SemanticMediaWiki versions from 3.0.0 up to but not including 7.3.1 contain a reflected cross-site scripting (XSS) vulnerability in the Special:Ask feature. This flaw arises because certain separator parameters are output without proper HTML escaping in various result printers. An unauthenticated attacker can craft malicious links that execute JavaScript in the context of the wiki, potentially stealing session cookies or CSRF tokens. The vulnerability is fixed in version 7.3.1.
SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unescaped default parameter in JsonResultPrinter. Attackers can lure victims to a crafted Special:Ask link with a zero-result query and request_type=special_page, executing JavaScript in the wiki origin to steal sessions or CSRF tokens.
Semantic MediaWiki versions 7.3.0 before 7.3.1 have a missing authorization vulnerability in the smwtask API module. This flaw allows unauthenticated attackers to run queued jobs and force store updates. Attackers can exploit the public anonymous CSRF token with run-joblist to execute arbitrary job types repeatedly or invoke updates on sysop-protected pages, potentially leaking page titles and exhausting system resources. The vulnerability is fixed in version 7.3.1.
Semantic MediaWiki versions from 3.0.0 up to but not including 7.3.1 contain an algorithmic complexity vulnerability in the TermParser::normalize_compact_form() function. This flaw allows unauthenticated attackers to cause quadratic CPU consumption by submitting long search terms with many distinct in:(...) or has:(...) expressions to Special:Search when the extended search engine is enabled. The vulnerability can exhaust PHP search workers, impacting service availability. A fix is available in version 7.3.1.
Semantic MediaWiki versions 3.0.0 through 7.3.0 contain an uncontrolled recursion vulnerability in the LegacyParser::getSubqueryDescription() function. This flaw allows unauthenticated attackers to submit deeply nested query elements via the action=ask API, causing excessive CPU and memory consumption and tying up server request workers. The vulnerability is fixed in version 7.3.1.
CVE-2026-117530 is a vulnerability in JetBrains Junie CLI versions before 26.8.17 where incomplete validation of allowlisted commands allowed command execution. This flaw was addressed and fixed in version 26.8.17.
CVE-2026-111548 is a stack-based buffer overflow vulnerability in the web management interface of Moxa NPort W2150A-W4 and W2250A-W4 series wireless device servers. An authenticated remote attacker with low privileges can exploit insufficient bounds checking of user input to cause the web management service to become unresponsive. Recovery requires power cycling the affected device, though other device functions continue operating.
In September 2026, multiple zero-day vulnerabilities affecting Citrix NetScaler ADC and Gateway were actively exploited by unidentified threat actors. These vulnerabilities allowed unauthenticated remote code execution, prompting Citrix to release emergency patches for CVE-2026-88771 through CVE-2026-88778. The rapid detection and patching reflect improved global telemetry and vendor coordination. Organizations using NetScaler devices should remain vigilant for potential additional advisories and maintain readiness to apply emergency patches promptly.
This content is an interview and career retrospective with security researcher Ryan Fetterman, discussing his journey from federal security operations centers to his role at Cisco Talos. It covers his experiences with detection engineering, host-based analytics, and challenges faced during advanced persistent threat (APT) incident investigations. The discussion includes insights into evolving attacker tactics and the importance of sustainable career development in cybersecurity.
## Summary
The venv creator reads the standard library's generated pyvenv.cfg with splitlines() and merges all resulting keys over
virtualenv's configuration. Line-boundary characters from destination data can therefore become configuration structure
before output sanitization.
Anthropic's OSS Scanner reported this as `ANT-2026-6ZQHJ6VI` in `virtualenv-20261015-005`, received on 15 October 2026.
## Affected area
Configuration readback by the stdlib venv creator.
## Attacker-controlled input
An untrusted caller must influence the destination pathname passed to the venv creator. That pathname must contain a
character that Python treats as a line boundary. The builtin creator follows a different configuration-writing path.
## Affected code
The relevant 21.14.8 source is in
[venv readback](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/create/via_global_ref/venv.py),
[configuration parser](https://github.com/pypa/virtualenv/blob/a795ab116356afde11039cf2763d77e8a06da738/src/virtualenv/create/pyenv_cfg.py).
## Mechanism
With `--creator venv`, virtualenv asks the standard library to create an environment, reads its `pyvenv.cfg` with
`str.splitlines()`, and merges the parsed keys over virtualenv's chosen settings. CPython writes the destination into a
`command =` value without escaping every character that `splitlines()` recognizes as a line boundary. A destination
containing U+2028, for example, can therefore supply new `home` and `include-system-site-packages` keys during readback.
Virtualenv writes those keys as real configuration lines. The builtin creator does not use this readback path.
## Reproduction and evidence
The scanner used one destination value with U+2028 between `home = /attacker/chosen`,
`include-system-site-packages = true`, and an absorbing `x =` key. A `python -m venv --without-pip` control kept the
value inside its `command` line and reported the base interpreter's `sys._home`. `virtualenv --creator venv --no-seed`
on the same value wrote separate injected configuration lines and its interpreter reported
`sys._home = /attacker/chosen`. The path did not require a literal newline byte. The control establishes that the extra
keys came from virtualenv's readback, not from the standard library's initial file alone.
The altered `home` can change which standard-library files the interpreter loads if an attacker also controls that
location; `include-system-site-packages = true` weakens environment isolation. Choosing the venv creator is required,
either explicitly or through a rare fallback. The report traces the readback to the 20.x rewrite, first released in
20.0.0b1. [PR #3426](https://github.com/pypa/virtualenv/pull/3426) rejects line-boundary characters before creation and
rebuilds the final configuration from selected settings.
## Attack sequence
```mermaid
sequenceDiagram
participant A as Destination supplier
participant S as stdlib venv
participant V as virtualenv readback
participant C as Final pyvenv.cfg
participant P as Environment Python
A->>S: path contains U+2028 and home = /attacker/chosen
S->>C: write path inside command value
V->>C: read with splitlines()
V->>V: parse suffix as separate keys
V->>C: rewrite home and include-system-site-packages
P->>C: read injected keys on startup
C-->>P: sys._home changes and isolation is disabled
```
## Reproducer files
The following files are from the scanner report for `ANT-2026-6ZQHJ6VI`. They were tested against commit `a857a7823c73`
in the scanner image. The `repro` entrypoint expects companion files under `/tmp/repro.d`; cases that change user IDs
need a disposable root-capable container. The last output line is `BUG` when the reported behavior occurs. These files
are included as evidence and were not rerun for this advisory update.
**`repro`**
```text
#!/usr/bin/env python3
import os
import shutil
import subprocess
work = "/tmp/repro-venv-creator-cfg"
shutil.rmtree(work, ignore_errors=True)
# the attacker's input: the text of a destination path.
# U+2028 ends a line for str.splitlines() but not for CPython's own pyvenv.cfg reader.
# The slashes only make nested directories; the last key, x, absorbs the rest of the path.
LS = "\u2028"
dest = f"{work}/proj{LS}home = /attacker/chosen{LS}include-system-site-packages = true{LS}x = /env"
base_python = os.path.realpath(shutil.which("python"))
real_home = os.path.dirname(base_python)
def pyvenv_cfg_lines(env):
# split on "\n" only, as the interpreter does
return open(f"{env}/pyvenv.cfg", encoding="utf-8").read().split("\n")
def sys_home(env):
# site.py sets sys._home from the `home` key of the environment's pyvenv.cfg
probe = [f"{env}/bin/python", "-c", "import sys; print(sys._home)"]
return subprocess.run(probe, capture_output=True, text=True, check=True).stdout.strip()
# control: the same path through the standard library alone
stdlib_env = dest + "-stdlib"
The Popcorn Time fork Time4Popcorn included an insecure updater that ran at system boot and polled update domains over unencrypted HTTP, executing any code served with full system privileges. The updater lacked code signing and was abandoned, leaving millions of Windows, macOS, and Android systems exposed to potential takeover by attackers serving malicious updates. Eye Security researchers registered abandoned update domains and pushed an update to disable the updater on Windows and macOS, significantly reducing risk. However, the underlying application remains vulnerable, and Android systems require user interaction to disable the updater. The recommendation is to uninstall Popcorn Time due to its outdated and insecure architecture.
CVE-2026-82117 is a critical authentication bypass vulnerability in Hitachi HiRDB Server Version 10 and certain versions of Version 9. The flaw allows an attacker to bypass authentication by spoofing, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability affects HiRDB Server Version 10 from 10-00 up to but not including 10-12-01, and multiple Version 9 releases. A fix is available in version 10-12-01.
CVE-2026-82116 is a critical vulnerability in Hitachi HiRDB Server Version 10 and certain versions of Version 9 that involves missing authentication for a critical function. This flaw allows unauthenticated remote attackers to potentially execute unauthorized actions with high impact on confidentiality, integrity, and availability. The vulnerability affects multiple versions prior to 10-12-01 and has been assigned a CVSS score of 9.8, indicating critical severity. A fix is available in version 10-12-01.
CVE-2026-82118 is a critical stack-based buffer overflow vulnerability affecting Hitachi HiRDB Server versions 9 and 10. The flaw exists in versions from 10-00 up to but not including 10-12-01, and in various 9.x versions up to 09-66-22. This vulnerability allows an attacker to execute arbitrary code or cause a denial of service due to memory corruption.
CVE-2026-82120 is a critical heap-based buffer overflow vulnerability affecting Hitachi HiRDB Server versions 9 and 10 within specified version ranges. The flaw allows an attacker to potentially execute arbitrary code or cause denial of service due to memory corruption. A fix is available in HiRDB Server version 10-12-01.
CVE-2026-82119 is a critical OS Command Injection vulnerability in Hitachi HiRDB Server Version 10 and certain versions of Version 9. It allows an unauthenticated attacker to execute arbitrary operating system commands remotely. The flaw affects multiple versions prior to 10-12-01 and specific 9.x releases. A fix is available in version 10-12-01.
CVE-2026-82121 is an origin validation error vulnerability in Hitachi HiRDB Server Version 10 and certain versions of Version 9. It allows an attacker to bypass origin checks, potentially leading to unauthorized data access. The vulnerability affects multiple versions prior to 10-12-01 and specific 9.x versions. It has a high severity with a CVSS score of 7.5. A fix is available in version 10-12-01.
CVE-2026-82122 is a critical stack-based buffer overflow vulnerability in Hitachi HiRDB Server Version 10 and several versions of Version 9. It affects versions from 10-00 up to but not including 10-12-01, and various 9.x versions up to 09-66-22. The flaw allows remote attackers to execute code or cause denial of service without requiring privileges or user interaction. A fix is available in version 10-12-01.
CVE-2026-76939 is a critical heap-based buffer overflow vulnerability in Hitachi JP1/Automatic Job Management System 3 - Manager and Agent components. It affects versions from 11-00 up to but not including 13-50-31. The flaw allows remote attackers to execute arbitrary code or cause denial of service without requiring authentication. A fix is available in version 13-50-31.
CVE-2026-76936 is a critical stack-based buffer overflow vulnerability in Hitachi's JP1/Automatic Job Management System 3 - Manager affecting versions from 10-00 up to but not including 13-50-31. The flaw allows an attacker to execute code remotely without privileges or user interaction, potentially leading to full system compromise. A fix is available in version 13-50-31.