p PatchFirst

PatchFirst · Vulnérabilités récentes

Vulnérabilités de la pile Python · Page n° 4

Vulnérabilités publiées pour Python au cours des 30 derniers jours : 322. Présentes dans le catalogue KEV : 0.

RSS ↗
Filtrer les vulnérabilités
Python

Vulnérabilités : 7029

  1. CVE-2026-114137

    Élevée · CVSS 7.4EPSS 0,35%Code d’exploitation publicCorrectif disponible

    Django REST framework: TokenProxy.delete() reports success and revokes nothing

    Django REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18.2, TokenProxy.delete() in rest_framework/authtoken/models.py uses the proxy's user-id pk while the concrete Token token-string primary key identifies rows, so Django issues a deletion query that matches no row and reports zero deletions without raising an error. Applications, administrative integrations, or operational scripts that revoke credentials through a TokenProxy instance can therefore believe revocation succeeded while the token remains live and continues authenticating. DRF's own TokenAdmin.delete_model workaround is not affected, but other callers can

    django-rest-framework djangorestframework djangorestframework djangorestframework djangorestframework djangorestframework djangorestframework djangorestframework djangorestframework djangorestframework djangorestframework djangorestframeworkSystèmes d’exploitation Python
    • Mettez à jour vers 3.18.2
    • Mettez à jour vers 3.18.3+ds1-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  2. CVE-2026-114136

    Élevée · CVSS 7.5EPSS 0,34%Code d’exploitation publicCorrectif disponible

    Django REST framework: JSONParser applies an attacker-named codec to the request stream

    Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in rest_framework/parsers.py uses the client-supplied Content-Type charset value with codecs.getreader, which accepts byte-transform codecs such as bz2_codec rather than only text encodings. A remote unauthenticated client can therefore cause a compressed JSON request body to be expanded after Django has enforced DATA_UPLOAD_MAX_MEMORY_SIZE against only the wire bytes, allowing a very small request to consume substantial per-worker memory. The default parser set is sufficient, and any reachable endpoint that accepts a JSON body is affected. Thi

    django-rest-framework djangorestframework djangorestframework djangorestframework djangorestframework djangorestframework djangorestframework djangorestframework djangorestframework djangorestframework djangorestframework djangorestframeworkSystèmes d’exploitation Python
    • Mettez à jour vers 3.18.2
    • Mettez à jour vers 3.18.3+ds1-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  3. CVE-2026-114135

    Élevée · CVSS 8.8EPSS 0,39%Correctif disponible

    Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization

    Jupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling GatewayClient.url replaced the normal KernelWebsocketHandler with WebSocketChannelsHandler, which authenticated the user but did not call authorizer.is_authorized(...) for the execute action on the kernels resource. A restricted authenticated user could therefore open an upstream kernel channel and obtain kernel execution despite the configured Authorizer denying that action, exposing data and credentials available to the kernel and permitting modification or disruption of the kernel environment. The default gateway configuration is fixed in version 2

    jupyter_server jupyter-server jupyter-server jupyter-server jupyter-server jupyter-server jupyter-server jupyter-server jupyter-serverSystèmes d’exploitation Python
    • Mettez à jour vers 2.6.0
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  4. CVE-2026-113795

    Moyenne · CVSS 6EPSS 0,47%Correctif disponible

    pypdf: Possible large memory usage for streams with multiple filters

    pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, accessing a crafted PDF stream with a large number of filters or multiple filters that pass around large amounts of data can cause large memory consumption. This issue is fixed in version 6.20.0.

    pypdf pypdf pypdf pypdf pypdf2 pypdf pypdf2 pypdf2 pypdf2 pypdf2 pypdf pypdf2Systèmes d’exploitation Python
    • Mettez à jour vers 6.20.0
    • Mettez à jour vers 6.21.0-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  5. CVE-2026-113794

    Moyenne · CVSS 6EPSS 0,47%Correctif disponible

    pypdf: Possible infinite loop when hitting EOF in standard xref table

    pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, an attacker can craft an incomplete PDF that ends inside a standard cross-reference table, causing pypdf to mishandle the unexpected end of file and enter an infinite loop. This issue is fixed in version 6.20.0.

    pypdf pypdf pypdf pypdf pypdf2 pypdf pypdf2 pypdf2 pypdf2 pypdf2 pypdf pypdf2Systèmes d’exploitation Python
    • Mettez à jour vers 6.20.0
    • Mettez à jour vers 6.21.0-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  6. CVE-2026-113793

    Moyenne · CVSS 6EPSS 0,47%Correctif disponible

    pypdf: Possible infinite loop when removing tree items

    pypdf is a free and open-source pure-python PDF library. Prior to 6.20.1, removing an object from a crafted cyclic PDF tree, such as an outline item, can enter an infinite loop and block the current process. This issue is fixed in version 6.20.1.

    pypdf pypdf pypdf pypdf pypdf2 pypdf pypdf2 pypdf2 pypdf2 pypdf2 pypdf pypdf2Systèmes d’exploitation Python
    • Mettez à jour vers 6.20.1
    • Mettez à jour vers 6.21.0-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  7. CVE-2026-113792

    Moyenne · CVSS 6EPSS 0,47%Correctif disponible

    pypdf: Possible infinite loop in PdfWriter.find_outline_item

    pypdf is a free and open-source pure-python PDF library. Prior to 6.20.1, calling PdfWriter.find_outline_item on a crafted PDF with a cyclic outline hierarchy can enter an infinite loop and block the current process. This issue is fixed in version 6.20.1.

    pypdf pypdf pypdf pypdf pypdf2 pypdf pypdf2 pypdf2 pypdf2 pypdf2 pypdf pypdf2Systèmes d’exploitation Python
    • Mettez à jour vers 6.20.1
    • Mettez à jour vers 6.21.0-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  8. CVE-2026-113791

    Moyenne · CVSS 6EPSS 0,32%Correctif disponible

    pypdf: Possible large memory usage when parsing content streams

    pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing a content stream with many small operations, causing parsing to consume large amounts of memory. This issue is fixed in version 6.21.0.

    pypdf pypdf pypdf pypdf pypdf2 pypdf pypdf2 pypdf2 pypdf2 pypdf2 pypdf pypdf2Systèmes d’exploitation Python
    • Mettez à jour vers 6.21.0
    • Mettez à jour vers 6.21.0-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  9. CVE-2026-113790

    Moyenne · CVSS 6EPSS 0,32%Correctif disponible

    pypdf: Possible large memory usage when parsing arrays and dictionaries

    pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing arrays or dictionaries with many elements, causing parsing to consume large amounts of memory. This issue is fixed in version 6.21.0.

    pypdf pypdf pypdf pypdf pypdf2 pypdf pypdf2 pypdf2 pypdf2 pypdf2 pypdf pypdf2Systèmes d’exploitation Python
    • Mettez à jour vers 6.21.0
    • Mettez à jour vers 6.21.0-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  10. CVE-2026-113789

    Moyenne · CVSS 6EPSS 0,32%Correctif disponible

    pypdf: Possible long runtimes/large memory usage when retrieving form fields

    pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF that causes large memory usage or long runtimes when an application retrieves the document's form fields. This issue is fixed in version 6.21.0.

    pypdf pypdf pypdf pypdf pypdf2 pypdf pypdf2 pypdf2 pypdf2 pypdf2 pypdf pypdf2Systèmes d’exploitation Python
    • Mettez à jour vers 6.21.0
    • Mettez à jour vers 6.21.0-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  11. CVE-2026-113786

    Faible · CVSS 2.3EPSS 0,38%Correctif disponible

    pypdf: Unvalidated JPEG image data loading

    pypdf is a free and open-source pure-python PDF library. Prior to 6.21.1, an attacker can craft a PDF containing image data labeled with the /DCTDecode filter that causes Pillow to select and invoke an unintended image parser when the image is loaded. Environments without the optional Pillow dependency are not affected. This issue is fixed in version 6.21.1.

    pypdf pypdf pypdf pypdf pypdf2 pypdf pypdf2 pypdf2 pypdf2 pypdf2 pypdf pypdf2Systèmes d’exploitation Python
    • Mettez à jour vers 6.21.1
    • Mettez à jour vers 6.21.1-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  12. CVE-2026-114386

    Moyenne · CVSS 6.3EPSS 0,35%Correctif disponible

    Pydantic AI Harness before 0.59.0 CodeMode Tool Call Limit Bypass via run_code

    Pydantic AI Harness before 0.59.0 fails to enforce UsageLimits.tool_calls_limit on nested tool calls dispatched from run_code in the CodeMode toolset. Users or prompt-injected content can make the sandboxed program invoke tools via run_nested_call() without check_before_tool_call, exceeding operator limits on costly or side-effecting tools.

    pydantic-ai-harness pydantic-ai-harnessPython
    • Mettez à jour vers 0.59.0
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  13. CVE-2026-114110

    Élevée · CVSS 8.7EPSS 0,27%Correctif disponible

    Astral uv before 0.11.6 Arbitrary File Deletion via Wheel RECORD Entries

    Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to delete those files when the user uninstalls the package.

    uv uv uv uvSystèmes d’exploitation Python
    • Mettez à jour vers 0.11.6
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  14. CVE-2026-114109

    Élevée · CVSS 8.7EPSS 0,38%Correctif disponible

    uv before 0.11.15 Arbitrary File Write via Entry Point Names

    uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories, shadowing or overwriting existing binaries for code execution.

    uv uv uv uv uvSystèmes d’exploitation Python
    • Mettez à jour vers 0.11.15
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  15. CVE-2026-114108

    Critique · CVSS 9.3EPSS 0,36%Correctif disponible

    HKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCE

    HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because require_auth() returns early when API_AUTH_KEY is unset. Attackers can post messages to /sessions/{id}/messages to trigger root shell commands via BashTool, upload .py or .sh files via /upload, read session histories, and obtain partial API keys.

    vibe-trading vibe-trading-aiPython
    • Mettez à jour vers 0.1.7
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  16. CVE-2026-114107

    Élevée · CVSS 8.7EPSS 0,46%Correctif disponible

    HKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and BackgroundRunTool

    HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting instructions in documents or web pages the agent processes. BashTool and BackgroundRunTool pass model-emitted commands to subprocess.run with shell=True and no allow-list or approval step, and read_url fetches arbitrary URLs, enabling command execution and server-side request forgery.

    vibe-trading vibe-trading-aiPython
    • Mettez à jour vers 0.1.7
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  17. CVE-2026-114106

    Élevée · CVSS 8.7EPSS 0,43%Correctif disponible

    HKUDS Vibe-Trading 0.1.0 before 0.1.7 Path Traversal via read_document and safe_user_path

    HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read sensitive server files through LLM agent file-read tools. Attackers can prompt the agent to invoke read_document, which lacks sandbox checks, or safe_user_path-gated tools to leak /etc/shadow, /proc/self/environ API keys, and /root credentials.

    vibe-trading vibe-trading-aiPython
    • Mettez à jour vers 0.1.7
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  18. CVE-2026-114098

    Élevée · CVSS 7.3EPSS 0,15%Correctif disponible

    Dulwich 0.22.5 before 1.2.8 Path Traversal via Stash Pop Symlinks

    Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to write arbitrary files outside the worktree through intermediate directory symlinks. Attackers can craft a malicious repository whose popped stash writes a payload into .git/hooks/post-checkout, achieving code execution on the next checkout.

    dulwich dulwich dulwich dulwich dulwich dulwich dulwich dulwich dulwich dulwich dulwichSystèmes d’exploitation Python
    • Mettez à jour vers 1.2.8
    • Mettez à jour vers 1.2.8-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  19. CVE-2026-114097

    Élevée · CVSS 7.3EPSS 0,15%Correctif disponible

    Dulwich 0.23.1 before 1.2.8 Symlink Path Traversal via filter_branch Index Filter

    Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that allows attackers to write files outside the working directory via symlinks persisting between commits. Attackers can craft a repository where an ancestor commit's symlink redirects a descendant commit's file writes during filter_branch, enabling code execution by writing into .git/hooks.

    dulwich dulwich dulwich dulwich dulwich dulwich dulwich dulwich dulwich dulwich dulwichSystèmes d’exploitation Python
    • Mettez à jour vers 1.2.8
    • Mettez à jour vers 1.2.8-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  20. CVE-2026-114096

    Élevée · CVSS 7.3EPSS 0,15%Correctif disponible

    Dulwich 0.24.0 before 1.2.8 Symlink Write-Through via porcelain.checkout paths

    Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to write arbitrary files by abusing raw os.open without O_NOFOLLOW. Attackers can craft a repository where a worktree symlink points to .git/hooks/post-checkout, so restoring the file from a tag writes a malicious hook for code execution.

    dulwich dulwich dulwich dulwich dulwich dulwich dulwich dulwich dulwich dulwich dulwichSystèmes d’exploitation Python
    • Mettez à jour vers 1.2.8
    • Mettez à jour vers 1.2.8-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

Vérifiez votre serveur

Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.

Vérifiez votre serveur →