https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T12:36:48.885306+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2024:10953 ALSA-2024:10953 — Important: python36:3.6 security update 2026-10-04T12:36:48.907842+00:00

Affected: AlmaLinux:8: python-nose-docs, AlmaLinux:8: python-pymongo-doc, AlmaLinux:8: python-sqlalchemy-doc, AlmaLinux:8: python-virtualenv-doc, AlmaLinux:8: python3-PyMySQL, AlmaLinux:8: python3-bson, AlmaLinux:8: python3-distro, AlmaLinux:8: python3-docs, AlmaLinux:8: python3-docutils, AlmaLinux:8: python3-nose and 12 more

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* virtualenv: potential command injection via virtual environment activation scripts (CVE-2024-53899)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2024-10842 bdu:2024-10842 2026-10-04T12:36:48.907928+00:00 bdu:2024-10842 https://cve.radiocsirt.org/vuln/bell-cve-2024-53899 BELL-CVE-2024-53899 2026-10-04T12:36:48.907946+00:00

Affected: Alpaquita:23: py3-virtualenv, Alpaquita:stream: py3-virtualenv

 https://cve.radiocsirt.org/vuln/bit-virtualenv-2024-53899 BIT-virtualenv-2024-53899 2026-10-04T12:36:48.907965+00:00

Affected: Bitnami: virtualenv

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.

 https://cve.radiocsirt.org/vuln/brew-charm-tools-cve-2024-53899 BREW-charm-tools-CVE-2024-53899 — virtualenv allows command injection through activation scripts for a virtual environment 2026-10-04T12:36:48.907984+00:00

Affected: Homebrew: charm-tools

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.

 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0303 certfr-2025-avi-0303 — De multiples vulnérabilités ont été découvertes dans les produits Splunk. Elles permettent à un attaquant de provoquer… 2026-10-04T12:36:48.908003+00:00 certfr-2025-avi-0303 https://cve.radiocsirt.org/vuln/euvd-2026-203983 EUVD-2026-203983 2026-10-04T12:36:48.908018+00:00 EUVD-2026-203983 https://cve.radiocsirt.org/vuln/fkie_cve-2024-53899 fkie_cve-2024-53899 2026-10-04T12:36:48.908028+00:00

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.

 https://cve.radiocsirt.org/vuln/ghsa-rqc4-2hc7-8c8v GHSA-rqc4-2hc7-8c8v — virtualenv allows command injection through activation scripts for a virtual environment 2026-10-04T12:36:48.908048+00:00

Affected: PyPI: virtualenv

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.

 https://cve.radiocsirt.org/vuln/msrc_cve-2024-53899 msrc_CVE-2024-53899 — virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic temp… 2026-10-04T12:36:48.908065+00:00 msrc_CVE-2024-53899 https://cve.radiocsirt.org/vuln/oesa-2025-1241 OESA-2025-1241 — python-virtualenv security update 2026-10-04T12:36:48.908081+00:00

Affected: openEuler:24.03-LTS: python-virtualenv

Virtualenv is a tool to create isolated Python environments. Since Python 3.3, a subset of it has been integrated into the standard library under the venv module. Note though, that the venv module does not offer all features of this library (e.g. cannot create bootstrap scripts, cannot create virtual environments for other python versions than the host python, not relocatable, etc.). Tools in general as such still may prefer using virtualenv for its ease of upgrading (via pip), unified handling of different Python versions and some more advanced features. Security Fix(es):

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.(CVE-2024-53899)

 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15252-1 openSUSE-SU-2025:15252-1 — oci-cli-3.61.0-1.1 on GA media 2026-10-04T12:36:48.908103+00:00

oci-cli-3.61.0-1.1 on GA media

 https://cve.radiocsirt.org/vuln/pysec-2024-187 PYSEC-2024-187 2026-10-04T12:36:48.908118+00:00

Affected: PyPI: virtualenv

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.

 https://cve.radiocsirt.org/vuln/rhsa-2024:11091 RHSA-2024:11091 — Red Hat Security Advisory: python36:3.6 security update 2026-10-04T12:36:48.908134+00:00

virtualenv: potential command injection via virtual environment activation scripts

 https://cve.radiocsirt.org/vuln/suse-su-2024:4143-1 SUSE-SU-2024:4143-1 — Security update for python3-virtualenv 2026-10-04T12:36:48.908149+00:00

Security update for python3-virtualenv

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-53899 UBUNTU-CVE-2024-53899 2026-10-04T12:36:48.908162+00:00

Affected: Ubuntu:14.04:LTS: python-virtualenv, Ubuntu:Pro:22.04:LTS: python-virtualenv, Ubuntu:Pro:24.04:LTS: python-virtualenv

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-3682 WID-SEC-W-2024-3682 — Python "virtualenv": Schwachstelle ermöglicht Codeausführung 2026-10-04T12:36:48.908181+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle im Python "virtualenv" Paket ausnutzen, um beliebigen Programmcode auszuführen.