MLflow versions from 3.10.0 up to but not including 3.17.0 contain a path traversal vulnerability in the _create_model_version() function. This flaw allows remote attackers to read arbitrary files on the MLflow server by storing a server-local path as the model version artifact location and accessing it via the model-versions API. Unauthenticated servers are fully exposed, while basic-auth servers expose this to authenticated users who can create registered models. The issue is resolved in version 3.17.0.
A vulnerability in the follow-redirects Node.js library versions 1.16.0 through 1.16.1 allows sensitive headers to be improperly forwarded during cross-origin redirects. This occurs because the sensitiveHeaders option is checked using value instanceof Array, which fails for arrays created in different JavaScript realms, causing the sensitive headers list to be replaced with an empty array. As a result, custom credential headers can be sent to attacker-controlled redirect destinations. The issue is fixed in version 1.16.2.
CKEditor 5 versions from 45.0.0 up to but not including 47.7.4, and from 48.0.0 up to but not including 48.5.1, contain a cross-site scripting (XSS) vulnerability due to prototype pollution in a vulnerable es-toolkit version used by the editor engine. This flaw allows crafted editor content to execute unauthorized JavaScript in the browser. The issue is resolved in versions 47.7.4 and 48.5.1.
OAuthLib versions from 4.5.1_3 up to but not including 4.5.1_14 contain a vulnerability in the device workflow implementation of the OAuth 2.0 device authorization grant (RFC 8628). The token endpoint does not properly validate the device_code parameter, allowing an attacker who knows a valid client ID for a public client to obtain a bearer token without a valid device_code. This flaw arises because the DeviceCodeGrant.validate_token_request method lacks proper device_code validation and mishandles public clients. A fix is available in version 4.5.1_14.
CKEditor 5 versions from 29.0.0 up to but not including 47.7.4, and from 48.0.0 up to but not including 48.5.1, contain a cross-site scripting (XSS) vulnerability when General HTML Support is enabled and configured to allow object content. This vulnerability allows specially crafted markup to execute attacker-controlled JavaScript in a browser context isolated from the embedding application's origin. The issue is fixed in versions 47.7.4 and 48.5.1.
A vulnerability in dnspython's dns.name.from_wire_parser() function can cause excessive CPU usage when processing maliciously crafted DNS messages. This can degrade or deny service to applications using dnspython for DNS name decompression. The issue affects FastAPI versions from 0.111.0 up to but not including 0.143.1. The vulnerability is fixed in dnspython 2.9.0 and FastAPI 0.143.1. No workarounds are known.
A Server-Side Request Forgery (SSRF) vulnerability exists in the Model Context Protocol Python SDK versions from 1.10.0 up to but not including 1.30.0, and from 2.0.0 up to but not including 2.2.0. The vulnerability arises because certain client calls validate server-declared outputSchema documents using jsonschema's default resolver, which can cause unresolved $ref values to fetch URLs or files from the client's network or filesystem. This can lead to blind requests, local file reads, and session stalls due to synchronous resolution without timeouts. The issue is fixed in versions 1.30.0 and 2.2.0.
A command injection vulnerability exists in the bash activation script of virtualenv when the shell option 'promptvars' is off at activation time. The bash activator inserts the user-supplied --prompt value into PS1 without escaping special characters, allowing subsequent re-enabling of prompt expansion to execute arbitrary commands embedded in the prompt. This regression was introduced in version 21.14.9 and persists in 21.14.12. The vulnerability allows an attacker controlling the prompt value to execute commands as the user who activates the virtual environment.
CVE-2026-113723 is a vulnerability in virtualenv's bash activation prompt handling where attacker-controlled prompt text can be interpreted as executable shell syntax under certain older bash compatibility modes (4.2 and lower) or when using dash shell. This can lead to command execution when the environment is activated and the prompt is drawn. The issue arises because the prompt string assigned to PS1 is expanded twice by the shell, and some code paths do not properly escape or sanitize the prompt text. The vulnerability affects virtualenv versions from 1.2.0 up to but not including 1.6.2 and 1.9.3 up to but not including 1.18.1_2. A fix is available in versions 1.6.2 and 1.18.1_2.
Virtualenv versions prior to 1.6.2 and 1.18.1_2 have a file permission issue where files copied from a cached app-data directory retain their original permissions, potentially allowing wider access than intended. This occurs because shutil.copy preserves cached file modes regardless of the current umask, leading to files with overly permissive modes in new environments. An attacker with access to the new environment and the ability to traverse it can exploit this to modify files such as pip/__init__.py, which then run with the environment owner's privileges.
CVE-2026-113719 is a vulnerability in virtualenv's app-data seeder where the removal of previously installed seed packages does not properly validate deletion paths. This allows deletion of files outside the intended environment if malicious distribution metadata is present. The flaw occurs during environment creation when reusing an existing environment containing manipulated package metadata. The issue was introduced in version 20.8.1 and fixed in versions 1.6.2 and 1.18.1_2 of the affected product. Exploitation requires attacker-controlled metadata and deletion rights by the invoking user. The CVSS score is 4.5 (medium severity).
A vulnerability in filelock's ReadWriteLock and AsyncReadWriteLock components allows a local user with write permissions in the directory containing the lock database to exploit SQLite's behavior of reopening lock files by name, following symlinks and acting on side files like -journal, -wal, and -shm. This can lead to the attacker writing arbitrary data into the lock user's files, creating or unlinking files, or causing lock acquisition failures. The issue affects filelock versions 3.20.4 through 4.2.0, with fixes available in version 1.18.1_2. The vulnerability requires specific directory permissions (non-sticky, writable by the attacker) and local access. It has a CVSS 3.1 score of 7.1 (High) with no confidentiality impact but high integrity and availability impacts.
A vulnerability in filelock's ReadWriteLock and AsyncReadWriteLock components allows a local user with write permission on the lock database's parent directory to rename directories and cause the lock user's process to recursively delete arbitrary directories. This occurs because the lock cleanup does not verify that the directory it deletes is still the originally created lock directory, enabling deletion of directories renamed onto the expected lock directory name. The issue affects filelock versions 4.1.0 through 4.2.0 on macOS and POSIX systems without a usable /proc/self/fd, such as containers or chroots without /proc. The vulnerability requires a non-sticky, writable shared parent directory and local user privileges. The CVSS 3.1 score is 6.1 (Medium).
A vulnerability in filelock versions 4.1.0 through 4.2.0 allows a local user with write access to a shared lock directory without the sticky bit to create a hard link to another user's file by exploiting the restore branch of the stale lock break mechanism. This can expose file metadata and enable the attacker to cause the lock user's FileLock to truncate or modify the linked file. The issue arises due to symbolic link following behavior in os.link on CPython 3.12+ on Linux and macOS. The vulnerability requires specific conditions including a non-sticky writable directory and repeated lock acquisition by the lock user. It has a CVSS 3.1 score of 5.3 (Medium).
A vulnerability in filelock versions 4.1.0 through 4.2.0 allows a local user to evict a fresh lock file owned by another user by exploiting inode reuse and coarse clock timestamp manipulation on certain filesystems like ext4. This causes two processes of the lock owner to enter a critical section simultaneously, violating lock integrity without affecting confidentiality or availability. The attack requires local access, specific filesystem behavior, and precise timing, making exploitation complex and unreliable.
CVE-2026-116685 is a vulnerability in the Model Context Protocol Python SDK versions from 1.8.0 up to but not including 1.30.0, and from 2.0.0 up to but not including 2.2.0. Certain client components improperly follow HTTP redirects to different origins while forwarding sensitive custom credential headers and request bodies, potentially exposing sensitive information to unauthorized actors. This issue is fixed in versions 1.30.0 and 2.2.0.
MembershipWorks plugin for WordPress versions before 6.17 has an information disclosure vulnerability that allows unauthenticated attackers to access member-only content via the WordPress REST API. The plugin fails to apply content protection filters during REST API requests, exposing protected content to unauthorized users. This issue is fixed in version 6.17.
CVE-2026-116684 is an authorization vulnerability in the Model Context Protocol Python SDK affecting versions from 1.10.0 up to but not including 1.30.0, and from 2.0.0 up to but not including 2.2.0. The flaw occurs when server-side bearer authentication configured with AuthSettings and token_verifier accepts a valid token issued for a different service due to lack of independent audience (aud) validation. This allows an attacker holding a token for one resource to authenticate to a different MCP server and gain unauthorized access. The issue is fixed in versions 1.30.0 and 2.2.0.