p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Schwachstellen im Stack Python · Seite 116

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für Python: 350. Davon im KEV-Katalog: 1.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Python

Sicherheitslücken: 7131

  1. CVE-2026-22815

    Mittel · CVSS 6.9EPSS 0,46%Korrektur verfügbar

    AIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headers

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, insufficient restrictions in header/trailer handling could cause uncapped memory usage. This issue has been patched in version 3.13.4.

    aiohttp python-aiohttp python-aiohttp python-aiohttp aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttpBetriebssysteme Python
    • Auf 0.20.2-1ubuntu0.1~esm1 aktualisieren
    • Auf 3.0.1-1ubuntu0.1~esm7 aktualisieren
    • Auf 3.13.3-3ubuntu1+esm1 aktualisieren
    • Auf 3.13.4 aktualisieren
    • Auf 3.13.5-1 aktualisieren
    • Auf 3.8.1-4ubuntu0.2+esm3 aktualisieren
    • Auf 3.8.4-1+deb12u2 aktualisieren
    • Auf 3.9.1-1ubuntu0.1+esm3 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. CVE-2026-34513

    Niedrig · CVSS 2.7EPSS 0,46%Korrektur verfügbar

    AIOHTTP: Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an unbounded DNS cache could result in excessive memory usage possibly resulting in a DoS situation. This issue has been patched in version 3.13.4.

    aiohttp python-aiohttp python-aiohttp python-aiohttp aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttpBetriebssysteme Python
    • Auf 0.20.2-1ubuntu0.1~esm1 aktualisieren
    • Auf 3.0.1-1ubuntu0.1~esm7 aktualisieren
    • Auf 3.13.3-3ubuntu1+esm1 aktualisieren
    • Auf 3.13.4 aktualisieren
    • Auf 3.13.5-1 aktualisieren
    • Auf 3.8.1-4ubuntu0.2+esm3 aktualisieren
    • Auf 3.8.4-1+deb12u2 aktualisieren
    • Auf 3.9.1-1ubuntu0.1+esm3 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. CVE-2026-35000

    Hoch · CVSS 7.1EPSS 0,29%Korrektur verfügbar

    ChangeDetection.io < 0.54.7 SafeXPath3Parser Bypass Arbitrary File Read

    ChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPath3Parser implementation that allows attackers to read arbitrary local files by using unblocked XPath 3.0/3.1 functions such as json-doc() and similar file-access primitives. Attackers can exploit the incomplete blocklist of dangerous XPath functions to access sensitive data from the local filesystem.

    changedetection.io changedetection-ioPython
    • Auf 0.54.7 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  4. CVE-2026-34447

    Mittel · CVSS 5.5EPSS 0,26%Korrektur verfügbar

    ONNX: External Data Symlink Traversal

    Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, there is a symlink traversal vulnerability in external data loading allows reading files outside the model directory. This issue has been patched in version 1.21.0.

    onnx onnx onnx onnx onnx onnx onnx onnx onnx onnxBetriebssysteme Python
    • Auf 1.21.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  5. CVE-2026-34446

    Mittel · CVSS 4.7EPSS 0,18%Korrektur verfügbar

    ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load

    Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, there is an issue in onnx.load, the code checks for symlinks to prevent path traversal, but completely misses hardlinks because a hardlink looks exactly like a regular file on the filesystem. This issue has been patched in version 1.21.0.

    onnx onnx onnx onnx onnx onnx onnx onnx onnx onnxBetriebssysteme Python
    • Auf 1.21.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  6. CVE-2026-27489

    Hoch · CVSS 8.7EPSS 0,62%Korrektur verfügbar

    ONNX: Path Traversal via Symlink

    Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, a path traversal vulnerability via symlink allows to read arbitrary files outside model or user-provided directory. This issue has been patched in version 1.21.0.

    onnx onnx onnx onnx onnx onnx onnx onnx onnx onnxBetriebssysteme Python
    • Auf 1.21.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  7. CVE-2026-34445

    Hoch · CVSS 8.6EPSS 0,29%Korrektur verfügbar

    ONNX: Malicious ONNX models can crash servers by exploiting unprotected object settings.

    Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, the ExternalDataInfo class in ONNX was using Python’s setattr() function to load metadata (like file paths or data lengths) directly from an ONNX model file. It didn’t check if the "keys" in the file were valid. Due to this, an attacker could craft a malicious model that overwrites internal object properties. This issue has been patched in version 1.21.0.

    onnx onnx onnx onnx onnx onnx onnx onnx onnx onnxBetriebssysteme Python
    • Auf 1.21.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  8. CVE-2026-34222

    Hoch · CVSS 7.7EPSS 5,1%Korrektur verfügbar

    Open WebUI has Broken Access Control in Tool Valves

    Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.11, there is a broken access control vulnerability in tool values. This issue has been patched in version 0.8.11.

    open-webui open-webuiPython
    • Auf 0.8.11 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  9. CVE-2026-34450

    Mittel · CVSS 4.8EPSS 0,13%Korrektur verfügbar

    Claude SDK for Python: Insecure Default File Permissions in Local Filesystem Memory Tool

    The Claude SDK for Python provides access to the Claude API from Python applications. From version 0.86.0 to before version 0.87.0, the local filesystem memory tool in the Anthropic Python SDK created memory files with mode 0o666, leaving them world-readable on systems with a standard umask and world-writable in environments with a permissive umask such as many Docker base images. A local attacker on a shared host could read persisted agent state, and in containerized deployments could modify memory files to influence subsequent model behavior. Both the synchronous and asynchronous memory tool implementations were affected. This issue has bee

    anthropic-sdk-python anthropicPython
    • Auf 0.87.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  10. CVE-2026-34452

    Mittel · CVSS 5.8EPSS 0,14%Korrektur verfügbar

    Claude SDK for Python: Memory Tool Path Validation Race Condition Allows Sandbox Escape

    The Claude SDK for Python provides access to the Claude API from Python applications. From version 0.86.0 to before version 0.87.0, the async local filesystem memory tool in the Anthropic Python SDK validated that model-supplied paths resolved inside the sandboxed memory directory, but then returned the unresolved path for subsequent file operations. A local attacker able to write to the memory directory could retarget a symlink between validation and use, causing reads or writes to escape the sandbox. The synchronous memory tool implementation was not affected. This issue has been patched in version 0.87.0.

    anthropic-sdk-python anthropicPython
    • Auf 0.87.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  11. CVE-2026-34400

    Mittel · CVSS 6.9EPSS 0,53%Korrektur verfügbar

    alerta-server has potential SQL Injection vulnerability in Query String Syntax (q=) API

    Alerta is a monitoring tool. Prior to version 9.1.0, the Query string search API (q=) was vulnerable to SQL injection via the Postgres query parser, which built WHERE clauses by interpolating user-supplied search terms directly into SQL strings via f-strings. This issue has been patched in version 9.1.0.

    alerta alerta-serverPython
    • Auf 9.1.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  12. CVE-2026-34203

    Niedrig · CVSS 2.7EPSS 0,26%Korrektur verfügbar

    Nautobot: Management of users via REST API does not apply configured password validators

    Nautobot is a Network Source of Truth and Network Automation Platform. Prior to versions 2.4.30 and 3.0.10, user creation and editing via the REST API fails to apply the password validation rules defined by Django's AUTH_PASSWORD_VALIDATORS setting (which defaults to an empty list, i.e., no specific rules, but can be configured in Nautobot's nautobot_config.py to apply various rules if desired). This can potentially allow for the creation or modification of users to have passwords that are weak or otherwise do not comply with configured standards. This issue has been patched in versions 2.4.30 and 3.0.10.

    nautobot nautobot nautobot nautobotPython
    • Auf 2.4.30 aktualisieren
    • Auf 3.0.10 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  13. CVE-2026-34231

    Mittel · CVSS 6.1EPSS 0,24%Korrektur verfügbar

    Slippers: Cross-Site Scripting (XSS) in `attrs` Template Tag

    Slippers is a UI component framework for Django. Prior to version 0.6.3, a Cross-Site Scripting (XSS) vulnerability exists in the {% attrs %} template tag of the slippers Django package. When a context variable containing untrusted data is passed to {% attrs %}, the value is interpolated into an HTML attribute string without escaping, allowing an attacker to break out of the attribute context and inject arbitrary HTML or JavaScript into the rendered page. This issue has been patched in version 0.6.3.

    slippers slippersPython
    • Auf 0.6.3 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  14. CVE-2026-0596

    Kritisch · CVSS 9.6EPSS 1,39%Korrektur verfügbar

    Command Injection in mlflow/mlflow

    A command injection vulnerability exists in mlflow/mlflow when serving a model with `enable_mlserver=True`. The `model_uri` is embedded directly into a shell command executed via `bash -c` without proper sanitization. If the `model_uri` contains shell metacharacters, such as `$()` or backticks, it allows for command substitution and execution of attacker-controlled commands. This vulnerability affects the latest version of mlflow/mlflow and can lead to privilege escalation if a higher-privileged service serves models from a directory writable by lower-privileged users.

    mlflow/mlflow mlflowPython
    • Auf 3.9.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  15. CVE-2026-34172

    Hoch · CVSS 7.7EPSS 0,64%Korrektur verfügbar

    Giskard Agents have Server-side template injection via ChatWorkflow.chat() using non-sandboxed Jinja2 Environment

    Giskard is an open-source Python library for testing and evaluating agentic systems. Prior to versions 0.3.4 and 1.0.2b1, ChatWorkflow.chat(message) passes its string argument directly as a Jinja2 template source to a non-sandboxed Environment. A developer who passes user input to this method enables full remote code execution via Jinja2 class traversal. The method name chat and parameter name message naturally invite passing user input directly, but the string is silently parsed as a Jinja2 template, not treated as plain text. This issue has been patched in versions 0.3.4 and 1.0.2b1.

    giskard-oss giskard-agents giskard-agents giskard-agentsPython
    • Auf 0.3.4 aktualisieren
    • Auf 1.0.2b1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  16. CVE-2026-34881

    Mittel · CVSS 5EPSS 0,28%Korrektur verfügbar

    CVE-2026-34881

    OpenStack Glance before 29.1.1, 30.x before 30.1.1, and 31.0.0 is affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only glance image import functionality is affected. In particular, the web-download and glance-download import methods are subject to this vulnerability, as is the optional (not enabled by default) ovf_process image import plugin.

    glance glance glance glance glance glance glance glance glance glanceBetriebssysteme Python
    • Auf 29.1.1 aktualisieren
    • Auf 29.2.0 aktualisieren
    • Auf 2:16.0.1-0ubuntu1.1+esm2 aktualisieren
    • Auf 2:20.2.0-0ubuntu1.2+esm2 aktualisieren
    • Auf 2:25.1.0-2+deb12u2 aktualisieren
    • Auf 2:30.0.0-3+deb13u1 aktualisieren
    • Auf 2:31.0.0-3 aktualisieren
    • Auf 30.1.1 aktualisieren
    • Auf 30.2.0 aktualisieren
    • Auf 31.1.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  17. CVE-2026-34073

    Niedrig · CVSS 1.7EPSS 0,23%Korrektur verfügbar

    cryptography has incomplete DNS name constraint enforcement on peer names

    cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each validation. Consequently, cryptography would allow a peer named bar.example.com to validate against a wildcard leaf certificate for *.example.com, even if the leaf's parent certificate (or upwards) contained an excluded subtree constraint for bar.example.com. This issue has been patched in version 46.0.6.

    cryptography python-cryptography python-cryptography python-cryptography cryptographyBetriebssysteme Python
    • Auf 46.0.6 aktualisieren
    • Auf 46.0.6-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  18. CVE-2026-34070

    Hoch · CVSS 7.5EPSS 1,44%Korrektur verfügbar

    LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions

    LangChain is a framework for building agents and LLM-powered applications. Prior to version 1.2.22, multiple functions in langchain_core.prompts.loading read files from paths embedded in deserialized config dicts without validating against directory traversal or absolute path injection. When an application passes user-influenced prompt configurations to load_prompt() or load_prompt_from_config(), an attacker can read arbitrary files on the host filesystem, constrained only by file-extension checks (.txt for templates, .json/.yaml for examples). This issue has been patched in version 1.2.22.

    langchain langchain-corePython
    • Auf 1.2.22 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  19. CVE-2026-32727

    Hoch · CVSS 8.1EPSS 0,53%Korrektur verfügbar

    SciTokens: Authorization Bypass via Path Traversal in Scope Validation

    SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.7, the Enforcer is vulnerable to a path traversal attack where an attacker can use dot-dot (..) in the scope claim of a token to escape the intended directory restriction. This occurs because the library normalizes both the authorized path (from the token) and the requested path (from the application) before comparing them using startswith. This issue has been patched in version 1.9.7.

    scitokens scitokensPython
    • Auf 1.9.7 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  20. CVE-2026-32716

    Hoch · CVSS 8.1EPSS 0,4%Korrektur verfügbar

    SciTokens: Authorization Bypass via Incorrect Scope Path Prefix Checking

    SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the Enforcer incorrectly validates scope paths by using a simple prefix match (startswith). This allows a token with access to a specific path (e.g., /john) to also access sibling paths that start with the same prefix (e.g., /johnathan, /johnny), which is an Authorization Bypass. This issue has been patched in version 1.9.6.

    scitokens scitokensPython
    • Auf 1.9.6 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →