A vulnerability in GitLab CE/EE versions from 15.0 up to but not including 19.3.6, 19.4 up to 19.4.3, and 19.5 up to 19.5.1 allowed authenticated users without project membership to read confidential issue titles from private projects when referenced in merge requests of public projects. This occurred due to a cache key that improperly shared rendered content across users, exposing sensitive information.
GitLab EE versions 19.2 up to but not including 19.3.6, 19.4 up to 19.4.3, and 19.5 up to 19.5.1 contain an authorization flaw. This flaw allows an authenticated user with group Owner permissions to bypass an instance administrator's lock on a group's Duo availability and re-enable AI-backed data egress to a third-party service for that group and its descendant projects. The issue arises from insufficient granularity in the enforcement of admin-lock controls. GitLab has released fixes in versions 19.3.6, 19.4.3, and 19.5.1.
Apache Tomcat versions 9.0.90 through 9.0.122, 10.1.25 through 10.1.60, and 11.0.0 through 11.0.26 contain an incomplete cleanup vulnerability that can cause TLS 1.3 connections to fail intermittently. This issue is resolved in versions 9.0.123, 10.1.61, and 11.0.27.
Apache Tomcat versions 9.0.92 through 9.0.122, 10.1.27 through 10.1.60, and 11.0.0 through 11.0.26 contain an incomplete cleanup vulnerability that allows HTTP/2 trailer header information from a previous request to leak into a subsequent request. This issue is fixed in versions 9.0.123, 10.1.61, and 11.0.27.
A time-of-check time-of-use (TOCTOU) race condition vulnerability exists in Apache Tomcat when creating Unix domain sockets for the APR/Native connector. This flaw allows an unauthorized local user to access the Unix domain socket. The previous fix for CVE-2026-65183 addressed only the NIO connector and did not resolve the issue in the APR/Native connector. The vulnerability affects Apache Tomcat versions from 9.0.47 through 9.0.122. Upgrading to version 9.0.123 resolves the issue.
An Execution After Redirect (EAR) vulnerability exists in Apache Tomcat's Jasper JSTL <c:redirect> plug-in implementation, where the page abort (SKIP_PAGE) is omitted. This affects multiple versions of Apache Tomcat, including 7.0.0 through 9.0.122, 10.1.0 through 10.1.60, and 11.0.0 through 11.0.26. The issue is fixed in versions 9.0.123, 10.1.61, and 11.0.27.
Apache Tomcat versions 9.0.92 through 9.0.122, 10.1.22 through 10.1.60, and 11.0.0 through 11.0.26 contain a vulnerability where the OpenSSLLifecycleListener fails to enforce FIPS mode securely. If FIPS activation fails, Tomcat logs an error but continues running using JSSE in non-FIPS mode with the provided configuration. This behavior is a 'Failing Open' security issue. Fixed versions are 9.0.123, 10.1.61, and 11.0.27.
A buffer under-read vulnerability in Apache Tomcat's AJP connector can cause the response body to be split between consecutive requests on the same connection. This may lead to failure of the second request and potential leakage of data from the first response to the second. The issue affects Apache Tomcat versions from 11.0.0 through 11.0.26 and is fixed in version 11.0.27.
Apache Tomcat contains a vulnerability in HTTP/2 asynchronous servlet processing where incorrect object recycling and reuse can cause request and response mix-ups between users. This affects versions 9.0.118 through 9.0.122, 10.1.55 through 10.1.60, and 11.0.22 through 11.0.26. The issue is fixed in versions 9.0.123, 10.1.61, and 11.0.27. Users should upgrade to these fixed versions to mitigate the risk.
Apache Tomcat contains an authentication vulnerability in the JNDIRealm when configured with non-GSSAPI SASL mechanisms. This flaw allows attackers to bypass password validation and authenticate without correct credentials. The issue affects multiple versions across Tomcat 7, 8.5, 9, 10.1, and 11 branches. Fixed versions are 11.0.27, 10.1.61, and 9.0.123.
A vulnerability in virtualenv versions 21.14.9 through 21.14.12 allows an attacker-controlled --prompt value to be copied into the PS1 environment variable without proper escaping when promptvars and POSIX mode are disabled. This can lead to command execution when prompt expansion occurs. The issue is fixed in version 21.14.13.
A vulnerability in virtualenv versions from 20.26.6 up to but not including 21.14.2 allows code execution when activating a virtual environment. The issue arises because the activation scripts replace placeholders in the environment path or prompt in multiple passes, enabling crafted values containing placeholder names to break out of quoting and execute arbitrary code during activation. This affects activation via bash, fish, xonsh, or activate_this.py. The vulnerability is fixed in version 21.14.2.
A command injection vulnerability exists in virtualenv versions prior to 21.14.2 due to improper quoting in the Fish shell activation script. An attacker-controlled environment path or prompt containing a backslash before a quote can cause command substitution when sourcing activate.fish. This issue is fixed in version 21.14.2.
A command injection vulnerability exists in virtualenv versions prior to 21.14.4 when used with zsh shells that have PROMPT_SUBST enabled. The vulnerability arises because the environment name is assigned to the shell prompt (PS1) without proper escaping, allowing attacker-controlled input to execute commands each time the prompt is drawn. This affects virtualenv versions before 21.14.4 and is fixed in 21.14.4.
A vulnerability in virtualenv prior to version 21.14.7 allows command execution via specially crafted environment names containing a backslash before a dollar sign in the bash activate script. This occurs because the script escapes the environment name improperly, leading to execution of commands in the user's shell prompt. The issue is fixed in version 21.14.7.
A vulnerability in virtualenv prior to version 21.14.9 allows a symlink target's mode to be changed during deletion recovery. The safe_delete() function's error handler follows symlinks and applies owner-write permissions, which can unintentionally widen write access to a target file owned by the user. This occurs if a symlink is planted inside a read-only directory, potentially making the target broadly writable before the deletion retry fails. The issue is fixed in version 21.14.9.
virtualenv versions prior to 21.14.9 allow caller-supplied prompt text to be interpreted as executable syntax in the bash activation prompt. This occurs when an attacker can influence the prompt value and a user activates the environment, causing potential execution of unintended commands. The issue is fixed in version 21.14.9.
virtualenv versions prior to 21.14.9 generate POSIX console launchers that improperly quote interpreter paths. This flaw allows command substitution and backtick expansion in the generated /bin/sh wrapper script if the interpreter path contains spaces or results in a shebang longer than 127 bytes. An attacker who can influence the environment destination can execute arbitrary commands with the user's privileges when the generated launcher is run. Existing launchers are not fixed by upgrading virtualenv alone and must be regenerated. The issue is fixed in version 21.14.9.
A vulnerability in virtualenv prior to version 21.14.9 allows local attackers to cause environment creation to overwrite files outside the intended directory tree by exploiting how symbolic or hard links are handled during activation file generation. This can lead to unauthorized file modification with the invoking user's permissions. The issue is fixed in version 21.14.9.
virtualenv versions prior to 21.14.9 have a vulnerability where cached package files retain file permissions from an older cache due to the use of shutil.copy(). This can cause files to be writable by other local accounts if the cache was created under a permissive umask, potentially allowing modification and execution of package code by the environment owner. The issue is fixed in version 21.14.9.