Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,934 results · page 22 of 39
Feb 21, 2025vyper is a Pythonic Smart Contract Language for the EVM.CVE-2025-27104 · Other software · vyperlang · reported by GitHubLow 2.3
vyper is a Pythonic Smart Contract Language for the EVM. Multiple evaluation of a single expression is possible in the iterator target of a for loop. While the iterator expression cannot produce multiple writes, it can consume side effects produced in the loop body (e.g. read a storage variable updated in the loop body) and thus lead to unexpected program behavior. Specifically, reads in iterators which contain an ifexp (e.g. `for s: uint256 in ([read(), read()] if True else [])`) may interleave reads with writes in the loop body. Vyper for loops allow two kinds of iterator targets, namely the `range()` builtin and an iterable type, like SArray and DArray. During codegen, iterable lists are required to not produce any side-effects (in the following code, `range_scope` forces `iter_list` to be parsed in a constant context, which is checked against `is_constant`). However, this does not prevent the iterator from consuming side effects provided by the body of the loop. For SArrays on the other hand, `iter_list` is instantiated in the body of a `repeat` ir, so it can be evaluated several times. This issue is being addressed and is expected to be available in version 0.4.1. Users are ad
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2025vyper is a Pythonic Smart Contract Language for the EVM.CVE-2025-26622 · Other software · vyperlang · reported by GitHubLow 2.3
vyper is a Pythonic Smart Contract Language for the EVM. Vyper `sqrt()` builtin uses the babylonian method to calculate square roots of decimals. Unfortunately, improper handling of the oscillating final states may lead to sqrt incorrectly returning rounded up results. This issue is being addressed and a fix is expected in version 0.4.1. Users are advised to upgrade as soon as the patched release is available. There are no known workarounds for this vulnerability.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2025There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of known file locations are writable meaning other users CVE-2024-3220 · Other software · Python Software Foundation · reported by cna@python.orgLow 2.3
There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of known file locations are writable meaning other users can create invalid files to cause MemoryError to be raised on Python runtime startup or have file extensions be interpreted as the incorrect file type. This defect is caused by the default locations of Linux and macOS platforms (such as “/etc/mime.types”) also being used on Windows, where they are user-writable locations (“C:\etc\mime.types”). To work-around this issue a user can call mimetypes.init() with an empty list (“[]”) on Windows platforms to avoid using the default list of known file locations.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025With a specially crafted Python script, an attacker could send continuous startMeasurement commands over an unencrypted Bluetooth connection to the affected dCVE-2025-24836 · Other software · Qardio · reported by ics-cert@hq.dhs.govMedium 6.1
With a specially crafted Python script, an attacker could send continuous startMeasurement commands over an unencrypted Bluetooth connection to the affected device. This would prevent the device from connecting to a clinician's app to take patient readings and ostensibly flood it with requests, resulting in a denial-of-service condition.
- Product
- Heart Health IOS Mobile Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025PandasAI uses an interactive prompt function that is vulnerable to prompt injection and run arbitrary Python code that can lead to Remote Code Execution (RCE) iCVE-2024-12366 · Other software · Sinaptik AI · reported by cret@cert.orgCritical 9.8
PandasAI uses an interactive prompt function that is vulnerable to prompt injection and run arbitrary Python code that can lead to Remote Code Execution (RCE) instead of the intended explanation of the natural language processing by the LLM.
- Product
- PandasAI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.getpanda.aidocs.pandas-ai.com
Feb 11, 2025An authenticated attacker is able to use the Plugin Manager of the web interface of the Wattsense Bridge devices to upload malicious Python files to the device.CVE-2025-26411 · Other software · Wattsense · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 8.8
An authenticated attacker is able to use the Plugin Manager of the web interface of the Wattsense Bridge devices to upload malicious Python files to the device. This enables an attacker to gain remote root access to the device. An attacker needs a valid user account on the Wattsense web interface to be able to conduct this attack. This issue is fixed in recent firmware versions BSP >= 6.1.0.
- Product
- Wattsense Bridge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordr.sec-consult.comsupport.wattsense.com
Jan 31, 2025The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to CVE-2025-0938 · Other software · Python Software Foundation · reported by cna@python.orgMedium 6.3
The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-compliant URL parsers.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2025The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations.CVE-2025-24795 · Other software · snowflakedb · reported by GitHubMedium 4.4
The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. On Linux systems, when temporary credential caching is enabled, the Snowflake Connector for Python will cache temporary credentials locally in a world-readable file. This vulnerability affects versions 2.3.7 through 3.13.0. Snowflake fixed the issue in version 3.13.1.
- Product
- snowflake-connector-python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2025The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations.CVE-2025-24794 · Other software · snowflakedb · reported by GitHubMedium 6.7
The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. The OCSP response cache uses pickle as the serialization format, potentially leading to local privilege escalation. This vulnerability affects versions 2.7.12 through 3.13.0. Snowflake fixed the issue in version 3.13.1.
- Product
- snowflake-connector-python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2025The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations.CVE-2025-24793 · Other software · snowflakedb · reported by GitHubHigh 7
The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. A function from the snowflake.connector.pandas_tools module is vulnerable to SQL injection. This vulnerability affects versions 2.2.5 through 3.13.0. Snowflake fixed the issue in version 3.13.1.
- Product
- snowflake-connector-python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2025ASTEVAL is an evaluator of Python expressions and statements.CVE-2025-24359 · Other software · lmfit · reported by GitHubHigh 8.4
ASTEVAL is an evaluator of Python expressions and statements. Prior to version 1.0.6, if an attacker can control the input to the `asteval` library, they can bypass asteval's restrictions and execute arbitrary Python code in the context of the application using the library. The vulnerability is rooted in how `asteval` performs handling of `FormattedValue` AST nodes. In particular, the `on_formattedvalue` value uses the dangerous format method of the str class. The code allows an attacker to manipulate the value of the string used in the dangerous call `fmt.format(__fstring__=val)`. This vulnerability can be exploited to access protected attributes by intentionally triggering an `AttributeError` exception. The attacker can then catch the exception and use its `obj` attribute to gain arbitrary access to sensitive or protected object properties. Version 1.0.6 fixes this issue.
- Product
- asteval
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2025RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment.CVE-2025-22153 · Other software · zopefoundation · reported by GitHubHigh 7.9
RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Via a type confusion bug in versions of the CPython interpreter starting in 3.11 and prior to 3.13.2 when using `try/except*`, RestrictedPython starting in version 6.0 and prior to version 8.0 could be bypassed. The issue is patched in version 8.0 of RestrictedPython by removing support for `try/except*` clauses. No known workarounds are available.
- Product
- RestrictedPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python).CVE-2025-21548 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.4
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). Supported versions that are affected are 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Connectors accessible data as well as unauthorized read access to a subset of MySQL Connectors accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors. CVSS 3.1 Base Score 6.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:H).
- Product
- MySQL Connectors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025Gradio is an open-source Python package that allows quick building of demos and web application for machine learning models, API, or any arbitrary Python functiCVE-2025-23042 · Other software · gradio-app · reported by GitHubHigh 8.7
Gradio is an open-source Python package that allows quick building of demos and web application for machine learning models, API, or any arbitrary Python function. Gradio's Access Control List (ACL) for file paths can be bypassed by altering the letter case of a blocked file or directory path. This vulnerability arises due to the lack of case normalization in the file path validation logic. On case-insensitive file systems, such as those used by Windows and macOS, this flaw enables attackers to circumvent security restrictions and access sensitive files that should be protected. This issue can lead to unauthorized data access, exposing sensitive information and undermining the integrity of Gradio's security model. Given Gradio's popularity for building web applications, particularly in machine learning and AI, this vulnerability may pose a substantial threat if exploited in production environments. This issue has been addressed in release version 5.6.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- gradio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025Vyper is a Pythonic Smart Contract Language for the EVM.CVE-2025-21607 · Other software · vyperlang · reported by GitHubLow 2.3
Vyper is a Pythonic Smart Contract Language for the EVM. When the Vyper Compiler uses the precompiles EcRecover (0x1) and Identity (0x4), the success flag of the call is not checked. As a consequence an attacker can provide a specific amount of gas to make these calls fail but let the overall execution continue. Then the execution result can be incorrect. Based on EVM's rules, after the failed precompile the remaining code has only 1/64 of the pre-call-gas left (as 63/64 were forwarded and spent). Hence, only fairly simple executions can follow the failed precompile calls. Therefore, we found no significantly impacted real-world contracts. None the less an advisory has been made out of an abundance of caution. This issue is fixed in 0.4.1.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2025NiceGUI is an easy-to-use, Python-based UI framework.CVE-2025-21618 · Other software · zauberzeug · reported by GitHubHigh 7.5
NiceGUI is an easy-to-use, Python-based UI framework. Prior to 2.9.1, authenticating with NiceGUI logged in the user for all browsers, including browsers in incognito mode. This vulnerability is fixed in 2.9.1.
- Product
- nicegui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2024A vulnerability was found in python-sql where unary operators do not escape non-Expression.CVE-2024-9774 · Other software · reported by Red HatMedium 6.5
A vulnerability was found in python-sql where unary operators do not escape non-Expression.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Dec 24, 2024A SQL injection in the Amazon Redshift Python Connector v2.1.4 allows a user to gain escalated privileges via the get_schemas, get_tables, or get_columns MetadaCVE-2024-12745 · Other software · Amazon · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5High 8.6
A SQL injection in the Amazon Redshift Python Connector v2.1.4 allows a user to gain escalated privileges via the get_schemas, get_tables, or get_columns Metadata APIs. Users are recommended to upgrade to the driver version 2.1.5 or revert to driver version 2.1.3.
- Product
- Amazon Redshift Python Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Dec 23, 2024APTRS (Automated Penetration Testing Reporting System) is a Python and Django-based automated reporting tool designed for penetration testers and security organCVE-2024-56363 · Other software · APTRS · reported by GitHubHigh 7.8
APTRS (Automated Penetration Testing Reporting System) is a Python and Django-based automated reporting tool designed for penetration testers and security organizations. In 1.0, there is a vulnerability in the web application's handling of user-supplied input that is incorporated into a Jinja2 template. Specifically, when user input is improperly sanitized or validated, an attacker can inject Jinja2 syntax into the template, causing the server to execute arbitrary code. For example, an attacker might be able to inject expressions like {{ config }}, {{ self.class.mro[1].subclasses() }}, or more dangerous payloads that trigger execution of arbitrary Python code. The vulnerability can be reproduced by submitting crafted input to all the template fields handled by ckeditor, that are passed directly to a Jinja2 template. If the input is rendered without sufficient sanitization, it results in the execution of malicious Jinja2 code on the server.
- Product
- APTRS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2024pyrage is a set of Python bindings for the rage file encryption library (age in Rust).CVE-2024-56327 · Other software · woodruffw · reported by GitHubHigh 7.7
pyrage is a set of Python bindings for the rage file encryption library (age in Rust). `pyrage` uses the Rust `age` crate for its underlying operations, and `age` is vulnerable to GHSA-4fg7-vxc8-qx5w. All details of GHSA-4fg7-vxc8-qx5w are relevant to `pyrage` for the versions specified in this advisory. See GHSA-4fg7-vxc8-qx5w for full details. Versions of `pyrage` before 1.2.0 lack plugin support and are therefore **not affected**. An equivalent issue was fixed in [the reference Go implementation of age](https://github.com/FiloSottile/age), see advisory GHSA-32gq-x56h-299c. This issue has been addressed in version 1.2.3 and all users are advised to update. There are no known workarounds for this vulnerability.
- Product
- pyrage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024python-libarchive through 4.2.1 allows directory traversal (to create files) in extract in zip.py for ZipFile.extractall and ZipFile.extract.CVE-2024-55587 · Other software · reported by MITREHigh 8.8
python-libarchive through 4.2.1 allows directory traversal (to create files) in extract in zip.py for ZipFile.extractall and ZipFile.extract.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024sigstore-python is a Python tool for generating and verifying Sigstore signatures.CVE-2024-55655 · Other software · sigstore · reported by GitHubLow 2.7
sigstore-python is a Python tool for generating and verifying Sigstore signatures. Versions of sigstore-python newer than 2.0.0 but prior to 3.6.0 perform insufficient validation of the "integration time" present in "v2" and "v3" bundles during the verification flow: the "integration time" is verified *if* a source of signed time (such as an inclusion promise) is present, but is otherwise trusted if no source of signed time is present. This does not affect "v1" bundles, as the "v1" bundle format always requires an inclusion promise. Sigstore uses signed time to support verification of signatures made against short-lived signing keys. The impact and severity of this weakness is *low*, as Sigstore contains multiple other enforcing components that prevent an attacker who modifies the integration timestamp within a bundle from impersonating a valid signature. In particular, an attacker who modifies the integration timestamp can induce a Denial of Service, but in no different manner than already possible with bundle access (e.g. modifying the signature itself such that it fails to verify). Separately, an attacker could upload a *new* entry to the transparency service, and substitute th
- Product
- sigstore-python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2024Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer tCVE-2024-12254 · Other software · Python Software Foundation · reported by cna@python.orgHigh 8.7
Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer potentially leading to memory exhaustion. This vulnerability likely impacts a small number of users, you must be using Python 3.12.0 or later, on macOS or Linux, using the asyncio module with protocols, and using .writelines() method which had new zero-copy-on-write behavior in Python 3.12.0 and later. If not all of these factors are true then your usage of Python is unaffected.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2024python-multipart is a streaming multipart parser for Python.CVE-2024-53981 · Other software · Kludex · reported by GitHubHigh 7.5
python-multipart is a streaming multipart parser for Python. When parsing form data, python-multipart skips line breaks (CR \r or LF \n) in front of the first boundary and any tailing bytes after the last boundary. This happens one byte at a time and emits a log event each time, which may cause excessive logging for certain inputs. An attacker could abuse this by sending a malicious request with lots of data before the first or after the last boundary, causing high CPU load and stalling the processing thread for a significant amount of time. In case of ASGI application, this could stall the event loop and prevent other requests from being processed, resulting in a denial of service (DoS). This vulnerability is fixed in 0.0.18.
- Product
- python-multipart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2024zhmcclient is a pure Python client library for the IBM Z HMC Web Services API.CVE-2024-53865 · Other software · zhmcclient · reported by GitHubHigh 8.2
zhmcclient is a pure Python client library for the IBM Z HMC Web Services API. In affected versions the Python package "zhmcclient" writes password-like properties in clear text into its HMC and API logs in the following cases: 1. The 'boot-ftp-password' and 'ssc-master-pw' properties when creating or updating a partition in DPM mode, in the zhmcclient API and HMC logs. 2. The 'ssc-master-pw' and 'zaware-master-pw' properties when updating an LPAR in classic mode, in the zhmcclient API and HMC logs. 3. The 'ssc-master-pw' and 'zaware-master-pw' properties when creating or updating an image activation profile in classic mode, in the zhmcclient API and HMC logs. 4. The 'password' property when creating or updating an HMC user, in the zhmcclient API log. 5. The 'bind-password' property when creating or updating an LDAP server definition, in the zhmcclient API and HMC logs. This issue affects only users of the zhmcclient package that have enabled the Python loggers named "zhmcclient.api" (for the API log) or "zhmcclient.hmc" (for the HMC log) and that use the functions listed above. This issue has been fixed in zhmcclient version 1.18.1. Users are advised to upgrade. There are no known
- Product
- python-zhmcclient
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2024pyjwt is a JSON Web Token implementation in Python.CVE-2024-53861 · Other software · jpadilla · reported by GitHubLow 2.2
pyjwt is a JSON Web Token implementation in Python. An incorrect string comparison is run for `iss` checking, resulting in `"acb"` being accepted for `"_abc_"`. This is a bug introduced in version 2.10.0: checking the "iss" claim changed from `isinstance(issuer, list)` to `isinstance(issuer, Sequence)`. Since str is a Sequnce, but not a list, `in` is also used for string comparison. This results in `if "abc" not in "__abcd__":` being checked instead of `if "abc" != "__abc__":`. Signature checks are still present so real world impact is likely limited to denial of service scenarios. This issue has been patched in version 2.10.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- pyjwt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2024check-jsonschema is a CLI and set of pre-commit hooks for jsonschema validation.CVE-2024-53848 · Other software · python-jsonschema · reported by GitHubHigh 7.1
check-jsonschema is a CLI and set of pre-commit hooks for jsonschema validation. The default cache strategy uses the basename of a remote schema as the name of the file in the cache, e.g. `https://example.org/schema.json` will be stored as `schema.json`. This naming allows for conflicts. If an attacker can get a user to run `check-jsonschema` against a malicious schema URL, e.g., `https://example.evil.org/schema.json`, they can insert their own schema into the cache and it will be picked up and used instead of the appropriate schema. Such a cache confusion attack could be used to allow data to pass validation which should have been rejected. This issue has been patched in version 0.30.0. All users are advised to upgrade. A few workarounds exist: 1. Users can use `--no-cache` to disable caching. 2. Users can use `--cache-filename` to select filenames for use in the cache, or to ensure that other usages do not overwrite the cached schema. (Note: this flag is being deprecated as part of the remediation effort.) 3. Users can explicitly download the schema before use as a local file, as in `curl -LOs https://example.org/schema.json; check-jsonschema --schemafile ./schema.json`
- Product
- check-jsonschema
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Tornado is a Python web framework and asynchronous networking library.CVE-2024-52804 · Other software · tornadoweb · reported by GitHubHigh 7.5
Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests. Version 6.4.2 fixes the issue.
- Product
- tornado
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`.CVE-2024-52595 · Other software · fedora-python · reported by GitHubHigh 7.7
lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.0, the HTML Parser in lxml does not properly handle context-switching for special HTML tags such as `<svg>`, `<math>` and `<noscript>`. This behavior deviates from how web browsers parse and interpret such tags. Specifically, content in CSS comments is ignored by lxml_html_clean but may be interpreted differently by web browsers, enabling malicious scripts to bypass the cleaning process. This vulnerability could lead to Cross-Site Scripting (XSS) attacks, compromising the security of users relying on lxml_html_clean in default configuration for sanitizing untrusted HTML content. Users employing the HTML cleaner in a security-sensitive context should upgrade to lxml 0.4.0, which addresses this issue. As a temporary mitigation, users can configure lxml_html_clean with the following settings to prevent the exploitation of this vulnerability. Via `remove_tags`, one may specify tags to remove - their content is moved to their parents' tags. Via `kill_tags`, one may specify tags to be removed completely. Via `allow_tags`, one may restrict the set of permissible tags, excludi
- Product
- lxml_html_clean
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2024Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the PythonCVE-2024-48990 · Other software · needrestart · reported by security@ubuntu.comHigh 7.8
Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.
- Product
- needrestart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2024aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.CVE-2024-52304 · Other software · aio-libs · reported by GitHubMedium 6.3
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or `AIOHTTP_NO_EXTENSIONS` is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.10.11 fixes the issue.
- Product
- aiohttp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2024aiohttp is an asynchronous HTTP client/server framework for asyncio and Python.CVE-2024-52303 · Other software · aio-libs · reported by GitHubHigh 8.7
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions starting with 3.10.6 and prior to 3.10.11, a memory leak can occur when a request produces a MatchInfoError. This was caused by adding an entry to a cache on each request, due to the building of each MatchInfoError producing a unique cache entry. An attacker may be able to exhaust the memory resources of a server by sending a substantial number (100,000s to millions) of such requests. Those who use any middlewares with aiohttp.web should upgrade to version 3.10.11 to receive a patch.
- Product
- aiohttp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024python_book V1.0 is vulnerable to Incorrect Access Control, which allows attackers to obtain sensitive information of users with different IDs by modifying the CVE-2024-50650 · Other software · python_book · reported by MITREHigh 7.5
python_book V1.0 is vulnerable to Incorrect Access Control, which allows attackers to obtain sensitive information of users with different IDs by modifying the ID parameter.
- Product
- python_book
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024The user avatar upload function in python_book V1.0 has an arbitrary file upload vulnerability.CVE-2024-50649 · Other software · python_book · reported by MITRECritical 9.8
The user avatar upload function in python_book V1.0 has an arbitrary file upload vulnerability.
- Product
- python_book
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024The python_food ordering system V1.0 has an unauthorized vulnerability that leads to the leakage of sensitive user information.CVE-2024-50647 · Other software · python_food_ordering_system · reported by MITREHigh 7.5
The python_food ordering system V1.0 has an unauthorized vulnerability that leads to the leakage of sensitive user information. Attackers can access it through https://ip:port/api/myapp/index/user/info?id=1 And modify the ID value to obtain sensitive user information beyond authorization.
- Product
- python_food_ordering_system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2024A Python command injection vulnerability exists in the `SagemakerLLM` class's `complete()` method within `./private_gpt/components/llm/custom/sagemaker.py` of tCVE-2024-4343 · Other software · imartinez · reported by security@huntr.devCritical 9.8
A Python command injection vulnerability exists in the `SagemakerLLM` class's `complete()` method within `./private_gpt/components/llm/custom/sagemaker.py` of the imartinez/privategpt application, versions up to and including 0.3.0. The vulnerability arises due to the use of the `eval()` function to parse a string received from a remote AWS SageMaker LLM endpoint into a dictionary. This method of parsing is unsafe as it can execute arbitrary Python code contained within the response. An attacker can exploit this vulnerability by manipulating the response from the AWS SageMaker LLM endpoint to include malicious Python code, leading to potential execution of arbitrary commands on the system hosting the application. The issue is fixed in version 0.6.0.
- Product
- imartinez/privategpt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2024Incorrect default permissions in some Intel(R) Distribution for Python software before version 2024.2 may allow an authenticated user to potentially enable escaCVE-2024-29083 · Other software · intel · reported by secure@intel.comMedium 5.4
Incorrect default permissions in some Intel(R) Distribution for Python software before version 2024.2 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- distribution_for_python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture.CVE-2024-11168 · Other software · Python Software Foundation · reported by cna@python.orgMedium 6.3
The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024Visual Studio Code Python Extension Remote Code Execution VulnerabilityCVE-2024-49050 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Visual Studio Code Python Extension Remote Code Execution Vulnerability
- Product
- Python extension for Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024libosdp is an implementation of IEC 60839-11-5 OSDP (Open Supervised Device Protocol) and provides a C library with support for C++, Rust and Python3.CVE-2024-52296 · Other software · goToMain · reported by GitHubMedium 6.5
libosdp is an implementation of IEC 60839-11-5 OSDP (Open Supervised Device Protocol) and provides a C library with support for C++, Rust and Python3. At ospd_common.c, on the osdp_reply_name function, any reply id between REPLY_ACK and REPLY_XRD is valid, but names array do not declare all of the range. On a case of an undefined reply id within the range, name will be null (name = names[reply_id - REPLY_ACK];). Null name will casue a crash on next line: if (name[0] == '\0') as null[0] is invalid. As this logic is not limited to a secure connection, attacker may trigger this vulnerability without any prior knowledge. This issue is fixed in 2.4.0.
- Product
- libosdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2024PyMOL 2.5.0 contains a vulnerability in its "Run Script" function, which allows the execution of arbitrary Python code embedded within .PYM files.CVE-2024-50636 · Other software · schrodinger · reported by MITRECritical 9.8
PyMOL 2.5.0 contains a vulnerability in its "Run Script" function, which allows the execution of arbitrary Python code embedded within .PYM files. Attackers can craft a malicious .PYM file containing a Python reverse shell payload and exploit the function to achieve Remote Command Execution (RCE). This vulnerability arises because PyMOL treats .PYM files as Python scripts without properly validating or restricting the commands within the script, enabling attackers to run unauthorized commands in the context of the user running the application.
- Product
- pymol
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2024libosdp is an implementation of IEC 60839-11-5 OSDP (Open Supervised Device Protocol) and provides a C library with support for C++, Rust and Python3.CVE-2024-52288 · Other software · goToMain · reported by GitHubMedium 5.1
libosdp is an implementation of IEC 60839-11-5 OSDP (Open Supervised Device Protocol) and provides a C library with support for C++, Rust and Python3. In affected versions an unexpected `REPLY_CCRYPT` or `REPLY_RMAC_I` may be introduced into an active stream when they should not be. Once RMAC_I message can be sent during a session, attacker with MITM access to the communication may intercept the original RMAC_I reply and save it. While the session continues, the attacker will record all of the replies and save them, till capturing the message to be replied (can be detected by ID, length or time based on inspection of visual activity next to the reader) Once attacker captures a session with the message to be replayed, he stops resetting the connection and waits for signal to perform the replay to of the PD to CP message (ex: by signaling remotely to the MIMT device or setting a specific timing). In order to replay, the attacker will craft a specific RMAC_I message in the proper seq of the execution, which will result in reverting the RMAC to the beginning of the session. At that phase - attacker can replay all the messages from the beginning of the session. This issue has been addre
- Product
- libosdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2024MediaCMS is an open source video and media CMS, written in Python/Django and React, featuring a REST API.CVE-2024-52004 · Other software · mediacms-io · reported by GitHubHigh 8.7
MediaCMS is an open source video and media CMS, written in Python/Django and React, featuring a REST API. MediaCMS has been prone to vulnerabilities that upon special cases can lead to remote code execution. All versions before v4.1.0 are susceptible, and users are highly recommended to upgrade. The vulnerabilities are related with insufficient input validation while uploading media content. The condition to exploit the vulnerability is that the portal allows users to upload content. This issue has been patched in version 4.1.0. There are no known workarounds for this vulnerability.
- Product
- mediacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2024Gradio is an open-source Python package designed to enable quick builds of a demo or web application.CVE-2024-51751 · Other software · gradio-app · reported by GitHubMedium 6.5
Gradio is an open-source Python package designed to enable quick builds of a demo or web application. If File or UploadButton components are used as a part of Gradio application to preview file content, an attacker with access to the application might abuse these components to read arbitrary files from the application server. This issue has been addressed in release version 5.5.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- gradio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2024langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.CVE-2024-42835 · Other software · Langflow · reported by MITRECritical 9.8
langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.
- Product
- Langflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2024Waitress is a Web Server Gateway Interface server for Python 2 and 3.CVE-2024-49769 · Other software · Pylons · reported by GitHubHigh 7.5
Waitress is a Web Server Gateway Interface server for Python 2 and 3. When a remote client closes the connection before waitress has had the opportunity to call getpeername() waitress won't correctly clean up the connection leading to the main thread attempting to write to a socket that no longer exists, but not removing it from the list of sockets to attempt to process. This leads to a busy-loop calling the write function. A remote attacker could run waitress out of available sockets with very little resources required. Waitress 3.0.1 contains fixes that remove the race condition.
- Product
- waitress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2024Waitress is a Web Server Gateway Interface server for Python 2 and 3.CVE-2024-49768 · Other software · Pylons · reported by GitHubCritical 9.1
Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recv_bytes (defaults to 8192) long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled (default) we won't read any more requests, and when the first request fails due to a parsing error, we simply close the connection. However when request lookahead is enabled, it is possible to process and receive the first request, start sending the error message back to the client while we read the next request and queue it. This will allow the secondary request to be serviced by the worker thread while the connection should be closed. Waitress 3.0.1 fixes the race condition. As a workaround, disable channel_request_lookahead, this is set to 0 by default disabling this feature.
- Product
- waitress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2024An issue in pyload-ng v0.5.0b3.dev85 running under python3.11 or below allows attackers to execute arbitrary code via a crafted HTTP request.CVE-2024-39205 · Other software · pyload-ng_project · reported by MITRECritical 9.8
An issue in pyload-ng v0.5.0b3.dev85 running under python3.11 or below allows attackers to execute arbitrary code via a crafted HTTP request.
- Product
- pyload-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2024The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations.CVE-2024-49750 · Other software · snowflakedb · reported by GitHubMedium 5.5
The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Prior to version 3.12.3, when the logging level was set by the user to DEBUG, the Connector could have logged Duo passcodes (when specified via the `passcode` parameter) and Azure SAS tokens. Additionally, the SecretDetector logging formatter, if enabled, contained bugs which caused it to not fully redact JWT tokens and certain private key formats. Snowflake released version 3.12.3 of the Snowflake Connector for Python, which fixes the issue. In addition to upgrading, users should review their logs for any potentially sensitive information that may have been captured.
- Product
- snowflake-connector-python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2024A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, alloCVE-2024-9287 · Other software · Python Software Foundation · reported by cna@python.orgMedium 5.3
A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie "./venv/bin/python") are not affected.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.