p PatchFirst

PatchFirst · Vulnérabilités récentes

Vulnérabilités de la pile Python · Page n° 115

Vulnérabilités publiées pour Python au cours des 30 derniers jours : 350. Présentes dans le catalogue KEV : 1.

RSS ↗ JSON ↗
Filtrer les vulnérabilités
Python

Vulnérabilités : 7131

  1. CVE-2026-34730

    Moyenne · CVSS 5.5EPSS 0,3%Correctif disponible

    Copier `_external_data` allows path traversal and absolute-path local file read without unsafe mode

    Copier is a library and CLI app for rendering project templates. Prior to version 9.14.1, Copier's _external_data feature allows a template to load YAML files using template-controlled paths. If untrusted templates are in scope, a malicious template can read attacker-chosen YAML-parseable local files that are accessible to the user running Copier and expose their contents in rendered output. This issue has been patched in version 9.14.1.

    copier copierPython
    • Mettez à jour vers 9.14.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  2. CVE-2026-34726

    Moyenne · CVSS 4.4EPSS 0,4%Correctif disponible

    Copier `_subdirectory` allows template root escape via parent-directory traversal

    Copier is a library and CLI app for rendering project templates. Prior to version 9.14.1, Copier's _subdirectory setting is documented as the subdirectory to use as the template root. However, the current implementation accepts parent-directory traversal such as .. and uses it directly when selecting the template root. As a result, a template can escape its own directory and make Copier render files from the parent directory without --UNSAFE. This issue has been patched in version 9.14.1.

    copier copierPython
    • Mettez à jour vers 9.14.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  3. CVE-2026-34591

    Élevée · CVSS 7.1EPSS 0,49%Correctif disponible

    Poetry Has Wheel Path Traversal Which Can Lead to Arbitrary File Write

    Poetry is a dependency manager for Python. From version 1.4.0 to before version 2.3.3, a crafted wheel can contain ../ paths that Poetry writes to disk without containment checks, allowing arbitrary file write with the privileges of the Poetry process. It is reachable from untrusted package artifacts during normal install flows. (Normally, installing a malicious wheel is not sufficient for execution of malicious code. Malicious code will only be executed after installation if the malicious package is imported or invoked by the user.). This issue has been patched in version 2.3.3.

    poetry poetry poetry poetry poetry poetry poetry poetry poetry poetrySystèmes d’exploitation Python
    • Mettez à jour vers 2.1.2+dfsg-1+deb13u1
    • Mettez à jour vers 2.3.3
    • Mettez à jour vers 2.3.4-0.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  4. CVE-2026-33641

    Élevée · CVSS 7.8EPSS 0,9%Code d’exploitation publicCorrectif disponible

    Glances Vulnerable to Command Injection via Dynamic Configuration Values

    Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.3, Glances supports dynamic configuration values in which substrings enclosed in backticks are executed as system commands during configuration parsing. This behavior occurs in Config.get_value() and is implemented without validation or restriction of the executed commands. If an attacker can modify or influence configuration files, arbitrary commands will execute automatically with the privileges of the Glances process during startup or configuration reload. In deployments where Glances runs with elevated privileges (e.g., as a system service), this may lea

    glances glances glances glances glances glances glances glances glances glances glances glancesSystèmes d’exploitation Python
    • Mettez à jour vers 4.5.3
    • Mettez à jour vers 4.5.3.2+dfsg-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  5. CVE-2026-33533

    Élevée · CVSS 7.1EPSS 0,34%Correctif disponible

    Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard

    Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.3, the Glances XML-RPC server (activated with glances -s or glances --server) sends Access-Control-Allow-Origin: * on every HTTP response. Because the XML-RPC handler does not validate the Content-Type header, an attacker-controlled webpage can issue a CORS "simple request" (POST with Content-Type: text/plain) containing a valid XML-RPC payload. The browser sends the request without a preflight check, the server processes the XML body and returns the full system monitoring dataset, and the wildcard CORS header lets the attacker's JavaScript read the response

    glances glances glances glances glances glances glances glances glances glances glances glancesSystèmes d’exploitation Python
    • Mettez à jour vers 4.5.3
    • Mettez à jour vers 4.5.3.2+dfsg-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  6. CVE-2026-32871

    Critique · CVSS 10EPSS 0,92%Correctif disponible

    FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability

    FastMCP is a Pythonic way to build MCP servers and clients. Prior to version 3.2.0, the OpenAPIProvider in FastMCP exposes internal APIs to MCP clients by parsing OpenAPI specifications. The RequestDirector class is responsible for constructing HTTP requests to the backend service. A vulnerability exists in the _build_url() method. When an OpenAPI operation defines path parameters (e.g., /api/v1/users/{user_id}), the system directly substitutes parameter values into the URL template string without URL-encoding. Subsequently, urllib.parse.urljoin() resolves the final URL. Since urljoin() interprets ../ sequences as directory traversal, an atta

    fastmcp fastmcpPython
    • Mettez à jour vers 3.2.0
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  7. CVE-2026-35002

    Critique · CVSS 9.3EPSS 0,86%Correctif disponible

    Agno < 2.3.24 field_type Eval Injection Arbitrary Code Execution

    Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component that allows attackers to execute arbitrary Python code by manipulating the field_type parameter passed to eval(). Attackers can influence the field_type value in a FunctionCall to achieve remote code execution.

    agno agnoPython
    • Mettez à jour vers 2.3.24
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  8. CVE-2026-34543

    Élevée · CVSS 8.7EPSS 0,5%Correctif disponible

    OpenEXR: Heap information disclosure in PXR24 decompression via unchecked decompressed size (undo_pxr24_impl)

    OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From version 3.4.0 to before version 3.4.8, sensitive information from heap memory may be leaked through the decoded pixel data (information disclosure). This occurs under default settings; simply reading a malicious EXR file is sufficient to trigger the issue, without any user interaction. This issue has been patched in version 3.4.8.

    openexr openexr openexr openexr openexr openexr openexr openexr openexrSystèmes d’exploitation Python
    • Mettez à jour vers 3.4.14-0.1
    • Mettez à jour vers 3.4.8
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  9. CVE-2026-34544

    Élevée · CVSS 8.4EPSS 0,25%Correctif disponible

    OpenEXR: integer overflow to OOB write in uncompress_b44_impl()

    OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From version 3.4.0 to before version 3.4.8, a crafted B44 or B44A EXR file can cause an out-of-bounds write in any application that decodes it via exr_decoding_run(). Consequences range from immediate crash (most likely) to corruption of adjacent heap allocations (layout-dependent). This issue has been patched in version 3.4.8.

    openexr openexr openexr openexr openexr openexr openexr openexr openexrSystèmes d’exploitation Python
    • Mettez à jour vers 3.4.14-0.1
    • Mettez à jour vers 3.4.8
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  12. CVE-2026-34531

    Moyenne · CVSS 6.5EPSS 0,34%Correctif disponible

    Flask-HTTPAuth invokes token verification callback when missing or empty token was given by client

    Flask-HTTPAuth provides Basic, Digest and Token HTTP authentication for Flask routes. Prior to version 4.8.1, in a situation where the client makes a request to a token protected resource without passing a token, or passing an empty token, Flask-HTTPAuth would invoke the application's token verification callback function with the token argument set to an empty string. If the application had any users in its database with an empty string set as their token, then it could potentially authenticate the client request against any of those users. This issue has been patched in version 4.8.1.

    flask-httpauth python-flask-httpauth python-flask-httpauth python-flask-httpauth flask-httpauth python-flask-httpauth python-flask-httpauth python-flask-httpauth python-flask-httpauth python-flask-httpauth python-flask-httpauth python-flask-httpauthSystèmes d’exploitation Python
    • Mettez à jour vers 4.8.1
    • Mettez à jour vers 4.8.1-1.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  13. CVE-2026-34525

    Moyenne · CVSS 6.3EPSS 0,3%Correctif disponible

    AIOHTTP: Duplicate Host header accepted

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, multiple Host headers were allowed in aiohttp. This issue has been patched in version 3.13.4.

    aiohttp python-aiohttp python-aiohttp python-aiohttp aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttpSystèmes d’exploitation Python
    • Mettez à jour vers 3.13.4
    • Mettez à jour vers 3.13.5-1
    • Mettez à jour vers 3.8.4-1+deb12u2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  14. CVE-2026-34520

    Faible · CVSS 2.7EPSS 0,48%Correctif disponible

    AIOHTTP: C parser (llhttp) accepts null bytes and control characters in response header values - header injection / security bypass

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most installs) accepted null bytes and control characters in response headers. This issue has been patched in version 3.13.4.

    aiohttp python-aiohttp python-aiohttp python-aiohttp aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttpSystèmes d’exploitation Python
    • Mettez à jour vers 3.13.4
    • Mettez à jour vers 3.13.5-1
    • Mettez à jour vers 3.8.4-1+deb12u2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  15. CVE-2026-34519

    Faible · CVSS 2.7EPSS 0,3%Correctif disponible

    AIOHTTP: HTTP response splitting via \r in reason phrase

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.

    aiohttp python-aiohttp python-aiohttp python-aiohttp aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttpSystèmes d’exploitation Python
    • Mettez à jour vers 3.13.4
    • Mettez à jour vers 3.13.5-1
    • Mettez à jour vers 3.8.4-1+deb12u2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  16. CVE-2026-34518

    Faible · CVSS 2.7EPSS 0,35%Correctif disponible

    AIOHTTP: Cookie and Proxy-Authorization headers leaked on cross-origin redirect

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, when following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers. This issue has been patched in version 3.13.4.

    aiohttp python-aiohttp python-aiohttp python-aiohttp aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttpSystèmes d’exploitation Python
    • Mettez à jour vers 3.13.4
    • Mettez à jour vers 3.13.5-1
    • Mettez à jour vers 3.8.4-1+deb12u2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  17. CVE-2026-34517

    Faible · CVSS 2.7EPSS 0,4%Correctif disponible

    AIOHTTP: Late size enforcement for non-file multipart fields causes memory DoS

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, for some multipart form fields, aiohttp read the entire field into memory before checking client_max_size. This issue has been patched in version 3.13.4.

    aiohttp python-aiohttp python-aiohttp python-aiohttp aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttpSystèmes d’exploitation Python
    • Mettez à jour vers 3.13.4
    • Mettez à jour vers 3.13.5-1
    • Mettez à jour vers 3.8.4-1+deb12u2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  18. CVE-2026-34516

    Moyenne · CVSS 6.6EPSS 0,46%Correctif disponible

    AIOHTTP: Multipart Header Size Bypass

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, a response with an excessive number of multipart headers may be allowed to use more memory than intended, potentially allowing a DoS vulnerability. This issue has been patched in version 3.13.4.

    aiohttp python-aiohttp python-aiohttp python-aiohttp aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttpSystèmes d’exploitation Python
    • Mettez à jour vers 0.20.2-1ubuntu0.1~esm1
    • Mettez à jour vers 3.0.1-1ubuntu0.1~esm7
    • Mettez à jour vers 3.13.3-3ubuntu1+esm1
    • Mettez à jour vers 3.13.4
    • Mettez à jour vers 3.13.5-1
    • Mettez à jour vers 3.8.1-4ubuntu0.2+esm3
    • Mettez à jour vers 3.8.4-1+deb12u2
    • Mettez à jour vers 3.9.1-1ubuntu0.1+esm3
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  19. CVE-2026-34515

    Moyenne · CVSS 6.6EPSS 0,45%Correctif disponible

    AIOHTTP: UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This issue has been patched in version 3.13.4.

    aiohttp aiohttp python-aiohttpSystèmes d’exploitation Python
    • Mettez à jour vers 3.13.4
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  20. CVE-2026-34514

    Faible · CVSS 2.7EPSS 0,33%Correctif disponible

    AIOHTTP: CRLF injection in multipart part content type header construction

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the content_type parameter in aiohttp could use this to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.

    aiohttp python-aiohttp python-aiohttp python-aiohttp aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttp python-aiohttpSystèmes d’exploitation Python
    • Mettez à jour vers 0.20.2-1ubuntu0.1~esm1
    • Mettez à jour vers 3.0.1-1ubuntu0.1~esm7
    • Mettez à jour vers 3.13.3-3ubuntu1+esm1
    • Mettez à jour vers 3.13.4
    • Mettez à jour vers 3.13.5-1
    • Mettez à jour vers 3.8.1-4ubuntu0.2+esm3
    • Mettez à jour vers 3.8.4-1+deb12u2
    • Mettez à jour vers 3.9.1-1ubuntu0.1+esm3
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

Vérifiez votre serveur

Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.

Vérifiez votre serveur →