p PatchFirst

PatchFirst · Vulnerabilidades recientes

Vulnerabilidades de la pila Python · Página 115

Vulnerabilidades publicadas para Python en los últimos 30 días: 350. Incluidas en el catálogo KEV: 1.

RSS ↗ JSON ↗
Filtrar vulnerabilidades
Python

Vulnerabilidades: 7131

  1. CVE-2026-34730

    Media · CVSS 5.5EPSS 0,3%Corrección disponible

    Copier `_external_data` allows path traversal and absolute-path local file read without unsafe mode

    Copier is a library and CLI app for rendering project templates. Prior to version 9.14.1, Copier's _external_data feature allows a template to load YAML files using template-controlled paths. If untrusted templates are in scope, a malicious template can read attacker-chosen YAML-parseable local files that are accessible to the user running Copier and expose their contents in rendered output. This issue has been patched in version 9.14.1.

    copier copierPython
    • Actualiza a 9.14.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  2. CVE-2026-34726

    Media · CVSS 4.4EPSS 0,4%Corrección disponible

    Copier `_subdirectory` allows template root escape via parent-directory traversal

    Copier is a library and CLI app for rendering project templates. Prior to version 9.14.1, Copier's _subdirectory setting is documented as the subdirectory to use as the template root. However, the current implementation accepts parent-directory traversal such as .. and uses it directly when selecting the template root. As a result, a template can escape its own directory and make Copier render files from the parent directory without --UNSAFE. This issue has been patched in version 9.14.1.

    copier copierPython
    • Actualiza a 9.14.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  3. CVE-2026-34591

    Alta · CVSS 7.1EPSS 0,49%Corrección disponible

    Poetry Has Wheel Path Traversal Which Can Lead to Arbitrary File Write

    Poetry is a dependency manager for Python. From version 1.4.0 to before version 2.3.3, a crafted wheel can contain ../ paths that Poetry writes to disk without containment checks, allowing arbitrary file write with the privileges of the Poetry process. It is reachable from untrusted package artifacts during normal install flows. (Normally, installing a malicious wheel is not sufficient for execution of malicious code. Malicious code will only be executed after installation if the malicious package is imported or invoked by the user.). This issue has been patched in version 2.3.3.

    poetry poetry poetry poetry poetry poetry poetry poetry poetry poetrySistemas operativos Python
    • Actualiza a 2.1.2+dfsg-1+deb13u1
    • Actualiza a 2.3.3
    • Actualiza a 2.3.4-0.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  4. CVE-2026-33641

    Alta · CVSS 7.8EPSS 0,9%Código de explotación públicoCorrección disponible

    Glances Vulnerable to Command Injection via Dynamic Configuration Values

    Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.3, Glances supports dynamic configuration values in which substrings enclosed in backticks are executed as system commands during configuration parsing. This behavior occurs in Config.get_value() and is implemented without validation or restriction of the executed commands. If an attacker can modify or influence configuration files, arbitrary commands will execute automatically with the privileges of the Glances process during startup or configuration reload. In deployments where Glances runs with elevated privileges (e.g., as a system service), this may lea

    glances glances glances glances glances glances glances glances glances glances glances glancesSistemas operativos Python
    • Actualiza a 4.5.3
    • Actualiza a 4.5.3.2+dfsg-1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  5. CVE-2026-33533

    Alta · CVSS 7.1EPSS 0,34%Corrección disponible

    Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard

    Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.3, the Glances XML-RPC server (activated with glances -s or glances --server) sends Access-Control-Allow-Origin: * on every HTTP response. Because the XML-RPC handler does not validate the Content-Type header, an attacker-controlled webpage can issue a CORS "simple request" (POST with Content-Type: text/plain) containing a valid XML-RPC payload. The browser sends the request without a preflight check, the server processes the XML body and returns the full system monitoring dataset, and the wildcard CORS header lets the attacker's JavaScript read the response

    glances glances glances glances glances glances glances glances glances glances glances glancesSistemas operativos Python
    • Actualiza a 4.5.3
    • Actualiza a 4.5.3.2+dfsg-1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  6. CVE-2026-32871

    Crítica · CVSS 10EPSS 0,92%Corrección disponible

    FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability

    FastMCP is a Pythonic way to build MCP servers and clients. Prior to version 3.2.0, the OpenAPIProvider in FastMCP exposes internal APIs to MCP clients by parsing OpenAPI specifications. The RequestDirector class is responsible for constructing HTTP requests to the backend service. A vulnerability exists in the _build_url() method. When an OpenAPI operation defines path parameters (e.g., /api/v1/users/{user_id}), the system directly substitutes parameter values into the URL template string without URL-encoding. Subsequently, urllib.parse.urljoin() resolves the final URL. Since urljoin() interprets ../ sequences as directory traversal, an atta

    fastmcp fastmcpPython
    • Actualiza a 3.2.0
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  7. CVE-2026-35002

    Crítica · CVSS 9.3EPSS 0,86%Corrección disponible

    Agno < 2.3.24 field_type Eval Injection Arbitrary Code Execution

    Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component that allows attackers to execute arbitrary Python code by manipulating the field_type parameter passed to eval(). Attackers can influence the field_type value in a FunctionCall to achieve remote code execution.

    agno agnoPython
    • Actualiza a 2.3.24
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  8. CVE-2026-34543

    Alta · CVSS 8.7EPSS 0,5%Corrección disponible

    OpenEXR: Heap information disclosure in PXR24 decompression via unchecked decompressed size (undo_pxr24_impl)

    OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From version 3.4.0 to before version 3.4.8, sensitive information from heap memory may be leaked through the decoded pixel data (information disclosure). This occurs under default settings; simply reading a malicious EXR file is sufficient to trigger the issue, without any user interaction. This issue has been patched in version 3.4.8.

    openexr openexr openexr openexr openexr openexr openexr openexr openexrSistemas operativos Python
    • Actualiza a 3.4.14-0.1
    • Actualiza a 3.4.8
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  9. CVE-2026-34544

    Alta · CVSS 8.4EPSS 0,25%Corrección disponible

    OpenEXR: integer overflow to OOB write in uncompress_b44_impl()

    OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From version 3.4.0 to before version 3.4.8, a crafted B44 or B44A EXR file can cause an out-of-bounds write in any application that decodes it via exr_decoding_run(). Consequences range from immediate crash (most likely) to corruption of adjacent heap allocations (layout-dependent). This issue has been patched in version 3.4.8.

    openexr openexr openexr openexr openexr openexr openexr openexr openexrSistemas operativos Python
    • Actualiza a 3.4.14-0.1
    • Actualiza a 3.4.8
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  12. CVE-2026-34531

    Media · CVSS 6.5EPSS 0,34%Corrección disponible

    Flask-HTTPAuth invokes token verification callback when missing or empty token was given by client

    Flask-HTTPAuth provides Basic, Digest and Token HTTP authentication for Flask routes. Prior to version 4.8.1, in a situation where the client makes a request to a token protected resource without passing a token, or passing an empty token, Flask-HTTPAuth would invoke the application's token verification callback function with the token argument set to an empty string. If the application had any users in its database with an empty string set as their token, then it could potentially authenticate the client request against any of those users. This issue has been patched in version 4.8.1.

    flask-httpauth python-flask-httpauth python-flask-httpauth python-flask-httpauth flask-httpauth python-flask-httpauth python-flask-httpauth python-flask-httpauth python-flask-httpauth python-flask-httpauth python-flask-httpauth python-flask-httpauthSistemas operativos Python
    • Actualiza a 4.8.1
    • Actualiza a 4.8.1-1.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  13. CVE-2026-34525

    Media · CVSS 6.3EPSS 0,3%Corrección disponible

    AIOHTTP: Duplicate Host header accepted

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, multiple Host headers were allowed in aiohttp. This issue has been patched in version 3.13.4.

    aiohttp python-aiohttp python-aiohttp python-aiohttp aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttpSistemas operativos Python
    • Actualiza a 3.13.4
    • Actualiza a 3.13.5-1
    • Actualiza a 3.8.4-1+deb12u2
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  14. CVE-2026-34520

    Baja · CVSS 2.7EPSS 0,48%Corrección disponible

    AIOHTTP: C parser (llhttp) accepts null bytes and control characters in response header values - header injection / security bypass

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most installs) accepted null bytes and control characters in response headers. This issue has been patched in version 3.13.4.

    aiohttp python-aiohttp python-aiohttp python-aiohttp aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttpSistemas operativos Python
    • Actualiza a 3.13.4
    • Actualiza a 3.13.5-1
    • Actualiza a 3.8.4-1+deb12u2
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  15. CVE-2026-34519

    Baja · CVSS 2.7EPSS 0,3%Corrección disponible

    AIOHTTP: HTTP response splitting via \r in reason phrase

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.

    aiohttp python-aiohttp python-aiohttp python-aiohttp aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttpSistemas operativos Python
    • Actualiza a 3.13.4
    • Actualiza a 3.13.5-1
    • Actualiza a 3.8.4-1+deb12u2
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  16. CVE-2026-34518

    Baja · CVSS 2.7EPSS 0,35%Corrección disponible

    AIOHTTP: Cookie and Proxy-Authorization headers leaked on cross-origin redirect

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, when following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers. This issue has been patched in version 3.13.4.

    aiohttp python-aiohttp python-aiohttp python-aiohttp aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttpSistemas operativos Python
    • Actualiza a 3.13.4
    • Actualiza a 3.13.5-1
    • Actualiza a 3.8.4-1+deb12u2
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  17. CVE-2026-34517

    Baja · CVSS 2.7EPSS 0,4%Corrección disponible

    AIOHTTP: Late size enforcement for non-file multipart fields causes memory DoS

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, for some multipart form fields, aiohttp read the entire field into memory before checking client_max_size. This issue has been patched in version 3.13.4.

    aiohttp python-aiohttp python-aiohttp python-aiohttp aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttpSistemas operativos Python
    • Actualiza a 3.13.4
    • Actualiza a 3.13.5-1
    • Actualiza a 3.8.4-1+deb12u2
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  18. CVE-2026-34516

    Media · CVSS 6.6EPSS 0,46%Corrección disponible

    AIOHTTP: Multipart Header Size Bypass

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, a response with an excessive number of multipart headers may be allowed to use more memory than intended, potentially allowing a DoS vulnerability. This issue has been patched in version 3.13.4.

    aiohttp python-aiohttp python-aiohttp python-aiohttp aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttpSistemas operativos Python
    • Actualiza a 0.20.2-1ubuntu0.1~esm1
    • Actualiza a 3.0.1-1ubuntu0.1~esm7
    • Actualiza a 3.13.3-3ubuntu1+esm1
    • Actualiza a 3.13.4
    • Actualiza a 3.13.5-1
    • Actualiza a 3.8.1-4ubuntu0.2+esm3
    • Actualiza a 3.8.4-1+deb12u2
    • Actualiza a 3.9.1-1ubuntu0.1+esm3
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  19. CVE-2026-34515

    Media · CVSS 6.6EPSS 0,45%Corrección disponible

    AIOHTTP: UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This issue has been patched in version 3.13.4.

    aiohttp aiohttp python-aiohttpSistemas operativos Python
    • Actualiza a 3.13.4
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  20. CVE-2026-34514

    Baja · CVSS 2.7EPSS 0,33%Corrección disponible

    AIOHTTP: CRLF injection in multipart part content type header construction

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the content_type parameter in aiohttp could use this to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.

    aiohttp python-aiohttp python-aiohttp python-aiohttp aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttpSistemas operativos Python
    • Actualiza a 0.20.2-1ubuntu0.1~esm1
    • Actualiza a 3.0.1-1ubuntu0.1~esm7
    • Actualiza a 3.13.3-3ubuntu1+esm1
    • Actualiza a 3.13.4
    • Actualiza a 3.13.5-1
    • Actualiza a 3.8.1-4ubuntu0.2+esm3
    • Actualiza a 3.8.4-1+deb12u2
    • Actualiza a 3.9.1-1ubuntu0.1+esm3
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

Comprueba tu servidor

Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.

Comprueba tu servidor →