CVE-2026-13346: pip absolute path traversal during download from malicious package indexes
CVE-2026-13346 is a vulnerability in pip absolute path traversal during download from malicious package indexes, rated Moderate by Microsoft. Microsoft has not reported exploitation in the wild. The EPSS model estimates a 0.29% probability of exploitation activity in the next 30 days, higher than 22% of all scored vulnerabilities. Microsoft released the fix on 6 August 2026, outside Patch Tuesday. It affects 4 products in 1 product family (Open Source Software).
CVE-2026-57968: Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability (High, CVSS 7.8)
CVE-2026-57973: Windows Subsystem for Linux (WSL2) Kernel Tampering Vulnerability (Medium, CVSS 6.3)
CVE-2026-44210: Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations (Critical, CVSS 9.9)
CVE-2026-15043: DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text (Critical, CVSS 9.8)
CVE-2026-17543: SQL injection in ext-pgsql via E'...' backslash breakout (Critical, CVSS 9.8)
CVE-2026-38968: ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session identifiers in src/HTTPserver.cpp use weak time-seeded pseudo-randomness during session creation. As a result, fresh authenticated logins can receive deterministic or colliding session cookies under attacker-controlled timing. (Critical, CVSS 9.8)
CVE-2026-53374: drm/amdgpu: zero-initialize GART table on allocation (Critical, CVSS 9.8)