p PatchFirst

PatchFirst · Latest vulnerabilities

Python stack vulnerabilities · Page 15

Vulnerabilities published for Python in the last 30 days: 341. Listed in the KEV catalogue: 1.

RSS ↗ JSON ↗
Filter vulnerabilities
Python

Vulnerabilities: 7065

  1. CVE-2026-105698

    Medium · CVSS 5.4EPSS 0.22%Public exploitFix available

    Langflow: Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints

    Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.0.0 until 1.10.1, Langflow did not verify flow ownership in the deprecated POST /api/v1/build/{flow_id}/vertices and POST /api/v1/build/{flow_id}/vertices/{vertex_id} handlers. Through version 1.7.1, an unauthenticated caller who knew another user's flow UUID could reach these handlers; from version 1.7.2 through 1.10.0, callers had to authenticate but needed no elevated privileges. Such a caller could cause retrieve_vertices_order to load and cache the private graph, enumerate its vertex identifiers, and use build_vertex to execute selected vertices and rec

    langflow langflow-base langflow langflow-basePython
    • Update to 0.10.1
    • Update to 1.10.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2026-105697

    Critical · CVSS 9.9EPSS 0.79%Public exploitFix available

    Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

    Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and (before 1.10.3) wrapped in bash -c "exec {command} ...". Any user able to reach the MCP server settings ("Settings → MCP Servers → Add MCP Server", POST/PATCH /api/v2/mcp/servers/{server_name}) or to build a flow with the MCP Tools component could add a "server" whose command is an arbitrary OS command (touch, rm -rf, a reverse shell, ...). The command runs on the Langflow host as the Langflow process user as soon as Lang

    langflow langflow-base lfx langflow langflow-base lfxPython
    • Update to 0.10.3
    • Update to 1.10.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. CVE-2026-105315

    Medium · CVSS 5.1EPSS 0.25%Fix available

    django-haystack more_like_this Template Tag elasticsearch_backend.py _to_python eval injection

    A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function _to_python of the file haystack/backends/elasticsearch_backend.py of the component more_like_this Template Tag Handler. Such manipulation of the argument result_class leads to improper neutralization of directives in dynamically evaluated code. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.4.0 is able to address this issue. The name of the patch is eb05f193c9771a68dcc8cfac6674a0d48a52ee9d. It is suggested to upgrade the affected component.

    django-haystack django-haystack django-haystack django-haystack django-haystack django-haystack django-haystack django-haystack django-haystack django-haystack django-haystack django-haystackOperating systems Python
    • Update to 3.4.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  4. CVE-2026-104874

    Medium · CVSS 5.3EPSS 0.45%Fix available

    Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction

    Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand | d.items(), in multidict_itemsview_or2_impl and subtraction operation, d.items() - operand, in multidict_itemsview_sub1_impl fail to release new key-identity and value references returned for each operand element. Applications that perform these operations over attacker-influenced sequences can leak two strong references per element, and garbage collection cannot reclaim them, so repeated operations can cause unbounded process memory growth and denial of service. Forward union, intersection, no

    multidict multidict python-multidict python-multidict python-multidict python-multidict python-multidict python-multidictOperating systems Python
    • Update to 6.9.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  5. CVE-2026-104873

    High · CVSS 7.6EPSS 0.25%Fix available

    LangGraph SDK custom auth silently ignores actions= on resource decorators

    LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From 0.1.45 until 0.4.4, the langgraph-sdk resource-scoped authorization decorators @auth.on.threads, @auth.on.assistants, and @auth.on.crons ignore the actions argument and register the selected handler for every action on the resource. Because that wildcard resource handler is selected before broader fallback handlers, an authenticated user may bypass fallback action, ownership, or permission checks and read, update, or delete another user's resource. Only Python deployments using actions on the affe

    langgraph langgraph-sdkPython
    • Update to 0.4.4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  6. CVE-2026-104851

    High · CVSS 8.8EPSS 0.47%Fix available

    fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

    fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unrestricted jinja2.Template(...).render(...) calls in _process_references1._render_jinja, _process_templates, and _process_gen in fsspec/implementations/reference.py. A document supplied inline or fetched from an attacker-controlled URL can provide template expressions that execute Python code when the reference filesystem is opened, including through consumers such as xarray, before referenced data is read. The

    filesystem_spec fsspec fsspec fsspec fsspec fsspec fsspec fsspec fsspec fsspecOperating systems Python
    • Update to 2026.6.0
    • Update to 2026.9.0-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  7. CVE-2026-104843

    Medium · CVSS 5.9EPSS 0.43%Fix available

    uv: Path traversal on Windows through wheel extraction

    uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a directory already present on the user's PATH. Non-Windows hosts are not affected. This issue is fixed in version 0.12.18.

    uv uv uv uv uv-fullOperating systems Python
    • Update to 0.12.18
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  8. CVE-2026-53964

    High · CVSS 7.2EPSS 0.49%Fix available

    Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)

    Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Prior to version 9.1.0, a remote code execution (RCE) via server-side template injection (SSTI) allows for user supplied code to be executed in the server's context where it is executed as the document-merge-server user with the UID 901 thus giving an attacker considerable control over the container. The vulnerability is limited to XLSX templates, were the xltpl library uses a npn-sandboxed Jinja environment for the processing of the template. This issue has been patched in version 9.1.0.

    document-merge-service document-merge-servicePython
    • Update to 9.1.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  9. CVE-2026-77387

    Medium · CVSS 4EPSS 0.2%Fix available

    geopy: Regular Expression Denial of Service (ReDoS) in geopy.Point

    geopy is a geocoding library for Python. Prior to 2.5.0, geopy.Point and Point.from_string() can spend excessive CPU time due to inefficient regular-expression behavior when an application passes a long malformed coordinate string without the 256-character input limit used by the fix. Geocoder reverse methods also reach the vulnerable parsing path when called with string inputs. Repeated attacker-controlled requests can cause a denial of service, while the numeric Point constructor is unaffected. This issue is fixed in version 2.5.0.

    geopy geopy geopy geopy geopy geopy geopy geopy geopy geopy geopy geopyOperating systems Python
    • Update to 2.5.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  10. CVE-2026-103263

    High · CVSS 8.2EPSS 0.52%Fix available

    Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink

    Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user.

    tornado python-tornado python-tornado python-tornado tornado python-tornado python-tornado python-tornado python-tornado python-tornadoOperating systems Python
    • Update to 4.2.1-1ubuntu3.1+esm4
    • Update to 4.5.3-1ubuntu0.2+esm4
    • Update to 6.1.0-3ubuntu0.1~esm6
    • Update to 6.4.0-1ubuntu0.6
    • Update to 6.5.4-0.1ubuntu0.2
    • Update to 6.5.9
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  11. CVE-2026-103262

    High · CVSS 8.7EPSS 0.63%Fix available

    Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient

    Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits, causing the application process to be killed by out-of-memory conditions.

    tornado python-tornado python-tornado python-tornado tornado python-tornado python-tornado python-tornado python-tornado python-tornadoOperating systems Python
    • Update to 4.2.1-1ubuntu3.1+esm4
    • Update to 4.5.3-1ubuntu0.2+esm4
    • Update to 6.4.0-1ubuntu0.6
    • Update to 6.5.4-0.1ubuntu0.2
    • Update to 6.5.9
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  12. CVE-2026-103261

    Medium · CVSS 6.9EPSS 0.47%Fix available

    Tornado before 6.5.9 Denial of Service via Query String

    Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.__init__, allowing remote attackers to cause event-loop stalling by sending requests with thousands of query parameters. Attackers can send unauthenticated GET requests with unbounded query-string field counts to degrade response times for all clients sharing the same IOLoop.

    tornado python-tornado python-tornado python-tornado tornado python-tornado python-tornado python-tornado python-tornado python-tornado python-tornado python-tornadoOperating systems Python
    • Update to 6.5.9
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  13. CVE-2026-51886

    Critical · CVSS 9.8EPSS 0.6%Public exploitFix available

    CVE-2026-51886

    langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (remote). The component is: src/backend/base/langflow/api/v1/validate.py:validate-post_validate_code-a-real-authenticated-http-post-to-api-v1. The attack vector is: Attack surface: HTTP or browser-backed service path. A public-facing route accepts raw Python source and forwards it into a server-side compile/exec validation path without any visible entitlement guard. ¶¶ A weakness has been identified in langflow-ai langflow up to 1.9.3. langflow contains a code injection vulnerability in validate-post_validate_code-a-real-authenticated-http-post-t

    n/a langflowPython
    • Update to 1.10.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  14. CVE-2026-103001

    Medium · CVSS 6.5EPSS 0.26%Public exploitFix available

    PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse

    PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT._merge_options() method can modify a caller-supplied mutable options mapping when verify_signature is false. If an application reuses that same mapping for a later decode() or decode_complete() call and changes verify_signature to true, the mapping can retain false values for expiration, not-before, issued-at, audience, issuer, subject, and JWT ID checks. A signed token with invalid registered claims can then be accepted without disabling signature verification, but applications that create a fresh options mapping for each call are not affe

    pyjwt pyjwt pyjwt pyjwt pyjwt pyjwt pyjwt pyjwt pyjwt pyjwtOperating systems Python
    • Update to 2.14.0-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  15. CVE-2026-103000

    High · CVSS 8.7EPSS 0.35%Fix available

    pypdf: Possible large memory usage when retrieving alphabetical page labels

    pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF can provide unusually large alphabetical page-label values that cause pypdf/_page_labels.py to generate strings beyond a reasonable page-label length when an application retrieves document page labels, consuming excessive memory and potentially making the application unavailable. This issue is fixed in version 6.19.0.

    pypdf pypdf pypdf pypdf pypdf pypdf2 pypdf2 pypdf2 pypdf2 pypdf pypdf2 pypdfOperating systems Python
    • Update to 6.19.0
    • Update to 6.19.0-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  16. CVE-2026-102999

    High · CVSS 8.7EPSS 0.35%Fix available

    pypdf: Possible long runtimes with large amount of embedded files

    pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files can cause the dictionary-based attachments API in pypdf/_doc_common.py to reparse the full attachment list for each content lookup, producing repeated work and long runtimes when an application accesses the embedded-file mapping. This issue is fixed in version 6.19.0.

    pypdf pypdf pypdf pypdf pypdf2 pypdf2 pypdf2 pypdf2 pypdf pypdf2 pypdf pypdfOperating systems Python
    • Update to 6.19.0
    • Update to 6.19.0-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  17. CVE-2026-102998

    High · CVSS 8.7EPSS 0.34%Fix available

    pypdf: Possible long runtimes when generating appearance streams

    pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF with form field values can cause pypdf/generic/_appearance_stream.py appearance-stream generation to repeat invariant selection-data work inside a loop when an application updates fields with flattening enabled, resulting in excessive runtimes and application unavailability. This issue is fixed in version 6.19.0.

    pypdf pypdf pypdf pypdf pypdf2 pypdf2 pypdf2 pypdf2 pypdf pypdf2 pypdf pypdfOperating systems Python
    • Update to 6.19.0
    • Update to 6.19.0-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  18. CVE-2026-102997

    High · CVSS 8.7EPSS 0.34%Fix available

    pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up)

    pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF containing a partially malformed /FlateDecode stream with padded data can force pypdf/filters.py to use inefficient byte-by-byte decompression while the earlier recovery counter fails to advance for bytes that successfully decode, causing long runtimes and application unavailability. This is a residual issue after the malformed FlateDecode recovery fix. This issue is fixed in version 6.18.1.

    pypdf pypdf pypdf pypdf pypdf2 pypdf pypdf2 pypdf2 pypdf2 pypdf2 pypdf pypdf2Operating systems Python
    • Update to 6.18.1
    • Update to 6.19.0-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  19. CVE-2026-102996

    High · CVSS 8.7EPSS 0.34%Fix available

    pypdf: Possible large memory usage when parsing font data

    pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can provide a TrueType or Type1 simple font with an unusually large /Widths array, causing pypdf/_font.py Font._collect_tt_t1_character_widths to process entries beyond the 256 character codes meaningful for a simple font and consume excessive memory during operations such as text extraction. This issue is fixed in version 6.18.1.

    pypdf pypdf pypdf pypdf pypdf2 pypdf2 pypdf2 pypdf2 pypdf pypdf2 pypdf pypdfOperating systems Python
    • Update to 6.18.1
    • Update to 6.19.0-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  20. CVE-2026-102995

    High · CVSS 8.7EPSS 0.34%Fix available

    pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)

    pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can place unusually large source-code or destination-string tokens in a font /ToUnicode mapping, causing pypdf/_cmap.py parse_bfchar to decode and retain oversized values during operations such as text extraction and consume excessive memory. This is a second follow-up to earlier /ToUnicode resource-consumption fixes and is limited to the remaining token-length path. This issue is fixed in version 6.18.1.

    pypdf pypdf pypdf pypdf pypdf2 pypdf pypdf2 pypdf2 pypdf2 pypdf2 pypdf pypdf2Operating systems Python
    • Update to 6.18.1
    • Update to 6.19.0-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →