Vulnerability archive

Understand vulnerabilities. Protect your applications.

Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.

Platform

Severity

Disclosed from

Disclosed to

Vulnerability archive 16

Reset filters

High 21.10.2026

CVE-2026-113732

virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote

A command injection vulnerability in virtualenv's activate.fish script allows arbitrary command execution if an environment path or prompt contains a backslash before a quote. Fixed in version 21.14.2.

High 21.10.2026

CVE-2026-113776

virtualenv activation scripts run code from a path that contains a placeholder name

A vulnerability in virtualenv activation scripts allows arbitrary code execution if an environment path or prompt contains placeholder names. Activating a maliciously crafted virtual environment can cause the generated script to execute unintended commands.

High 09.10.2026

ghsa-889w-m37p-88m5

pyLoad: Api.set_user_permission never invalidates the target's session

High 18.09.2026

CVE-2026-102925

virtualenv bash and fish activation scripts execute commands embedded in paths

High 18.09.2026

CVE-2026-102937

Command injection via --prompt in activate.bat (batch activator)

High 18.09.2026

CVE-2026-102930

Downloaded seed wheels (pip/setuptools) are not integrity-checked before use

Medium 17.09.2026

CVE-2026-102938

virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection

Medium 27.08.2026

CVE-2026-81724

NLTK: Uncontrolled recursion in nltk.featstruct.FeatStructReader causes unhandled RecursionError (DoS) via deeply nested feature-structure input

Medium 13.01.2026

CVE-2026-22702

virtualenv Has TOCTOU Vulnerabilities in Directory Creation

Medium 16.12.2025

CVE-2025-68146

filelock has a TOCTOU race condition which allows symlink attacks during lock file creation

High 21.07.2025

CVE-2025-54140

`pyLoad` has Path Traversal Vulnerability in `json/upload` Endpoint that allows Arbitrary File Write

Medium 08.06.2026

CVE-2026-41479

Authlib OAuth 2.0 has Open Redirect in Authorization API that allows attacker-controlled redirect_uri through unsupported response_type

High 24.11.2024

CVE-2024-53899

virtualenv allows command injection through activation scripts for a virtual environment

Medium 26.03.2024

CVE-2024-29735

Apache Airflow Improper Preservation of Permissions vulnerability

Medium 31.12.2011

CVE-2011-4617

virtualenv.py in virtualenv before 1.5 allows local users to overwrite arbitrary files via a symlink attack on a certain file in /tmp/.

Medium 23.02.2022

CVE-2022-23653

B2 Command Line Tool is the official command line tool for the backblaze cloud storage service. Linux and Mac releases of the B2 command-line tool version 3.2.0 and below contain a key disclosure vuln

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application

Understand vulnerabilities. Protect your applications.

Vulnerability archive 16

Know which vulnerabilities affect your application

Application security in your inbox