p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Schwachstellen im Stack Python · Seite 13

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für Python: 306. Davon im KEV-Katalog: 0.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Python

Sicherheitslücken: 7029

  1. CVE-2026-105745

    Mittel · CVSS 6.7EPSS 0,12%Korrektur verfügbar

    Docling: Plugin entry points are imported before the allow_external_plugins check

    Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.27.0 until 2.131.0, Docling plugin factories in docling/models/factories/base_factory.py call load_setuptools_entrypoints() before applying the allow_external_plugins setting, so every module registered in the Docling entry-point group is imported even when external plugins are disabled. An installed third-party or compromised package can therefore execute import-time code when Docling starts, while the subsequent namespace filter misleadingly reports that the plugin was not loaded. This issue is fixed in 2.131

    docling docling-slim docling docling-slimPython
    • Auf 2.131.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. CVE-2026-105744

    Hoch · CVSS 7.5EPSS 0,37%Öffentlicher ExploitKorrektur verfügbar

    Docling: Arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine

    Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until 2.132.0, callers that opt into LatexBackendOptions(tikz_engine="tectonic") invoke docling/backend/latex/engines/tectonic.py to compile an untrusted TikZ body and document preamble without restricting TeX file primitives including \openin and \openout. Crafted input can read files available to the converter and create or overwrite writable files, and enabling the tikz_engine_allow_shell_escape option additionally permits shell commands through TeX. The default configuration, which does not enable Tect

    docling docling-slim docling docling-slimPython
    • Auf 2.132.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. CVE-2026-105743

    Mittel · CVSS 4EPSS 0,2%Korrektur verfügbar

    Docling: SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)

    Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.91.0 until 2.132.0, validate_url_safety in docling/backend/utils/image_resource_loader.py validates a hostname with a single IPv4 lookup and then allows the HTTP client to resolve and parse the original URL again, permitting DNS rebinding, mixed public and internal address records, and backslash authority parser disagreement to reach internal services. HTMLBackendOptions(render_page=True) also allows HTTP and HTTPS browser requests without validating their resolved destination. Exploitation requires remote fetc

    docling docling-slim docling docling-slimPython
    • Auf 2.132.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  4. CVE-2026-105742

    Niedrig · CVSS 3.7EPSS 0,25%Öffentlicher ExploitKorrektur verfügbar

    Docling: Configured HTTP headers sent to every remote image host named by a document

    Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.95.0 until 2.132.0, the HTML image resource loader in docling/backend/utils/image_resource_loader.py forwards headers configured through the HTMLBackendOptions.headers setting to every remote image URL named by an untrusted document when enable_remote_fetch=True and fetch_images=True. The loader does not restrict those credentials to the source document's origin, allowing requests that carry custom headers such as API keys and cookies to follow cross-origin redirects and expose the caller's configured credentia

    docling docling-slim docling docling-slimPython
    • Auf 2.132.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  5. CVE-2026-105741

    Hoch · CVSS 7.1EPSS 0,24%Korrektur verfügbar

    Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write

    Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.5.0 until 1.10.3, an IP spoofing vulnerability in the Model Context Protocol (MCP) configuration installation endpoint (POST /api/v1/mcp/project/{project_id}/install) allowed authenticated remote attackers to bypass the "local-only" access restriction. By sending a spoofed X-Forwarded-For: 127.0.0.1 header, an attacker could make the server treat the request as originating from localhost, letting them write/overwrite an MCP client configuration file on the server's filesystem. This vulnerability is fixed in 1.10.3.

    langflow langflowPython
    • Auf 1.10.3 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  6. CVE-2026-105699

    Hoch · CVSS 7.1EPSS 0,31%Korrektur verfügbar

    Langflow: Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers

    Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.6.8 until 1.9.1, Langflow authenticated access to the project identifier in a project-scoped MCP connection but did not authorize the resource URI supplied to resources/read. read_resource forwarded the attacker-controlled URI to handle_read_resource, which parsed a flow_id and filename and called storage_service.get_file without verifying that the flow belonged to the authenticated user or current project. A user with access to any project-scoped MCP endpoint could therefore request another user's flow-backed file, while global handle_list_resources and han

    langflow langflowPython
    • Auf 1.9.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  7. CVE-2026-105698

    Mittel · CVSS 5.4EPSS 0,22%Öffentlicher ExploitKorrektur verfügbar

    Langflow: Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints

    Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.0.0 until 1.10.1, Langflow did not verify flow ownership in the deprecated POST /api/v1/build/{flow_id}/vertices and POST /api/v1/build/{flow_id}/vertices/{vertex_id} handlers. Through version 1.7.1, an unauthenticated caller who knew another user's flow UUID could reach these handlers; from version 1.7.2 through 1.10.0, callers had to authenticate but needed no elevated privileges. Such a caller could cause retrieve_vertices_order to load and cache the private graph, enumerate its vertex identifiers, and use build_vertex to execute selected vertices and rec

    langflow langflow-base langflow langflow-basePython
    • Auf 0.10.1 aktualisieren
    • Auf 1.10.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  8. CVE-2026-105697

    Kritisch · CVSS 9.9EPSS 0,79%Öffentlicher ExploitKorrektur verfügbar

    Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

    Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and (before 1.10.3) wrapped in bash -c "exec {command} ...". Any user able to reach the MCP server settings ("Settings → MCP Servers → Add MCP Server", POST/PATCH /api/v2/mcp/servers/{server_name}) or to build a flow with the MCP Tools component could add a "server" whose command is an arbitrary OS command (touch, rm -rf, a reverse shell, ...). The command runs on the Langflow host as the Langflow process user as soon as Lang

    langflow langflow-base lfx langflow langflow-base lfxPython
    • Auf 0.10.3 aktualisieren
    • Auf 1.10.3 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  9. CVE-2026-105315

    Mittel · CVSS 5.1EPSS 0,25%Korrektur verfügbar

    django-haystack more_like_this Template Tag elasticsearch_backend.py _to_python eval injection

    A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function _to_python of the file haystack/backends/elasticsearch_backend.py of the component more_like_this Template Tag Handler. Such manipulation of the argument result_class leads to improper neutralization of directives in dynamically evaluated code. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.4.0 is able to address this issue. The name of the patch is eb05f193c9771a68dcc8cfac6674a0d48a52ee9d. It is suggested to upgrade the affected component.

    django-haystack django-haystack django-haystack django-haystack django-haystack django-haystack django-haystack django-haystack django-haystack django-haystack django-haystack django-haystackBetriebssysteme Python
    • Auf 3.4.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  10. CVE-2026-104874

    Mittel · CVSS 5.3EPSS 0,45%Korrektur verfügbar

    Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction

    Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand | d.items(), in multidict_itemsview_or2_impl and subtraction operation, d.items() - operand, in multidict_itemsview_sub1_impl fail to release new key-identity and value references returned for each operand element. Applications that perform these operations over attacker-influenced sequences can leak two strong references per element, and garbage collection cannot reclaim them, so repeated operations can cause unbounded process memory growth and denial of service. Forward union, intersection, no

    multidict multidict python-multidict python-multidict python-multidict python-multidict python-multidict python-multidictBetriebssysteme Python
    • Auf 6.9.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  11. CVE-2026-104873

    Hoch · CVSS 7.6EPSS 0,25%Korrektur verfügbar

    LangGraph SDK custom auth silently ignores actions= on resource decorators

    LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From 0.1.45 until 0.4.4, the langgraph-sdk resource-scoped authorization decorators @auth.on.threads, @auth.on.assistants, and @auth.on.crons ignore the actions argument and register the selected handler for every action on the resource. Because that wildcard resource handler is selected before broader fallback handlers, an authenticated user may bypass fallback action, ownership, or permission checks and read, update, or delete another user's resource. Only Python deployments using actions on the affe

    langgraph langgraph-sdkPython
    • Auf 0.4.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  12. CVE-2026-104851

    Hoch · CVSS 8.8EPSS 0,47%Korrektur verfügbar

    fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

    fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unrestricted jinja2.Template(...).render(...) calls in _process_references1._render_jinja, _process_templates, and _process_gen in fsspec/implementations/reference.py. A document supplied inline or fetched from an attacker-controlled URL can provide template expressions that execute Python code when the reference filesystem is opened, including through consumers such as xarray, before referenced data is read. The

    filesystem_spec fsspec fsspec fsspec fsspec fsspec fsspec fsspec fsspec fsspecBetriebssysteme Python
    • Auf 2026.6.0 aktualisieren
    • Auf 2026.9.0-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  13. CVE-2026-104843

    Mittel · CVSS 5.9EPSS 0,43%Korrektur verfügbar

    uv: Path traversal on Windows through wheel extraction

    uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a directory already present on the user's PATH. Non-Windows hosts are not affected. This issue is fixed in version 0.12.18.

    uv uv uv uv uv-fullBetriebssysteme Python
    • Auf 0.12.18 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  14. CVE-2026-53964

    Hoch · CVSS 7.2EPSS 0,49%Korrektur verfügbar

    Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)

    Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Prior to version 9.1.0, a remote code execution (RCE) via server-side template injection (SSTI) allows for user supplied code to be executed in the server's context where it is executed as the document-merge-server user with the UID 901 thus giving an attacker considerable control over the container. The vulnerability is limited to XLSX templates, were the xltpl library uses a npn-sandboxed Jinja environment for the processing of the template. This issue has been patched in version 9.1.0.

    document-merge-service document-merge-servicePython
    • Auf 9.1.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  15. CVE-2026-77387

    Mittel · CVSS 4EPSS 0,2%Korrektur verfügbar

    geopy: Regular Expression Denial of Service (ReDoS) in geopy.Point

    geopy is a geocoding library for Python. Prior to 2.5.0, geopy.Point and Point.from_string() can spend excessive CPU time due to inefficient regular-expression behavior when an application passes a long malformed coordinate string without the 256-character input limit used by the fix. Geocoder reverse methods also reach the vulnerable parsing path when called with string inputs. Repeated attacker-controlled requests can cause a denial of service, while the numeric Point constructor is unaffected. This issue is fixed in version 2.5.0.

    geopy geopy geopy geopy geopy geopy geopy geopy geopy geopy geopy geopyBetriebssysteme Python
    • Auf 2.5.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  16. CVE-2026-103263

    Hoch · CVSS 8.2EPSS 0,52%Korrektur verfügbar

    Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink

    Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user.

    tornado python-tornado python-tornado python-tornado tornado python-tornado python-tornado python-tornado python-tornado python-tornadoBetriebssysteme Python
    • Auf 4.2.1-1ubuntu3.1+esm4 aktualisieren
    • Auf 4.5.3-1ubuntu0.2+esm4 aktualisieren
    • Auf 6.1.0-3ubuntu0.1~esm6 aktualisieren
    • Auf 6.4.0-1ubuntu0.6 aktualisieren
    • Auf 6.5.4-0.1ubuntu0.2 aktualisieren
    • Auf 6.5.9 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  17. CVE-2026-103262

    Hoch · CVSS 8.7EPSS 0,63%Korrektur verfügbar

    Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient

    Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits, causing the application process to be killed by out-of-memory conditions.

    tornado python-tornado python-tornado python-tornado tornado python-tornado python-tornado python-tornado python-tornado python-tornadoBetriebssysteme Python
    • Auf 4.2.1-1ubuntu3.1+esm4 aktualisieren
    • Auf 4.5.3-1ubuntu0.2+esm4 aktualisieren
    • Auf 6.4.0-1ubuntu0.6 aktualisieren
    • Auf 6.5.4-0.1ubuntu0.2 aktualisieren
    • Auf 6.5.9 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  18. CVE-2026-103261

    Mittel · CVSS 6.9EPSS 0,47%Korrektur verfügbar

    Tornado before 6.5.9 Denial of Service via Query String

    Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.__init__, allowing remote attackers to cause event-loop stalling by sending requests with thousands of query parameters. Attackers can send unauthenticated GET requests with unbounded query-string field counts to degrade response times for all clients sharing the same IOLoop.

    tornado python-tornado python-tornado python-tornado tornado python-tornado python-tornado python-tornado python-tornado python-tornado python-tornado python-tornadoBetriebssysteme Python
    • Auf 6.5.9 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  19. CVE-2026-51886

    Kritisch · CVSS 9.8EPSS 0,6%Öffentlicher ExploitKorrektur verfügbar

    CVE-2026-51886

    langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (remote). The component is: src/backend/base/langflow/api/v1/validate.py:validate-post_validate_code-a-real-authenticated-http-post-to-api-v1. The attack vector is: Attack surface: HTTP or browser-backed service path. A public-facing route accepts raw Python source and forwards it into a server-side compile/exec validation path without any visible entitlement guard. ¶¶ A weakness has been identified in langflow-ai langflow up to 1.9.3. langflow contains a code injection vulnerability in validate-post_validate_code-a-real-authenticated-http-post-t

    n/a langflowPython
    • Auf 1.10.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  20. CVE-2026-103001

    Mittel · CVSS 6.5EPSS 0,26%Öffentlicher ExploitKorrektur verfügbar

    PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse

    PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT._merge_options() method can modify a caller-supplied mutable options mapping when verify_signature is false. If an application reuses that same mapping for a later decode() or decode_complete() call and changes verify_signature to true, the mapping can retain false values for expiration, not-before, issued-at, audience, issuer, subject, and JWT ID checks. A signed token with invalid registered claims can then be accepted without disabling signature verification, but applications that create a fresh options mapping for each call are not affe

    pyjwt pyjwt pyjwt pyjwt pyjwt pyjwt pyjwt pyjwt pyjwt pyjwtBetriebssysteme Python
    • Auf 2.14.0-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →