper Preservation of Permissions vulnerability
Medium
CVE-2011-4617
virtualenv.py in virtualenv before 1.5 allows local users to overwrite arbitrary files via a symlink attack on a certain file in /tmp/.
Medium
CVE-2022-23653
B2 Command Line Tool is the official command line tool for the backblaze cloud storage service. Linux and Mac releases of the B2 command-line tool version 3.2.0 and below contain a key disclosure vuln
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.