Vulnerabilities
Recent vulnerabilities
Recent vulnerabilities from
π GNA-1 (CIRCL)
Select from 85 available sources using the dropdown above.
OSV Homebrew πΊ is not individually searchable yet β the search will cover the sources available on the search page.
| ID | Description | Published | Updated |
|---|---|---|---|
| brew-nx-ghsa-w2vw-w76x-qr89 | Nx: OS command injection via git revisions and remote refs | 2026-10-06T10:14:44Z | 2026-11-01T10:02:05Z |
| brew-nx-cve-2026-71476 | Nx: Zip-Slip in the self-hosted remote cache | 2026-08-13T17:19:21Z | 2026-11-01T10:02:05Z |
| brew-nx-cve-2026-54753 | `nx graph` dev server permissive CORS policy | 2026-08-13T17:19:21Z | 2026-11-01T10:02:05Z |
| brew-nx-cve-2026-104854 | Nx daemon and plugin worker sockets are accessible to other local users | 2026-10-06T10:14:44Z | 2026-11-01T10:02:05Z |
| brew-nx-cve-2026-104853 | Nx: Path traversal in nx migrate package-migrations extraction | 2026-10-06T10:14:44Z | 2026-11-01T10:02:05Z |
| brew-tox-cve-2026-22702 | virtualenv Has TOCTOU Vulnerabilities in Directory Creation | 2026-08-13T17:44:50Z | 2026-11-01T09:47:46Z |
| brew-tox-cve-2026-22701 | filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock | 2026-08-13T17:44:50Z | 2026-11-01T09:47:46Z |
| brew-tox-cve-2026-115586 | virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9) | 2026-10-29T21:45:01Z | 2026-11-01T09:47:46Z |
| brew-tox-cve-2026-113776 | virtualenv activation scripts run code from a path that contains a placeholder name | 2026-10-22T09:02:57Z | 2026-11-01T09:47:46Z |
| brew-tox-cve-2026-113732 | virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote | 2026-10-22T09:02:57Z | 2026-11-01T09:47:46Z |
| brew-tox-cve-2026-113726 | virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST | 2026-10-22T09:02:57Z | 2026-11-01T09:47:46Z |
| brew-tox-cve-2026-113725 | virtualenv bash activate runs commands from an environment name with a backslash before $ | 2026-10-22T09:02:57Z | 2026-11-01T09:47:46Z |
| brew-tox-cve-2026-113724 | virtualenv: Deletion recovery can change a symlink target's mode | 2026-10-22T09:02:57Z | 2026-11-01T09:47:46Z |
| brew-tox-cve-2026-113723 | virtualenv: Bash prompt values can change meaning under older compatibility modes | 2026-10-29T21:45:01Z | 2026-11-01T09:47:46Z |
| brew-tox-cve-2026-113722 | virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax | 2026-10-22T09:02:57Z | 2026-11-01T09:47:46Z |
| brew-tox-cve-2026-113721 | virtualenv: Generated files can follow existing destination links | 2026-10-23T09:03:39Z | 2026-11-01T09:47:46Z |
| brew-tox-cve-2026-113720 | virtualenv: Seeded files retain permissions from an older cache | 2026-10-26T09:10:34Z | 2026-11-01T09:47:46Z |
| brew-tox-cve-2026-113719 | virtualenv: Seed replacement does not contain metadata deletion paths | 2026-10-26T09:10:34Z | 2026-11-01T09:47:46Z |
| brew-tox-cve-2026-113718 | virtualenv: Xonsh activation literals depend on the script decoding codec | 2026-10-26T09:10:34Z | 2026-11-01T09:47:46Z |
| brew-tox-cve-2026-113717 | virtualenv: Pip seeding with download omits wheel digest verification | 2026-10-26T09:10:34Z | 2026-11-01T09:47:46Z |
| brew-tox-cve-2026-113716 | virtualenv: Builtin creation follows linked environment directories | 2026-10-22T09:02:57Z | 2026-11-01T09:47:46Z |
| brew-tox-cve-2026-113715 | virtualenv: Venv configuration readback can reinterpret path boundaries | 2026-10-26T09:10:34Z | 2026-11-01T09:47:46Z |
| brew-tox-cve-2026-113714 | virtualenv: Downloaded wheel selection and caching precede verification | 2026-10-26T09:10:34Z | 2026-11-01T09:47:46Z |
| brew-tox-cve-2026-113713 | virtualenv: Temporary app-data can leave dangling seed package links | 2026-10-29T21:45:01Z | 2026-11-01T09:47:46Z |
| brew-tox-cve-2026-112941 | filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock | 2026-10-29T21:45:01Z | 2026-11-01T09:47:46Z |
| brew-tox-cve-2026-112940 | filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files | 2026-10-29T21:45:01Z | 2026-11-01T09:47:46Z |
| brew-tox-cve-2026-112939 | filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker | 2026-10-29T21:45:01Z | 2026-11-01T09:47:46Z |
| brew-tox-cve-2026-112938 | filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user chooses | 2026-10-29T21:45:01Z | 2026-11-01T09:47:46Z |
| brew-tox-cve-2026-112937 | filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name | 2026-10-29T21:45:01Z | 2026-11-01T09:47:46Z |
| brew-tox-cve-2026-112936 | filelock: ReadWriteLock follows a symlink at the lock path into SQLite | 2026-10-29T21:45:01Z | 2026-11-01T09:47:46Z |