2026-10
“virtualenv: Seed replacement does not contain metadata deletion paths”
“virtualenv bash and fish activation scripts execute commands embedded in paths”
“virtualenv: Venv configuration readback can reinterpret path boundaries”
“virtualenv bash activate runs commands from an environment name with a backslash before $”
“virtualenv: Command injection via --prompt in activate.bat (batch activator)”
“Werkzeug safe_join() allows Windows special device names”
“Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain”
“Werkzeug safe_join() allows Windows special device names with compound extensions”
“Werkzeug safe_join not safe on Windows”
“Pallets Werkzeug Insufficient Entropy”
“Pallets Werkzeug vulnerable to Path Traversal”
“Incorrect parsing of nameless cookies leads to __Host- cookies bypass”
“High resource usage when parsing multipart form data with many fields”