p PatchFirst

PatchFirst · Vulnérabilités récentes

Vulnérabilités de la pile Python · Page n° 11

Vulnérabilités publiées pour Python au cours des 30 derniers jours : 343. Présentes dans le catalogue KEV : 1.

RSS ↗ JSON ↗
Filtrer les vulnérabilités
Python

Vulnérabilités : 7072

  1. CVE-2026-110860

    Moyenne · CVSS 6.9EPSS 0,19%Correctif disponible

    GitPython 3.1.62 before 3.2.0 Symlink Path Traversal via Submodule.move()

    GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move(), which checks the destination only lexically and does not reject symbolic links in intermediate path components. An untrusted repository can commit a symlink such as vendor pointing outside the worktree, so an application moving an initialized submodule beneath it relocates the checkout externally and corrupts the index and .gitmodules.

    gitpython python-git python-git python-git gitpython python-git python-git python-git python-git python-git python-git python-gitSystèmes d’exploitation Python
    • Mettez à jour vers 3.2.0
    • Mettez à jour vers 3.2.1-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  2. CVE-2026-110859

    Élevée · CVSS 8.7EPSS 0,39%Correctif disponible

    GitPython before 3.2.0 Arbitrary File Read via Head.checkout() Branch Name

    GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that allows remote attackers to read arbitrary files by supplying a branch name parsed as a git option. Attackers can host a repository whose default branch is named --pathspec-from-file=<path>, causing cloning applications that check out the active branch to leak file contents through GitCommandError messages.

    gitpython python-git python-git gitpython python-git python-git python-git python-git python-git python-git python-git python-gitSystèmes d’exploitation Python
    • Mettez à jour vers 3.2.0
    • Mettez à jour vers 3.2.1-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  3. CVE-2026-110858

    Critique · CVSS 9.2EPSS 0,46%Correctif disponible

    GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec

    GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard inspects only keyword arguments, not the positional refspec. Attackers controlling the refspec can supply --upload-pack=<command> to execute OS commands as the calling process over local-path or SSH transports.

    gitpython python-git python-git python-git gitpython python-git python-git python-git python-git python-git python-git python-gitSystèmes d’exploitation Python
    • Mettez à jour vers 3.2.0
    • Mettez à jour vers 3.2.1-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  4. CVE-2026-110857

    Élevée · CVSS 7.7EPSS 0,42%Code d’exploitation publicCorrectif disponible

    GitPython before 3.2.0 Command Execution via ls_remote ext:: URLs

    GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.ls_remote forwards URLs without check_unsafe_protocols validation. Attackers can supply ext:: remote-helper URLs to execute commands when git permits the ext transport, while merge_base and IndexFile.move also accept unguarded option injection.

    gitpython python-git python-git python-git gitpython python-git python-git python-git python-git python-git python-git python-gitSystèmes d’exploitation Python
    • Mettez à jour vers 3.2.0
    • Mettez à jour vers 3.2.1-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  5. CVE-2026-110856

    Élevée · CVSS 8.7EPSS 0,34%Correctif disponible

    GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_date

    GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines lacking a valid epoch or timezone, causing quadratic backtracking and CPU exhaustion.

    gitpython python-git python-git python-git gitpython python-git python-git python-git python-git python-git python-git python-gitSystèmes d’exploitation Python
    • Mettez à jour vers 3.2.0
    • Mettez à jour vers 3.2.1-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  6. CVE-2026-110855

    Élevée · CVSS 7.1EPSS 0,29%Correctif disponible

    GitPython before 3.2.0 Environment Variable Disclosure via .gitmodules Submodule Name

    GitPython before 3.2.0 contains an information disclosure vulnerability that allows malicious repositories to expand environment variables via separate_git_dir in Repo._clone(), which omits expand_vars=False when calling Git.polish_url(). Attackers can craft a .gitmodules submodule name containing variable syntax so that clone plus submodule_update exposes secrets in .git/modules directory names and DEBUG logs.

    gitpython python-git python-git python-git gitpython python-git python-git python-git python-git python-git python-git python-gitSystèmes d’exploitation Python
    • Mettez à jour vers 3.2.0
    • Mettez à jour vers 3.2.1-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  7. CVE-2026-102682

    Moyenne · CVSS 5.6EPSS 0,23%Correctif disponible

    Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation

    Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From 0.0.98 until 1.6.0, the pipecat-ai package's built-in development runner exposes unauthenticated endpoints including /start, /daily, and /daily-dialin-webhook that can create bot sessions and Daily rooms. The runner binds to localhost by default and is intended only for local development, so exploitation requires an operator to expose it to untrusted traffic through --host 0.0.0.0, a published port, or a tunnel without access controls. An unauthenticated caller can consume local resources and third-party quotas and, depending on

    pipecat pipecat-aiPython
    • Mettez à jour vers 1.6.0
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  8. CVE-2026-55786

    Élevée · CVSS 8.4EPSS 0,26%Correctif disponible

    Flyto2 Core: Unauthenticated Command Execution via HTTP MCP `execute_module`

    Flyto2 Core is an execution kernel for automation and AI-agent workflows. From 2.26.2 until 2.26.4, the HTTP MCP POST /mcp route accepts unauthenticated JSON-RPC tools/call requests and forwards execute_module arguments to the module registry without the require_auth dependency used by the REST execution routes. An unauthenticated caller can select sandbox.execute_shell and supply its command parameter, which reaches asyncio.create_subprocess_shell with the privileges of the flyto-core server process. The endpoint is reachable locally under the default loopback binding and becomes network reachable when an operator binds the server to a non-l

    flyto-core flyto-corePython
    • Mettez à jour vers 2.26.4
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  9. CVE-2026-55787

    Élevée · CVSS 7.1EPSS 0,29%Correctif disponible

    Flyto2 Core: SSRF guard bypass via IPv6 transition addresses (IPv4-mapped / 6to4 / NAT64) in validate_url_ssrf

    Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.3, validate_url_ssrf and is_private_ip in src/core/utils.py compare resolved addresses only against native private IPv4 and IPv6 ranges and do not unwrap IPv4-mapped, IPv4-compatible, 6to4, or NAT64 transition addresses. An authenticated workflow author can provide a transition-form literal URL through the Execution API POST /v1/execute route, http.get, or sibling guarded outbound-request modules, causing the guard to accept an address whose embedded IPv4 points to loopback, RFC 1918, or cloud metadata services. On a host that routes the selected transitio

    flyto-core flyto-corePython
    • Mettez à jour vers 2.26.3
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  10. CVE-2026-59951

    Moyenne · CVSS 6.9EPSS 0,46%Correctif disponible

    MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion

    The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.8.0 until 1.30.0 and 2.2.0, stateful Streamable HTTP servers, including FastMCP, MCPServer, Server.streamable_http_app(), and StreamableHTTPSessionManager, retain session entries without an idle expiration or aggregate session-count limit. DELETE, refused opening requests, and completed sessions do not reliably discard their entries, and each entry can retain parsed initialize parameters. A client that can reach the endpoint can therefore create ordinary short requests that grow server memory without bound until restart. Stateless HT

    python-sdk mcp mcpPython
    • Mettez à jour vers 1.30.0
    • Mettez à jour vers 2.2.0
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  11. CVE-2026-100169

    Élevée · CVSS 7.6EPSS 0,85%Correctif disponible

    Account pre-hijacking in the Prowler API through email based social account linking without verification

    Improper Authentication in the social account linking path of the Prowler API in Prowler from 5.4.0 before 5.35.0 allows a remote unauthenticated attacker to obtain persistent access to the account of a user who has not yet registered, because ProwlerSocialAccountAdapter.pre_social_login() in api/src/backend/api/adapters.py links a Google or GitHub login to any existing local account that has the same email address as the one returned by the provider, without requiring that the address has been verified by the provider or on the existing account, and without any other check that both accounts belong to the same person. Self registration is op

    prowler prowler-cloudPython
    • Mettez à jour vers 5.30.3
    • Mettez à jour vers 5.35.0
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  12. CVE-2026-104250

    Moyenne · CVSS 6.1EPSS 0,23%Correctif disponible

    unstructured: Stored XSS via unescaped HTML generation

    The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. Prior to 0.24.1, partition_html(html_parser_version="v2") and the VLM partitioner can preserve untrusted document tags, attributes, text, and link targets in metadata.text_as_html, while elements_to_html() emits the result as an HTML document. The to_html() path in unstructured/documents/ontology.py does not escape output or reject unsafe URL schemes, allowing event-handler attributes, attribute breakout markup, and javascript: links to survive parsing. When the generated HTML or te

    unstructured unstructuredPython
    • Mettez à jour vers 0.24.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  13. CVE-2026-49264

    Moyenne · CVSS 6.1EPSS 0,23%Code d’exploitation publicCorrectif disponible

    OAuthLib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation

    OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4.0.0, OAuthLib's RevocationEndpoint in oauthlib/oauth2/rfc6749/endpoints/revocation.py reflects an unvalidated callback request parameter into success and error response bodies when enable_jsonp=True. The callback can come from the query string or request body and is used without restricting it to a legal JavaScript function name. A browser application that loads the revocation response as trusted JSONP and permits attacker influence over callback can therefore execute attacker-controlled JavaScript in the including application's origin, with a

    oauthlib python-oauthlib python-oauthlib python-oauthlib oauthlib python-oauthlib python-oauthlib python-oauthlib python-oauthlib python-oauthlib python-oauthlib python-oauthlibSystèmes d’exploitation Python
    • Mettez à jour vers 4.0.0
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  14. CVE-2026-49265

    Moyenne · CVSS 6.8EPSS 0,24%Code d’exploitation publicCorrectif disponible

    OAuthLib: Timing Attack Vulnerability in PKCE code_verifier Comparison

    OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in oauthlib/oauth2/rfc6749/grant_types/authorization_code.py compare attacker-supplied code_verifier values with stored challenges using ordinary string equality in code_challenge_method_plain and code_challenge_method_s256. Because the comparison can return after a length difference or the first mismatching character, repeated token endpoint measurements can reveal common-prefix timing information that could potentially allow recovery of the code_verifier, unauthorized access-token acquisition, and account takeover

    oauthlib python-oauthlib python-oauthlib python-oauthlib oauthlib python-oauthlib python-oauthlib python-oauthlib python-oauthlib python-oauthlib python-oauthlib python-oauthlibSystèmes d’exploitation Python
    • Mettez à jour vers 4.0.0
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  15. CVE-2026-102734

    Moyenne · CVSS 5.5EPSS 0,13%Correctif disponible

    asteval sandbox escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter

    asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutils.py, the default Interpreter with numpy enabled exposes a ctypes type and permits from_address memory access. safe_getattr blocks the ctypes module but not reachable ctypes type objects, while attribute assignments use unfiltered setattr instead of safe_setattr. An attacker-controlled expression can derive an address with id, read memory through from_address, and write through an attribute assignment. The expression can read or corrupt arbitrary process memory, escape the intended sandbox, execute code, disclose secrets, or crash the

    asteval python-asteval python-asteval python-asteval asteval python-asteval python-asteval python-asteval python-asteval python-astevalSystèmes d’exploitation Python
    • Mettez à jour vers 1.0.9
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  16. CVE-2026-102832

    Moyenne · CVSS 4.2EPSS 0,14%Correctif disponible

    JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked

    JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.7 until 4.5.11 and 4.6.4, the markdownviewer:trust and notebook:trust command-link handlers use tracker.currentWidget to resolve the current Markdown viewer or notebook when the user answers rather than retaining the document whose command button was clicked. If another document becomes current while the prompt is open and the user chooses Trust, JupyterLab marks the second document trusted while leaving the clicked document untrusted. Later command buttons in the incorrectly trusted document run without a p

    jupyterlab jupyterlite-core notebook jupyterlab jupyterlab notebook jupyterlite-core jupyterlab jupyterlabSystèmes d’exploitation Python
    • Mettez à jour vers 0.8.4
    • Mettez à jour vers 4.5.11
    • Mettez à jour vers 4.6.4
    • Mettez à jour vers 7.6.3
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  17. CVE-2026-109956

    Élevée · CVSS 8.3EPSS 0,32%Correctif disponible

    NLTK through 3.10.3 Path Traversal via WekaClassifier Model Path

    NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths. Attackers controlling the model_filename or model argument can make the weka JVM write files via -d or probe files via -l outside allowed data roots.

    nltk nltk nltk nltk nltk nltk nltk nltk nltk nltk nltk nltkSystèmes d’exploitation Python
    • Mettez à jour vers 3.10.4
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  18. CVE-2026-57118

    Critique · CVSS 9.8EPSS 0,41%Correctif disponible

    PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints

    PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, AgentTeam.launch and the Agents alias register GET /{path}/list, POST /{path}, and `POST /{path}/{agent_id}' without access-control checks before listing agents or calling agent.chat. A remotely exposed server can therefore let unauthenticated clients enumerate agents, consume model resources, access connected private context, and trigger agent tools or workflow side effects. This vulnerability is fixed in praisonaiagents 1.6.59.

    praisonai praisonaiagents praisonaiagentsPython
    • Mettez à jour vers 1.6.59
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  19. CVE-2026-57143

    Élevée · CVSS 8.8EPSS 0,27%Correctif disponible

    PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter

    PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62, searxng_search and the search_web SearxNG provider pass the LLM-controlled searxng_url parameter directly to requests.get without validating its scheme, host, port, or resolved address. Prompt-injected content can direct the default search tool to internal JSON services, distinguish open and closed internal ports, and attempt cloud-metadata requests, with returned JSON results entering agent context. This issue is fixed in praisonaiagents 1.6.62.

    praisonaiagents praisonaiagentsPython
    • Mettez à jour vers 1.6.61
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  20. CVE-2026-104102

    Moyenne · CVSS 5.3EPSS 0,31%Correctif disponible

    copyparty FTP: upload outside defined volumes (limited path traversal)

    copyparty is a portable file server. Prior to 1.20.19, FTP upload path handling does not confine destinations to configured copyparty volumes. When FTP or FTPS is explicitly enabled, a low-privileged authenticated user can submit traversal paths during upload to create a new file outside configured volumes wherever the copyparty process has write permission. The attacker cannot read or overwrite files, the output name receives a randomized suffix, and copyparty does not execute the file; however, unrelated software on the same host could process the newly created file. This issue is fixed in version 1.20.19.

    copyparty copypartyPython
    • Mettez à jour vers 1.20.19
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

Vérifiez votre serveur

Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.

Vérifiez votre serveur →