CVE-2026-113716 is a medium severity vulnerability in python-virtualenv, a tool for creating isolated Python environments. It affects multiple specific package versions. The vulnerability has a CVSS 3.1 base score of 4.5, indicating limited impact on confidentiality, integrity, and availability. No public exploits or vendor patches are currently documented.
CVE-2026-113715 is a low severity vulnerability affecting specific versions of the python-virtualenv tool, which is used to create isolated Python environments. The CVSS 4.0 score is 2.0, indicating low impact with local attack vector, high attack complexity, and partial privileges required. No public exploit or known active exploitation is reported. The affected versions include various specific package builds primarily for Ubuntu distributions.
Certifi versions before 2026.10.18 include the emSign ECC Root CA - G3 root certificate, whose eight eMudhra intermediate CA certificates have compromised private keys and have been revoked. An attacker with these keys can issue valid-looking certificates for any hostname, potentially intercepting or modifying TLS traffic for clients trusting the certifi bundle, including popular Python tools. Certifi 2026.10.18 removed all emSign roots, and 2026.10.19 restored only unaffected emSign roots. Users should upgrade to 2026.10.19 or later and rebuild container images that include certifi.
CVE-2026-113714 is a low severity vulnerability affecting multiple specific versions of the python-virtualenv tool, which is used to create isolated Python environments. The vulnerability has a CVSS 4.0 base score of 2.3, indicating limited impact and complexity. No known exploits in the wild have been reported, and no patch or remediation details are provided in the available data.
CVE-2026-113713 is a medium severity vulnerability in python-virtualenv, a tool for creating isolated Python environments. It affects multiple specific versions of python-virtualenv, including various Debian and Ubuntu package versions. The vulnerability has a CVSS 4.4 score, indicating limited attack vector and complexity with partial privileges required. No known exploits in the wild have been reported. No patch or remediation details are provided in the available data.
A vulnerability in the Node.js package follow-redirects versions 1.2.4-1, 1.13.1-1, and 1.14.5-1 allows sensitive credential headers to be forwarded to attacker-controlled destinations during cross-origin redirects when headers are provided as arrays. This occurs because the header removal logic incorrectly assumes headers are plain objects, failing to remove Authorization, Proxy-Authorization, and Cookie headers in array form. The issue is patched in version 1.16.1.
ApostropheCMS versions prior to 4.33.0 are affected by a cross-site scripting (XSS) vulnerability due to unsafe handling of meta refresh elements in the sanitize-html library before version 2.18.0. This flaw allows unsafe script or redirect destinations to be retained in the refresh content value under a non-default configuration. The issue is fixed in sanitize-html 2.18.0 and ApostropheCMS 4.33.0.
ApostropheCMS versions prior to 4.33.0 and sanitize-html versions from 2.17.7 up to but not including 2.18.0 contain a cross-site scripting (XSS) vulnerability. This occurs due to a bypass in the SMIL URL protection when namespace-prefixed SVG animation elements and certain URL-targeting attributes are allowed, enabling unsafe URI rewriting and script execution upon user interaction. The default sanitizer configuration is not universally affected. The issue is fixed in sanitize-html 2.18.0 and ApostropheCMS 4.33.0.
ApostropheCMS versions prior to 4.33.0 are affected by a cross-site scripting (XSS) vulnerability due to improper sanitization of noscript tag content in the sanitize-html library before version 2.18.0. This flaw allows content intended to be inert to survive sanitization and render in scripting-enabled browsers, potentially enabling XSS attacks. The issue is fixed in sanitize-html 2.18.0 and ApostropheCMS 4.33.0.
ApostropheCMS versions prior to 4.34.0 and sanitize-html versions 2.18.0 before 2.18.1 contain an uncontrolled recursion vulnerability. This occurs when an <iframe> tag is disallowed and disallowedTagsMode is set to 'discard', causing recursive calls to sanitizeHtml without a termination condition. The flaw leads to a denial of service by exhausting resources. The issue is fixed in versions 4.34.0 of ApostropheCMS and 2.18.1 of sanitize-html.
Vite versions from 8.2.0 up to but not including 8.2.4 and version 8.3.3 have a vulnerability where the first 4 bytes of files outside the configured server.fs directory can be exposed to the browser. This occurs when a request includes the ?vite-wasm-instance query, which bypasses server.fs path checks and causes an error revealing file content. The issue is fixed in versions 8.2.4 and 8.3.3.
Vite versions prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3 have a vulnerability in import analysis where a root-relative browser URL can be recorded in safeModulePaths instead of the cleaned resolved module identifier. This can allow a network-accessible, non-Windows development server to authorize raw filesystem requests for certain host files outside the project root, potentially disclosing files. The vulnerability does not allow arbitrary path traversal and is fixed in the specified versions.
Vite versions prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3 have a vulnerability affecting applications using custom middleware that pass an unchanged browser request URL to server.transformIndexHtml. This flaw allows an attacker to craft a development-server page that causes the victim's browser to fetch and execute an attacker-controlled module, potentially exposing sensitive page data or enabling critical actions. The issue is fixed in the specified versions.
A medium severity vulnerability (CVE-2026-113681) affects multiple versions of OpenImageIO prior to 3.0.20.0, 3.1.15.0, and 3.2.x before 3.x.x. The flaw has an impact on availability but does not affect confidentiality or integrity. No public exploits or known active exploitation have been reported. The affected versions include several specific builds of OpenImageIO 2.2.x, 2.4.x, and 2.5.x series.
HarfBuzz versions from 8.0.0 through 14.6.0 contain a vulnerability that leads to a NULL pointer dereference. This flaw can cause a denial of service by crashing the affected application. The vulnerability has a CVSS 3.1 base score of 5.5, indicating a medium severity level. It requires local attack vector with low complexity and no privileges, but user interaction is required. There is no indication of confidentiality or integrity impact, only availability is affected.
HarfBuzz versions 8.0.0 through 14.6.0 contain an out-of-bounds write vulnerability. This flaw could allow an attacker with local access and high attack complexity to cause a high impact on confidentiality, integrity, and availability. The vulnerability requires user interaction and does not involve privileges. It is rated as high severity with a CVSS score of 7. No public exploits or vendor patch information are provided in the data.
json-smart versions through 2.6.0 contain an input validation bypass vulnerability that can lead to integrity impacts. This vulnerability has a CVSS 3.1 base score of 5.3, indicating medium severity. No public exploits or active exploitation in the wild have been reported. The affected versions include several specific builds primarily around version 2.2 and 2.5.2. No patch or remediation information is provided in the available data.
Python filelock is a platform-independent file locking library. A low severity vulnerability (CVE-2026-112941) affects multiple specific versions of python-filelock. The issue has a CVSS score of 3.3, indicating low impact, with limited integrity impact and no confidentiality or availability impact reported.
Python filelock is a platform-independent file locking library. A vulnerability identified as CVE-2026-112940 affects multiple specific versions of python-filelock. The vulnerability has a CVSS v3.1 score of 7.1, indicating high severity, with impact on integrity and availability but no confidentiality impact. No public exploits or vendor patch information are provided.
Python filelock, a platform-independent file locking library, has a vulnerability identified as CVE-2026-112939. The flaw affects multiple specific versions of the python-filelock package. The vulnerability has a medium severity rating with a CVSS score of 4.7, indicating limited impact. It requires local access with high attack complexity and low privileges, and it can cause integrity issues without affecting confidentiality or availability.