p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Schwachstellen im Stack Python · Seite 137

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für Python: 352. Davon im KEV-Katalog: 1.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Python

Sicherheitslücken: 7133

  1. CVE-2026-22691

    Niedrig · CVSS 2.7EPSS 0,43%Korrektur verfügbar

    pypdf has possible long runtimes for malformed startxref

    pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for malformed startxref. An attacker who uses this vulnerability can craft a PDF which leads to possibly long runtimes for invalid startxref entries. When rebuilding the cross-reference table, PDF files with lots of whitespace characters become problematic. Only the non-strict reading mode is affected. Only the non-strict reading mode is affected. This issue has been patched in version 6.6.0.

    pypdf pypdf pypdf pypdf pypdf2 pypdf pypdf2 pypdf2 pypdf2 pypdf2 pypdf pypdf2Betriebssysteme Python
    • Auf 6.6.0 aktualisieren
    • Auf 6.9.0-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. CVE-2026-22690

    Niedrig · CVSS 2.7EPSS 0,43%Korrektur verfügbar

    pypdf has possible long runtimes for missing /Root object with large /Size values

    pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for missing /Root object with large /Size values. An attacker who uses this vulnerability can craft a PDF which leads to possibly long runtimes for actually invalid files. This can be achieved by omitting the /Root entry in the trailer, while using a rather large /Size value. Only the non-strict reading mode is affected. This issue has been patched in version 6.6.0.

    pypdf pypdf pypdf pypdf pypdf2 pypdf pypdf2 pypdf2 pypdf2 pypdf2 pypdf pypdf2Betriebssysteme Python
    • Auf 6.6.0 aktualisieren
    • Auf 6.9.0-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. CVE-2026-22612

    Hoch · CVSS 8.9EPSS 0,32%Korrektur verfügbar

    Fickling vulnerable to detection bypass due to "builtins" blindness

    Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, Fickling is vulnerable to detection bypass due to "builtins" blindness. This issue has been patched in version 0.1.7.

    fickling ficklingPython
    • Auf 0.1.7 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  4. CVE-2026-22609

    Hoch · CVSS 8.9EPSS 0,63%Korrektur verfügbar

    Fickling has Static Analysis Bypass via Incomplete Dangerous Module Blocklist

    Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, the unsafe_imports() method in Fickling's static analyzer fails to flag several high-risk Python modules that can be used for arbitrary code execution. Malicious pickles importing these modules will not be detected as unsafe, allowing attackers to bypass Fickling's primary static safety checks. This issue has been patched in version 0.1.7.

    fickling ficklingPython
    • Auf 0.1.7 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  5. CVE-2026-22608

    Hoch · CVSS 8.9EPSS 0,39%Korrektur verfügbar

    Fickling vulnerable to use of ctypes and pydoc gadget chain to bypass detection

    Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, both ctypes and pydoc modules aren't explicitly blocked. Even other existing pickle scanning tools (like picklescan) do not block pydoc.locate. Chaining these two together can achieve RCE while the scanner still reports the file as LIKELY_SAFE. This issue has been patched in version 0.1.7.

    fickling ficklingPython
    • Auf 0.1.7 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  6. CVE-2026-22607

    Hoch · CVSS 8.9EPSS 0,52%Korrektur verfügbar

    Fickling Blocklist Bypass: cProfile.run()

    Fickling is a Python pickling decompiler and static analyzer. Fickling versions up to and including 0.1.6 do not treat Python's cProfile module as unsafe. Because of this, a malicious pickle that uses cProfile.run() is classified as SUSPICIOUS instead of OVERTLY_MALICIOUS. If a user relies on Fickling's output to decide whether a pickle is safe to deserialize, this misclassification can lead them to execute attacker-controlled code on their system. This affects any workflow or product that uses Fickling as a security gate for pickle deserialization. This issue has been patched in version 0.1.7.

    fickling ficklingPython
    • Auf 0.1.7 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  7. CVE-2026-22606

    Hoch · CVSS 8.9EPSS 0,48%Korrektur verfügbar

    Fickling has a bypass via runpy.run_path() and runpy.run_module()

    Fickling is a Python pickling decompiler and static analyzer. Fickling versions up to and including 0.1.6 do not treat Python’s runpy module as unsafe. Because of this, a malicious pickle that uses runpy.run_path() or runpy.run_module() is classified as SUSPICIOUS instead of OVERTLY_MALICIOUS. If a user relies on Fickling’s output to decide whether a pickle is safe to deserialize, this misclassification can lead them to execute attacker-controlled code on their system. This affects any workflow or product that uses Fickling as a security gate for pickle deserialization. This issue has been patched in version 0.1.7.

    fickling ficklingPython
    • Auf 0.1.7 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  8. CVE-2026-22584

    Kritisch · CVSS 9.8EPSS 0,44%Korrektur verfügbar

    CVE-2026-22584

    Improper Control of Generation of Code ('Code Injection') vulnerability in Salesforce Uni2TS on MacOS, Windows, Linux allows Leverage Executable Code in Non-Executable Files.This issue affects Uni2TS: through 1.2.0.

    uni2ts uni2tsPython
    • Auf 2.0.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  9. CVE-2026-21860

    Mittel · CVSS 6.3EPSS 0,47%Korrektur verfügbar

    Werkzeug safe_join() allows Windows special device names with compound extensions

    Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.5, Werkzeug's safe_join function allows path segments with Windows device names that have file extensions or trailing spaces. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. Windows still accepts them with any file extension, such as CON.txt, or trailing spaces such as CON. This issue has been patched in version 3.1.5.

    werkzeug werkzeugPython
    • Auf 3.1.5 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  10. CVE-2025-68158

    Mittel · CVSS 5.7EPSS 0,27%Korrektur verfügbar

    Authlib: 1-click Account Takeover

    Authlib is a Python library which builds OAuth and OpenID Connect servers. In versions 1.0.0 through 1.6.5, cache-backed state/request-token storage is not tied to the initiating user session, so CSRF is possible for any attacker that has a valid state (easily obtainable via an attacker-initiated authentication flow). When a cache is supplied to the OAuth client registry, FrameworkIntegration.set_state_data writes the entire state blob under _state_{app}_{state}, and get_state_data ignores the caller’s session altogether. This issue has been patched in version 1.6.6.

    authlib python-authlib python-authlib python-authlib authlib python-authlib python-authlibBetriebssysteme Python
    • Auf 1.2.0-1+deb12u1 aktualisieren
    • Auf 1.3.0-1ubuntu0.1~esm1 aktualisieren
    • Auf 1.6.0-1+deb13u1 aktualisieren
    • Auf 1.6.6 aktualisieren
    • Auf 1.6.6-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  11. CVE-2026-22041

    Niedrig · CVSS 2EPSS 0,27%Korrektur verfügbar

    loggingredactor converts non-string types to string types in logs

    Logging Redactor is a Python library designed to redact sensitive data in logs based on regex patterns and / or dictionary keys. Prior to version 0.0.6, non-string types are converted into string types, leading to type errors in %d conversions. The problem has been patched in version 0.0.6. No known workarounds are available.

    loggingredactor loggingredactorPython
    • Auf 0.0.6 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  12. CVE-2026-21892

    Mittel · CVSS 5.3EPSS 0,27%Korrektur verfügbar

    Parsl Monitoring Visualization Vulnerable to SQL Injection

    Parsl is a Python parallel scripting library. A SQL Injection vulnerability exists in the parsl-visualize component of versions prior to 2026.01.05. The application constructs SQL queries using unsafe string formatting (Python % operator) with user-supplied input (workflow_id) directly from URL routes. This allows an unauthenticated attacker with access to the visualization dashboard to inject arbitrary SQL commands, potentially leading to data exfiltration or denial of service against the monitoring database. Version 2026.01.05 fixes the issue.

    parsl python-parsl python-parsl parsl python-parsl python-parslBetriebssysteme Python
    • Auf 2024.02.26+ds-1ubuntu0.1~esm1 aktualisieren
    • Auf 2025.01.13+ds-1+deb13u1 aktualisieren
    • Auf 2026.01.05 aktualisieren
    • Auf 2026.01.05+ds-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  13. CVE-2026-21874

    Mittel · CVSS 5.3EPSS 0,55%Korrektur verfügbar

    NiceGUI has Redis connection leak via tab storage causes service degradation

    NiceGUI is a Python-based UI framework. From versions v2.10.0 to 3.4.1, an unauthenticated attacker can exhaust Redis connections by repeatedly opening and closing browser tabs on any NiceGUI application using Redis-backed storage. Connections are never released, leading to service degradation when Redis hits its connection limit. NiceGUI continues accepting new connections - errors are logged but the app stays up with broken storage functionality. This issue has been patched in version 3.5.0.

    nicegui niceguiPython
    • Auf 3.5.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  14. CVE-2026-21873

    Hoch · CVSS 7.2EPSS 0,26%Korrektur verfügbar

    Zero-click XSS in all NiceGUI apps which uses `ui.sub_pages`

    NiceGUI is a Python-based UI framework. From versions 2.22.0 to 3.4.1, an unsafe implementation in the pushstate event listener used by ui.sub_pages allows an attacker to manipulate the fragment identifier of the URL, which they can do despite being cross-site, using an iframe. This issue has been patched in version 3.5.0.

    nicegui niceguiPython
    • Auf 3.5.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  15. CVE-2026-21872

    Mittel · CVSS 6.1EPSS 0,27%Korrektur verfügbar

    NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links

    NiceGUI is a Python-based UI framework. From versions 2.22.0 to 3.4.1, an unsafe implementation in the click event listener used by ui.sub_pages, combined with attacker-controlled link rendering on the page, causes XSS when the user actively clicks on the link. This issue has been patched in version 3.5.0.

    nicegui niceguiPython
    • Auf 3.5.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  16. CVE-2026-21871

    Mittel · CVSS 6.1EPSS 0,27%Korrektur verfügbar

    NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace()

    NiceGUI is a Python-based UI framework. From versions 2.13.0 to 3.4.1, there is a XSS risk in NiceGUI when developers pass attacker-controlled strings into ui.navigate.history.push() or ui.navigate.history.replace(). These helpers are documented as History API wrappers for updating the browser URL without page reload. However, if the URL argument is embedded into generated JavaScript without proper escaping, a crafted payload can break out of the intended string context and execute arbitrary JavaScript in the victim’s browser. Applications that do not pass untrusted input into ui.navigate.history.push/replace are not affected. This issue has

    nicegui niceguiPython
    • Auf 3.5.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  17. CVE-2026-21883

    Mittel · CVSS 4.5EPSS 0,18%Korrektur verfügbar

    Bokeh server applications have Incomplete Origin Validation in WebSockets

    Bokeh is an interactive visualization library written in Python. In versions 3.8.1 and below, if a server is configured with an allowlist (e.g., dashboard.corp), an attacker can register a domain like dashboard.corp.attacker.com (or use a subdomain if applicable) and lure a victim to visit it. The malicious site can then initiate a WebSocket connection to the vulnerable Bokeh server. Since the Origin header (e.g., http://dashboard.corp.attacker.com/) matches the allowlist according to the flawed logic, the connection is accepted. Once connected, the attacker can interact with the Bokeh server on behalf of the victim, potentially accessing sen

    bokeh bokehPython
    • Auf 3.8.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  18. CVE-2025-15346

    Kritisch · CVSS 9.3EPSS 0,33%Korrektur verfügbar

    wolfSSL Python library `CERT_REQUIRED` mode fails to enforce client certificate requirement

    A vulnerability in the handling of verify_mode = CERT_REQUIRED in the wolfssl Python package (wolfssl-py) causes client certificate requirements to not be fully enforced.  Because the WOLFSSL_VERIFY_FAIL_IF_NO_PEER_CERT flag was not included, the behavior effectively matched CERT_OPTIONAL: a peer certificate was verified if presented, but connections were incorrectly authenticated when no client certificate was provided.  This results in improper authentication, allowing attackers to bypass mutual TLS (mTLS) client authentication by omitting a client certificate during the TLS handshake.  The issue affects versions up to and including 5.8.

    wolfssl-py wolfsslPython
    • Auf 5.8.4.post0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  19. CVE-2023-7333

    Mittel · CVSS 4.8EPSS 0,19%Korrektur verfügbar

    bluelabsio records-mover Table Object sql injection

    A weakness has been identified in bluelabsio records-mover up to 1.5.4. The affected element is an unknown function of the component Table Object Handler. This manipulation causes sql injection. The attack needs to be launched locally. Upgrading to version 1.6.0 is sufficient to fix this issue. Patch name: 3f8383aa89f45d861ca081e3e9fd2cc9d0b5dfaa. You should upgrade the affected component.

    records-mover records-moverPython
    • Auf 1.6.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  20. CVE-2026-21851

    Mittel · CVSS 5.3EPSS 0,36%Korrektur verfügbar

    MONAI has Path Traversal (Zip Slip) in NGC Private Bundle Download

    MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. In versions up to and including 1.5.1, a Path Traversal (Zip Slip) vulnerability exists in MONAI's `_download_from_ngc_private()` function. The function uses `zipfile.ZipFile.extractall()` without path validation, while other similar download functions in the same codebase properly use the existing `safe_extract_member()` function. Commit 4014c8475626f20f158921ae0cf98ed259ae4d59 fixes this issue.

    monai monaiPython
    • Auf 1.5.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →