bokeh
Interactive Data Visualization in the browser, from Python
View on Github
Activity
- Latest release
- 6d ago
- Total releases
- 277
- Cadence
- ~5 days
- Last 12 months
- 33
Reach
- Stars
- 20.5k
Details
- License
- BSD-3-Clause
- First release
- Oct 25, 2013
| Version | Released | |
|---|---|---|
3.10.1rc1
pre
| ||
3.10.1.dev0
pre
| ||
4.0.0.dev4
pre
| ||
4.0.0.dev3
pre
| ||
4.0.0.dev2
pre
| ||
3.10.0
minor
| ||
3.10.0rc2
pre
| ||
3.10.0rc1
pre
| ||
3.10.0.dev10
pre
| ||
3.10.0.dev9
pre
| ||
4.0.0.dev1
pre
| ||
3.10.0.dev8
pre
| ||
3.9.2
patch
| ||
3.10.0.dev7
pre
| ||
3.10.0.dev6
pre
| ||
3.9.1
patch
| ||
3.10.0.dev5
pre
| ||
3.10.0.dev4
pre
| ||
3.10.0.dev3
pre
| ||
3.10.0.dev2
pre
| ||
3.9.0
minor
| ||
3.9.0rc1
pre
| ||
3.9.0.dev11
pre
| ||
3.10.0.dev1
pre
| ||
3.9.0.dev10
pre
| ||
3.9.0.dev9
pre
| ||
3.9.0.dev8
pre
| ||
3.8.2
patch
| ||
3.9.0.dev7
pre
| ||
3.9.0.dev4
pre
| ||
3.8.1
patch
1 CVE
CVE-2026-21883
PYSEC-2026-1223
GHSA-793v-589g-574v
Jul 07, 2026
Bokeh server applications have Incomplete Origin Validation in WebSockets
Critical
Network
Low
None
This vulnerability allows for Cross-Site WebSocket Hijacking (CSWSH) of a deployed Bokeh server instance. ScopeThis vulnerability is only relevant to deployed Bokeh server instances. There is no impact on static HTML output, standalone embedded plots, or Jupyter notebook usage. This vulnerability does not prevent any requirements for up-front authentication on Bokeh servers that have authentication hooks in place, and cannot be used to make Bokeh servers deployed on private, internal networks accessible outside those networks. ImpactIf a Bokeh server is configured with an allowlist (e.g., Once connected, the attacker can interact with the Bokeh server on behalf of the victim, potentially accessing sensitive data, or modifying visualizations. PatchesPatched in versions 3.8.2 and later. WorkaroundsNone Technical descriptionThe Because the code only checks if the pattern is longer than the host (lines 232-233), but fails to check if the host is longer than the pattern, a host that starts with the pattern (but has additional segments) will successfully match. For example, if the allowlist is configured to
Affected versions
0.10.0
0.11.0
0.11.1
0.12.0
0.12.1
0.12.10
0.12.11
0.12.13
0.12.14
0.12.15
0.12.16
0.12.2
+ 232 more Show less
0.12.3
0.12.4
0.12.5
0.12.6
0.12.7
0.12.9
0.13.0
0.2
0.3
0.4
0.4.1
0.4.4
0.5.0
0.5.1
0.5.2
0.6.0
0.6.1
0.7.0
0.7.1
0.8.0
0.8.1
0.8.2
0.9.0
0.9.1
0.9.2
0.9.3
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.4
1.4.0
2.0.0
2.0.0rc1
2.0.0rc2
2.0.1
2.0.2
2.1.0
2.1.0rc1
2.1.0rc2
2.1.0rc3
2.1.1
2.2.0
2.2.0.dev4
2.2.0.dev6
2.2.0.dev7
2.2.0.dev8
2.2.0rc1
2.2.0rc2
2.2.0rc3
2.2.1
2.2.2
2.2.3
2.3.0
2.3.0.dev1
2.3.0.dev10
2.3.0.dev11
2.3.0.dev12
2.3.0.dev13
2.3.0.dev14
2.3.0.dev2
2.3.0.dev3
2.3.0.dev5
2.3.0.dev7
2.3.0.dev8
2.3.0.dev9
2.3.0rc2
2.3.0rc3
2.3.0rc4
2.3.1
2.3.1.dev1
2.3.1rc1
2.3.1rc2
2.3.2
2.3.2rc1
2.3.3
2.3.3rc1
2.4.0
2.4.0.dev1
2.4.0.dev2
2.4.0.dev4
2.4.0.dev5
2.4.0.dev6
2.4.0.dev7
2.4.0.dev8
2.4.0rc1
2.4.0rc2
2.4.0rc3
2.4.1
2.4.1rc1
2.4.2
2.4.2.dev1
2.4.2rc1
2.4.3
2.4.3.dev1
2.4.3.dev3
2.4.3.dev4
2.4.3rc1
3.0.0
3.0.0.dev1
3.0.0.dev10
3.0.0.dev11
3.0.0.dev13
3.0.0.dev14
3.0.0.dev15
3.0.0.dev16
3.0.0.dev17
3.0.0.dev18
3.0.0.dev19
3.0.0.dev2
3.0.0.dev20
3.0.0.dev3
3.0.0.dev4
3.0.0.dev5
3.0.0.dev6
3.0.0.dev7
3.0.0.dev8
3.0.0.dev9
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.0rc5
3.0.0rc6
3.0.1
3.0.1rc1
3.0.2
3.0.2rc1
3.0.3
3.0.3rc1
3.1.0
3.1.0.dev1
3.1.0.dev2
3.1.0.dev3
3.1.0.dev4
3.1.0.dev5
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.1
3.1.1rc1
3.2.0
3.2.0.dev1
3.2.0.dev2
3.2.0.dev3
3.2.0.dev4
3.2.0rc1
3.2.0rc2
3.2.0rc3
3.2.1
3.2.2
3.2.2rc1
3.3.0
3.3.0.dev1
3.3.0.dev2
3.3.0.dev3
3.3.0rc1
3.3.0rc2
3.3.0rc3
3.3.1
3.3.1.dev1
3.3.1rc1
3.3.2
3.3.3
3.3.4
3.3.4rc1
3.4.0
3.4.0.dev1
3.4.0.dev2
3.4.0.dev3
3.4.0.dev4
3.4.0.dev5
3.4.0.dev6
3.4.0.dev7
3.4.0.dev8
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.4.3
3.5.0
3.5.0.dev1
3.5.0.dev3
3.5.0.dev4
3.5.0.dev5
3.5.0.dev6
3.5.0.dev7
3.5.0.dev8
3.5.0rc1
3.5.0rc2
3.5.1
3.5.2
3.6.0
3.6.0.dev1
3.6.0rc1
3.6.0rc2
3.6.1
3.6.2
3.6.3
3.6.3rc1
3.6.3rc2
3.7.0
3.7.0.dev1
3.7.0.dev2
3.7.0.dev3
3.7.0.dev4
3.7.0.dev5
3.7.0.dev6
3.7.0.dev7
3.7.0.dev8
3.7.0.dev9
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.7.3
3.7.3rc1
3.7.3rc2
3.8.0
3.8.0.dev1
3.8.0.dev2
3.8.0.dev3
3.8.0.dev4
3.8.0rc1
3.8.0rc2
3.8.1
Fixed in
3.8.2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
3.9.0.dev3
pre
| ||
3.9.0.dev2
pre
| ||
3.9.0.dev1
pre
| ||
3.8.0
minor
1 CVE
CVE-2026-21883
PYSEC-2026-1223
GHSA-793v-589g-574v
Jul 07, 2026
Bokeh server applications have Incomplete Origin Validation in WebSockets
Critical
Network
Low
None
This vulnerability allows for Cross-Site WebSocket Hijacking (CSWSH) of a deployed Bokeh server instance. ScopeThis vulnerability is only relevant to deployed Bokeh server instances. There is no impact on static HTML output, standalone embedded plots, or Jupyter notebook usage. This vulnerability does not prevent any requirements for up-front authentication on Bokeh servers that have authentication hooks in place, and cannot be used to make Bokeh servers deployed on private, internal networks accessible outside those networks. ImpactIf a Bokeh server is configured with an allowlist (e.g., Once connected, the attacker can interact with the Bokeh server on behalf of the victim, potentially accessing sensitive data, or modifying visualizations. PatchesPatched in versions 3.8.2 and later. WorkaroundsNone Technical descriptionThe Because the code only checks if the pattern is longer than the host (lines 232-233), but fails to check if the host is longer than the pattern, a host that starts with the pattern (but has additional segments) will successfully match. For example, if the allowlist is configured to
Affected versions
0.10.0
0.11.0
0.11.1
0.12.0
0.12.1
0.12.10
0.12.11
0.12.13
0.12.14
0.12.15
0.12.16
0.12.2
+ 232 more Show less
0.12.3
0.12.4
0.12.5
0.12.6
0.12.7
0.12.9
0.13.0
0.2
0.3
0.4
0.4.1
0.4.4
0.5.0
0.5.1
0.5.2
0.6.0
0.6.1
0.7.0
0.7.1
0.8.0
0.8.1
0.8.2
0.9.0
0.9.1
0.9.2
0.9.3
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.4
1.4.0
2.0.0
2.0.0rc1
2.0.0rc2
2.0.1
2.0.2
2.1.0
2.1.0rc1
2.1.0rc2
2.1.0rc3
2.1.1
2.2.0
2.2.0.dev4
2.2.0.dev6
2.2.0.dev7
2.2.0.dev8
2.2.0rc1
2.2.0rc2
2.2.0rc3
2.2.1
2.2.2
2.2.3
2.3.0
2.3.0.dev1
2.3.0.dev10
2.3.0.dev11
2.3.0.dev12
2.3.0.dev13
2.3.0.dev14
2.3.0.dev2
2.3.0.dev3
2.3.0.dev5
2.3.0.dev7
2.3.0.dev8
2.3.0.dev9
2.3.0rc2
2.3.0rc3
2.3.0rc4
2.3.1
2.3.1.dev1
2.3.1rc1
2.3.1rc2
2.3.2
2.3.2rc1
2.3.3
2.3.3rc1
2.4.0
2.4.0.dev1
2.4.0.dev2
2.4.0.dev4
2.4.0.dev5
2.4.0.dev6
2.4.0.dev7
2.4.0.dev8
2.4.0rc1
2.4.0rc2
2.4.0rc3
2.4.1
2.4.1rc1
2.4.2
2.4.2.dev1
2.4.2rc1
2.4.3
2.4.3.dev1
2.4.3.dev3
2.4.3.dev4
2.4.3rc1
3.0.0
3.0.0.dev1
3.0.0.dev10
3.0.0.dev11
3.0.0.dev13
3.0.0.dev14
3.0.0.dev15
3.0.0.dev16
3.0.0.dev17
3.0.0.dev18
3.0.0.dev19
3.0.0.dev2
3.0.0.dev20
3.0.0.dev3
3.0.0.dev4
3.0.0.dev5
3.0.0.dev6
3.0.0.dev7
3.0.0.dev8
3.0.0.dev9
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.0rc5
3.0.0rc6
3.0.1
3.0.1rc1
3.0.2
3.0.2rc1
3.0.3
3.0.3rc1
3.1.0
3.1.0.dev1
3.1.0.dev2
3.1.0.dev3
3.1.0.dev4
3.1.0.dev5
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.1
3.1.1rc1
3.2.0
3.2.0.dev1
3.2.0.dev2
3.2.0.dev3
3.2.0.dev4
3.2.0rc1
3.2.0rc2
3.2.0rc3
3.2.1
3.2.2
3.2.2rc1
3.3.0
3.3.0.dev1
3.3.0.dev2
3.3.0.dev3
3.3.0rc1
3.3.0rc2
3.3.0rc3
3.3.1
3.3.1.dev1
3.3.1rc1
3.3.2
3.3.3
3.3.4
3.3.4rc1
3.4.0
3.4.0.dev1
3.4.0.dev2
3.4.0.dev3
3.4.0.dev4
3.4.0.dev5
3.4.0.dev6
3.4.0.dev7
3.4.0.dev8
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.4.3
3.5.0
3.5.0.dev1
3.5.0.dev3
3.5.0.dev4
3.5.0.dev5
3.5.0.dev6
3.5.0.dev7
3.5.0.dev8
3.5.0rc1
3.5.0rc2
3.5.1
3.5.2
3.6.0
3.6.0.dev1
3.6.0rc1
3.6.0rc2
3.6.1
3.6.2
3.6.3
3.6.3rc1
3.6.3rc2
3.7.0
3.7.0.dev1
3.7.0.dev2
3.7.0.dev3
3.7.0.dev4
3.7.0.dev5
3.7.0.dev6
3.7.0.dev7
3.7.0.dev8
3.7.0.dev9
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.7.3
3.7.3rc1
3.7.3rc2
3.8.0
3.8.0.dev1
3.8.0.dev2
3.8.0.dev3
3.8.0.dev4
3.8.0rc1
3.8.0rc2
3.8.1
Fixed in
3.8.2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
3.8.0rc2
pre
1 CVE
CVE-2026-21883
PYSEC-2026-1223
GHSA-793v-589g-574v
Jul 07, 2026
Bokeh server applications have Incomplete Origin Validation in WebSockets
Critical
Network
Low
None
This vulnerability allows for Cross-Site WebSocket Hijacking (CSWSH) of a deployed Bokeh server instance. ScopeThis vulnerability is only relevant to deployed Bokeh server instances. There is no impact on static HTML output, standalone embedded plots, or Jupyter notebook usage. This vulnerability does not prevent any requirements for up-front authentication on Bokeh servers that have authentication hooks in place, and cannot be used to make Bokeh servers deployed on private, internal networks accessible outside those networks. ImpactIf a Bokeh server is configured with an allowlist (e.g., Once connected, the attacker can interact with the Bokeh server on behalf of the victim, potentially accessing sensitive data, or modifying visualizations. PatchesPatched in versions 3.8.2 and later. WorkaroundsNone Technical descriptionThe Because the code only checks if the pattern is longer than the host (lines 232-233), but fails to check if the host is longer than the pattern, a host that starts with the pattern (but has additional segments) will successfully match. For example, if the allowlist is configured to
Affected versions
0.10.0
0.11.0
0.11.1
0.12.0
0.12.1
0.12.10
0.12.11
0.12.13
0.12.14
0.12.15
0.12.16
0.12.2
+ 232 more Show less
0.12.3
0.12.4
0.12.5
0.12.6
0.12.7
0.12.9
0.13.0
0.2
0.3
0.4
0.4.1
0.4.4
0.5.0
0.5.1
0.5.2
0.6.0
0.6.1
0.7.0
0.7.1
0.8.0
0.8.1
0.8.2
0.9.0
0.9.1
0.9.2
0.9.3
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.4
1.4.0
2.0.0
2.0.0rc1
2.0.0rc2
2.0.1
2.0.2
2.1.0
2.1.0rc1
2.1.0rc2
2.1.0rc3
2.1.1
2.2.0
2.2.0.dev4
2.2.0.dev6
2.2.0.dev7
2.2.0.dev8
2.2.0rc1
2.2.0rc2
2.2.0rc3
2.2.1
2.2.2
2.2.3
2.3.0
2.3.0.dev1
2.3.0.dev10
2.3.0.dev11
2.3.0.dev12
2.3.0.dev13
2.3.0.dev14
2.3.0.dev2
2.3.0.dev3
2.3.0.dev5
2.3.0.dev7
2.3.0.dev8
2.3.0.dev9
2.3.0rc2
2.3.0rc3
2.3.0rc4
2.3.1
2.3.1.dev1
2.3.1rc1
2.3.1rc2
2.3.2
2.3.2rc1
2.3.3
2.3.3rc1
2.4.0
2.4.0.dev1
2.4.0.dev2
2.4.0.dev4
2.4.0.dev5
2.4.0.dev6
2.4.0.dev7
2.4.0.dev8
2.4.0rc1
2.4.0rc2
2.4.0rc3
2.4.1
2.4.1rc1
2.4.2
2.4.2.dev1
2.4.2rc1
2.4.3
2.4.3.dev1
2.4.3.dev3
2.4.3.dev4
2.4.3rc1
3.0.0
3.0.0.dev1
3.0.0.dev10
3.0.0.dev11
3.0.0.dev13
3.0.0.dev14
3.0.0.dev15
3.0.0.dev16
3.0.0.dev17
3.0.0.dev18
3.0.0.dev19
3.0.0.dev2
3.0.0.dev20
3.0.0.dev3
3.0.0.dev4
3.0.0.dev5
3.0.0.dev6
3.0.0.dev7
3.0.0.dev8
3.0.0.dev9
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.0rc5
3.0.0rc6
3.0.1
3.0.1rc1
3.0.2
3.0.2rc1
3.0.3
3.0.3rc1
3.1.0
3.1.0.dev1
3.1.0.dev2
3.1.0.dev3
3.1.0.dev4
3.1.0.dev5
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.1
3.1.1rc1
3.2.0
3.2.0.dev1
3.2.0.dev2
3.2.0.dev3
3.2.0.dev4
3.2.0rc1
3.2.0rc2
3.2.0rc3
3.2.1
3.2.2
3.2.2rc1
3.3.0
3.3.0.dev1
3.3.0.dev2
3.3.0.dev3
3.3.0rc1
3.3.0rc2
3.3.0rc3
3.3.1
3.3.1.dev1
3.3.1rc1
3.3.2
3.3.3
3.3.4
3.3.4rc1
3.4.0
3.4.0.dev1
3.4.0.dev2
3.4.0.dev3
3.4.0.dev4
3.4.0.dev5
3.4.0.dev6
3.4.0.dev7
3.4.0.dev8
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.4.3
3.5.0
3.5.0.dev1
3.5.0.dev3
3.5.0.dev4
3.5.0.dev5
3.5.0.dev6
3.5.0.dev7
3.5.0.dev8
3.5.0rc1
3.5.0rc2
3.5.1
3.5.2
3.6.0
3.6.0.dev1
3.6.0rc1
3.6.0rc2
3.6.1
3.6.2
3.6.3
3.6.3rc1
3.6.3rc2
3.7.0
3.7.0.dev1
3.7.0.dev2
3.7.0.dev3
3.7.0.dev4
3.7.0.dev5
3.7.0.dev6
3.7.0.dev7
3.7.0.dev8
3.7.0.dev9
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.7.3
3.7.3rc1
3.7.3rc2
3.8.0
3.8.0.dev1
3.8.0.dev2
3.8.0.dev3
3.8.0.dev4
3.8.0rc1
3.8.0rc2
3.8.1
Fixed in
3.8.2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
3.8.0rc1
pre
1 CVE
CVE-2026-21883
PYSEC-2026-1223
GHSA-793v-589g-574v
Jul 07, 2026
Bokeh server applications have Incomplete Origin Validation in WebSockets
Critical
Network
Low
None
This vulnerability allows for Cross-Site WebSocket Hijacking (CSWSH) of a deployed Bokeh server instance. ScopeThis vulnerability is only relevant to deployed Bokeh server instances. There is no impact on static HTML output, standalone embedded plots, or Jupyter notebook usage. This vulnerability does not prevent any requirements for up-front authentication on Bokeh servers that have authentication hooks in place, and cannot be used to make Bokeh servers deployed on private, internal networks accessible outside those networks. ImpactIf a Bokeh server is configured with an allowlist (e.g., Once connected, the attacker can interact with the Bokeh server on behalf of the victim, potentially accessing sensitive data, or modifying visualizations. PatchesPatched in versions 3.8.2 and later. WorkaroundsNone Technical descriptionThe Because the code only checks if the pattern is longer than the host (lines 232-233), but fails to check if the host is longer than the pattern, a host that starts with the pattern (but has additional segments) will successfully match. For example, if the allowlist is configured to
Affected versions
0.10.0
0.11.0
0.11.1
0.12.0
0.12.1
0.12.10
0.12.11
0.12.13
0.12.14
0.12.15
0.12.16
0.12.2
+ 232 more Show less
0.12.3
0.12.4
0.12.5
0.12.6
0.12.7
0.12.9
0.13.0
0.2
0.3
0.4
0.4.1
0.4.4
0.5.0
0.5.1
0.5.2
0.6.0
0.6.1
0.7.0
0.7.1
0.8.0
0.8.1
0.8.2
0.9.0
0.9.1
0.9.2
0.9.3
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.4
1.4.0
2.0.0
2.0.0rc1
2.0.0rc2
2.0.1
2.0.2
2.1.0
2.1.0rc1
2.1.0rc2
2.1.0rc3
2.1.1
2.2.0
2.2.0.dev4
2.2.0.dev6
2.2.0.dev7
2.2.0.dev8
2.2.0rc1
2.2.0rc2
2.2.0rc3
2.2.1
2.2.2
2.2.3
2.3.0
2.3.0.dev1
2.3.0.dev10
2.3.0.dev11
2.3.0.dev12
2.3.0.dev13
2.3.0.dev14
2.3.0.dev2
2.3.0.dev3
2.3.0.dev5
2.3.0.dev7
2.3.0.dev8
2.3.0.dev9
2.3.0rc2
2.3.0rc3
2.3.0rc4
2.3.1
2.3.1.dev1
2.3.1rc1
2.3.1rc2
2.3.2
2.3.2rc1
2.3.3
2.3.3rc1
2.4.0
2.4.0.dev1
2.4.0.dev2
2.4.0.dev4
2.4.0.dev5
2.4.0.dev6
2.4.0.dev7
2.4.0.dev8
2.4.0rc1
2.4.0rc2
2.4.0rc3
2.4.1
2.4.1rc1
2.4.2
2.4.2.dev1
2.4.2rc1
2.4.3
2.4.3.dev1
2.4.3.dev3
2.4.3.dev4
2.4.3rc1
3.0.0
3.0.0.dev1
3.0.0.dev10
3.0.0.dev11
3.0.0.dev13
3.0.0.dev14
3.0.0.dev15
3.0.0.dev16
3.0.0.dev17
3.0.0.dev18
3.0.0.dev19
3.0.0.dev2
3.0.0.dev20
3.0.0.dev3
3.0.0.dev4
3.0.0.dev5
3.0.0.dev6
3.0.0.dev7
3.0.0.dev8
3.0.0.dev9
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.0rc5
3.0.0rc6
3.0.1
3.0.1rc1
3.0.2
3.0.2rc1
3.0.3
3.0.3rc1
3.1.0
3.1.0.dev1
3.1.0.dev2
3.1.0.dev3
3.1.0.dev4
3.1.0.dev5
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.1
3.1.1rc1
3.2.0
3.2.0.dev1
3.2.0.dev2
3.2.0.dev3
3.2.0.dev4
3.2.0rc1
3.2.0rc2
3.2.0rc3
3.2.1
3.2.2
3.2.2rc1
3.3.0
3.3.0.dev1
3.3.0.dev2
3.3.0.dev3
3.3.0rc1
3.3.0rc2
3.3.0rc3
3.3.1
3.3.1.dev1
3.3.1rc1
3.3.2
3.3.3
3.3.4
3.3.4rc1
3.4.0
3.4.0.dev1
3.4.0.dev2
3.4.0.dev3
3.4.0.dev4
3.4.0.dev5
3.4.0.dev6
3.4.0.dev7
3.4.0.dev8
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.4.3
3.5.0
3.5.0.dev1
3.5.0.dev3
3.5.0.dev4
3.5.0.dev5
3.5.0.dev6
3.5.0.dev7
3.5.0.dev8
3.5.0rc1
3.5.0rc2
3.5.1
3.5.2
3.6.0
3.6.0.dev1
3.6.0rc1
3.6.0rc2
3.6.1
3.6.2
3.6.3
3.6.3rc1
3.6.3rc2
3.7.0
3.7.0.dev1
3.7.0.dev2
3.7.0.dev3
3.7.0.dev4
3.7.0.dev5
3.7.0.dev6
3.7.0.dev7
3.7.0.dev8
3.7.0.dev9
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.7.3
3.7.3rc1
3.7.3rc2
3.8.0
3.8.0.dev1
3.8.0.dev2
3.8.0.dev3
3.8.0.dev4
3.8.0rc1
3.8.0rc2
3.8.1
Fixed in
3.8.2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
3.8.0.dev4
pre
1 CVE
CVE-2026-21883
PYSEC-2026-1223
GHSA-793v-589g-574v
Jul 07, 2026
Bokeh server applications have Incomplete Origin Validation in WebSockets
Critical
Network
Low
None
This vulnerability allows for Cross-Site WebSocket Hijacking (CSWSH) of a deployed Bokeh server instance. ScopeThis vulnerability is only relevant to deployed Bokeh server instances. There is no impact on static HTML output, standalone embedded plots, or Jupyter notebook usage. This vulnerability does not prevent any requirements for up-front authentication on Bokeh servers that have authentication hooks in place, and cannot be used to make Bokeh servers deployed on private, internal networks accessible outside those networks. ImpactIf a Bokeh server is configured with an allowlist (e.g., Once connected, the attacker can interact with the Bokeh server on behalf of the victim, potentially accessing sensitive data, or modifying visualizations. PatchesPatched in versions 3.8.2 and later. WorkaroundsNone Technical descriptionThe Because the code only checks if the pattern is longer than the host (lines 232-233), but fails to check if the host is longer than the pattern, a host that starts with the pattern (but has additional segments) will successfully match. For example, if the allowlist is configured to
Affected versions
0.10.0
0.11.0
0.11.1
0.12.0
0.12.1
0.12.10
0.12.11
0.12.13
0.12.14
0.12.15
0.12.16
0.12.2
+ 232 more Show less
0.12.3
0.12.4
0.12.5
0.12.6
0.12.7
0.12.9
0.13.0
0.2
0.3
0.4
0.4.1
0.4.4
0.5.0
0.5.1
0.5.2
0.6.0
0.6.1
0.7.0
0.7.1
0.8.0
0.8.1
0.8.2
0.9.0
0.9.1
0.9.2
0.9.3
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.4
1.4.0
2.0.0
2.0.0rc1
2.0.0rc2
2.0.1
2.0.2
2.1.0
2.1.0rc1
2.1.0rc2
2.1.0rc3
2.1.1
2.2.0
2.2.0.dev4
2.2.0.dev6
2.2.0.dev7
2.2.0.dev8
2.2.0rc1
2.2.0rc2
2.2.0rc3
2.2.1
2.2.2
2.2.3
2.3.0
2.3.0.dev1
2.3.0.dev10
2.3.0.dev11
2.3.0.dev12
2.3.0.dev13
2.3.0.dev14
2.3.0.dev2
2.3.0.dev3
2.3.0.dev5
2.3.0.dev7
2.3.0.dev8
2.3.0.dev9
2.3.0rc2
2.3.0rc3
2.3.0rc4
2.3.1
2.3.1.dev1
2.3.1rc1
2.3.1rc2
2.3.2
2.3.2rc1
2.3.3
2.3.3rc1
2.4.0
2.4.0.dev1
2.4.0.dev2
2.4.0.dev4
2.4.0.dev5
2.4.0.dev6
2.4.0.dev7
2.4.0.dev8
2.4.0rc1
2.4.0rc2
2.4.0rc3
2.4.1
2.4.1rc1
2.4.2
2.4.2.dev1
2.4.2rc1
2.4.3
2.4.3.dev1
2.4.3.dev3
2.4.3.dev4
2.4.3rc1
3.0.0
3.0.0.dev1
3.0.0.dev10
3.0.0.dev11
3.0.0.dev13
3.0.0.dev14
3.0.0.dev15
3.0.0.dev16
3.0.0.dev17
3.0.0.dev18
3.0.0.dev19
3.0.0.dev2
3.0.0.dev20
3.0.0.dev3
3.0.0.dev4
3.0.0.dev5
3.0.0.dev6
3.0.0.dev7
3.0.0.dev8
3.0.0.dev9
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.0rc5
3.0.0rc6
3.0.1
3.0.1rc1
3.0.2
3.0.2rc1
3.0.3
3.0.3rc1
3.1.0
3.1.0.dev1
3.1.0.dev2
3.1.0.dev3
3.1.0.dev4
3.1.0.dev5
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.1
3.1.1rc1
3.2.0
3.2.0.dev1
3.2.0.dev2
3.2.0.dev3
3.2.0.dev4
3.2.0rc1
3.2.0rc2
3.2.0rc3
3.2.1
3.2.2
3.2.2rc1
3.3.0
3.3.0.dev1
3.3.0.dev2
3.3.0.dev3
3.3.0rc1
3.3.0rc2
3.3.0rc3
3.3.1
3.3.1.dev1
3.3.1rc1
3.3.2
3.3.3
3.3.4
3.3.4rc1
3.4.0
3.4.0.dev1
3.4.0.dev2
3.4.0.dev3
3.4.0.dev4
3.4.0.dev5
3.4.0.dev6
3.4.0.dev7
3.4.0.dev8
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.4.3
3.5.0
3.5.0.dev1
3.5.0.dev3
3.5.0.dev4
3.5.0.dev5
3.5.0.dev6
3.5.0.dev7
3.5.0.dev8
3.5.0rc1
3.5.0rc2
3.5.1
3.5.2
3.6.0
3.6.0.dev1
3.6.0rc1
3.6.0rc2
3.6.1
3.6.2
3.6.3
3.6.3rc1
3.6.3rc2
3.7.0
3.7.0.dev1
3.7.0.dev2
3.7.0.dev3
3.7.0.dev4
3.7.0.dev5
3.7.0.dev6
3.7.0.dev7
3.7.0.dev8
3.7.0.dev9
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.7.3
3.7.3rc1
3.7.3rc2
3.8.0
3.8.0.dev1
3.8.0.dev2
3.8.0.dev3
3.8.0.dev4
3.8.0rc1
3.8.0rc2
3.8.1
Fixed in
3.8.2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
3.8.0.dev3
pre
1 CVE
CVE-2026-21883
PYSEC-2026-1223
GHSA-793v-589g-574v
Jul 07, 2026
Bokeh server applications have Incomplete Origin Validation in WebSockets
Critical
Network
Low
None
This vulnerability allows for Cross-Site WebSocket Hijacking (CSWSH) of a deployed Bokeh server instance. ScopeThis vulnerability is only relevant to deployed Bokeh server instances. There is no impact on static HTML output, standalone embedded plots, or Jupyter notebook usage. This vulnerability does not prevent any requirements for up-front authentication on Bokeh servers that have authentication hooks in place, and cannot be used to make Bokeh servers deployed on private, internal networks accessible outside those networks. ImpactIf a Bokeh server is configured with an allowlist (e.g., Once connected, the attacker can interact with the Bokeh server on behalf of the victim, potentially accessing sensitive data, or modifying visualizations. PatchesPatched in versions 3.8.2 and later. WorkaroundsNone Technical descriptionThe Because the code only checks if the pattern is longer than the host (lines 232-233), but fails to check if the host is longer than the pattern, a host that starts with the pattern (but has additional segments) will successfully match. For example, if the allowlist is configured to
Affected versions
0.10.0
0.11.0
0.11.1
0.12.0
0.12.1
0.12.10
0.12.11
0.12.13
0.12.14
0.12.15
0.12.16
0.12.2
+ 232 more Show less
0.12.3
0.12.4
0.12.5
0.12.6
0.12.7
0.12.9
0.13.0
0.2
0.3
0.4
0.4.1
0.4.4
0.5.0
0.5.1
0.5.2
0.6.0
0.6.1
0.7.0
0.7.1
0.8.0
0.8.1
0.8.2
0.9.0
0.9.1
0.9.2
0.9.3
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.4
1.4.0
2.0.0
2.0.0rc1
2.0.0rc2
2.0.1
2.0.2
2.1.0
2.1.0rc1
2.1.0rc2
2.1.0rc3
2.1.1
2.2.0
2.2.0.dev4
2.2.0.dev6
2.2.0.dev7
2.2.0.dev8
2.2.0rc1
2.2.0rc2
2.2.0rc3
2.2.1
2.2.2
2.2.3
2.3.0
2.3.0.dev1
2.3.0.dev10
2.3.0.dev11
2.3.0.dev12
2.3.0.dev13
2.3.0.dev14
2.3.0.dev2
2.3.0.dev3
2.3.0.dev5
2.3.0.dev7
2.3.0.dev8
2.3.0.dev9
2.3.0rc2
2.3.0rc3
2.3.0rc4
2.3.1
2.3.1.dev1
2.3.1rc1
2.3.1rc2
2.3.2
2.3.2rc1
2.3.3
2.3.3rc1
2.4.0
2.4.0.dev1
2.4.0.dev2
2.4.0.dev4
2.4.0.dev5
2.4.0.dev6
2.4.0.dev7
2.4.0.dev8
2.4.0rc1
2.4.0rc2
2.4.0rc3
2.4.1
2.4.1rc1
2.4.2
2.4.2.dev1
2.4.2rc1
2.4.3
2.4.3.dev1
2.4.3.dev3
2.4.3.dev4
2.4.3rc1
3.0.0
3.0.0.dev1
3.0.0.dev10
3.0.0.dev11
3.0.0.dev13
3.0.0.dev14
3.0.0.dev15
3.0.0.dev16
3.0.0.dev17
3.0.0.dev18
3.0.0.dev19
3.0.0.dev2
3.0.0.dev20
3.0.0.dev3
3.0.0.dev4
3.0.0.dev5
3.0.0.dev6
3.0.0.dev7
3.0.0.dev8
3.0.0.dev9
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.0rc5
3.0.0rc6
3.0.1
3.0.1rc1
3.0.2
3.0.2rc1
3.0.3
3.0.3rc1
3.1.0
3.1.0.dev1
3.1.0.dev2
3.1.0.dev3
3.1.0.dev4
3.1.0.dev5
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.1
3.1.1rc1
3.2.0
3.2.0.dev1
3.2.0.dev2
3.2.0.dev3
3.2.0.dev4
3.2.0rc1
3.2.0rc2
3.2.0rc3
3.2.1
3.2.2
3.2.2rc1
3.3.0
3.3.0.dev1
3.3.0.dev2
3.3.0.dev3
3.3.0rc1
3.3.0rc2
3.3.0rc3
3.3.1
3.3.1.dev1
3.3.1rc1
3.3.2
3.3.3
3.3.4
3.3.4rc1
3.4.0
3.4.0.dev1
3.4.0.dev2
3.4.0.dev3
3.4.0.dev4
3.4.0.dev5
3.4.0.dev6
3.4.0.dev7
3.4.0.dev8
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.4.3
3.5.0
3.5.0.dev1
3.5.0.dev3
3.5.0.dev4
3.5.0.dev5
3.5.0.dev6
3.5.0.dev7
3.5.0.dev8
3.5.0rc1
3.5.0rc2
3.5.1
3.5.2
3.6.0
3.6.0.dev1
3.6.0rc1
3.6.0rc2
3.6.1
3.6.2
3.6.3
3.6.3rc1
3.6.3rc2
3.7.0
3.7.0.dev1
3.7.0.dev2
3.7.0.dev3
3.7.0.dev4
3.7.0.dev5
3.7.0.dev6
3.7.0.dev7
3.7.0.dev8
3.7.0.dev9
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.7.3
3.7.3rc1
3.7.3rc2
3.8.0
3.8.0.dev1
3.8.0.dev2
3.8.0.dev3
3.8.0.dev4
3.8.0rc1
3.8.0rc2
3.8.1
Fixed in
3.8.2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
3.8.0.dev2
pre
1 CVE
CVE-2026-21883
PYSEC-2026-1223
GHSA-793v-589g-574v
Jul 07, 2026
Bokeh server applications have Incomplete Origin Validation in WebSockets
Critical
Network
Low
None
This vulnerability allows for Cross-Site WebSocket Hijacking (CSWSH) of a deployed Bokeh server instance. ScopeThis vulnerability is only relevant to deployed Bokeh server instances. There is no impact on static HTML output, standalone embedded plots, or Jupyter notebook usage. This vulnerability does not prevent any requirements for up-front authentication on Bokeh servers that have authentication hooks in place, and cannot be used to make Bokeh servers deployed on private, internal networks accessible outside those networks. ImpactIf a Bokeh server is configured with an allowlist (e.g., Once connected, the attacker can interact with the Bokeh server on behalf of the victim, potentially accessing sensitive data, or modifying visualizations. PatchesPatched in versions 3.8.2 and later. WorkaroundsNone Technical descriptionThe Because the code only checks if the pattern is longer than the host (lines 232-233), but fails to check if the host is longer than the pattern, a host that starts with the pattern (but has additional segments) will successfully match. For example, if the allowlist is configured to
Affected versions
0.10.0
0.11.0
0.11.1
0.12.0
0.12.1
0.12.10
0.12.11
0.12.13
0.12.14
0.12.15
0.12.16
0.12.2
+ 232 more Show less
0.12.3
0.12.4
0.12.5
0.12.6
0.12.7
0.12.9
0.13.0
0.2
0.3
0.4
0.4.1
0.4.4
0.5.0
0.5.1
0.5.2
0.6.0
0.6.1
0.7.0
0.7.1
0.8.0
0.8.1
0.8.2
0.9.0
0.9.1
0.9.2
0.9.3
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.4
1.4.0
2.0.0
2.0.0rc1
2.0.0rc2
2.0.1
2.0.2
2.1.0
2.1.0rc1
2.1.0rc2
2.1.0rc3
2.1.1
2.2.0
2.2.0.dev4
2.2.0.dev6
2.2.0.dev7
2.2.0.dev8
2.2.0rc1
2.2.0rc2
2.2.0rc3
2.2.1
2.2.2
2.2.3
2.3.0
2.3.0.dev1
2.3.0.dev10
2.3.0.dev11
2.3.0.dev12
2.3.0.dev13
2.3.0.dev14
2.3.0.dev2
2.3.0.dev3
2.3.0.dev5
2.3.0.dev7
2.3.0.dev8
2.3.0.dev9
2.3.0rc2
2.3.0rc3
2.3.0rc4
2.3.1
2.3.1.dev1
2.3.1rc1
2.3.1rc2
2.3.2
2.3.2rc1
2.3.3
2.3.3rc1
2.4.0
2.4.0.dev1
2.4.0.dev2
2.4.0.dev4
2.4.0.dev5
2.4.0.dev6
2.4.0.dev7
2.4.0.dev8
2.4.0rc1
2.4.0rc2
2.4.0rc3
2.4.1
2.4.1rc1
2.4.2
2.4.2.dev1
2.4.2rc1
2.4.3
2.4.3.dev1
2.4.3.dev3
2.4.3.dev4
2.4.3rc1
3.0.0
3.0.0.dev1
3.0.0.dev10
3.0.0.dev11
3.0.0.dev13
3.0.0.dev14
3.0.0.dev15
3.0.0.dev16
3.0.0.dev17
3.0.0.dev18
3.0.0.dev19
3.0.0.dev2
3.0.0.dev20
3.0.0.dev3
3.0.0.dev4
3.0.0.dev5
3.0.0.dev6
3.0.0.dev7
3.0.0.dev8
3.0.0.dev9
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.0rc5
3.0.0rc6
3.0.1
3.0.1rc1
3.0.2
3.0.2rc1
3.0.3
3.0.3rc1
3.1.0
3.1.0.dev1
3.1.0.dev2
3.1.0.dev3
3.1.0.dev4
3.1.0.dev5
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.1
3.1.1rc1
3.2.0
3.2.0.dev1
3.2.0.dev2
3.2.0.dev3
3.2.0.dev4
3.2.0rc1
3.2.0rc2
3.2.0rc3
3.2.1
3.2.2
3.2.2rc1
3.3.0
3.3.0.dev1
3.3.0.dev2
3.3.0.dev3
3.3.0rc1
3.3.0rc2
3.3.0rc3
3.3.1
3.3.1.dev1
3.3.1rc1
3.3.2
3.3.3
3.3.4
3.3.4rc1
3.4.0
3.4.0.dev1
3.4.0.dev2
3.4.0.dev3
3.4.0.dev4
3.4.0.dev5
3.4.0.dev6
3.4.0.dev7
3.4.0.dev8
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.4.3
3.5.0
3.5.0.dev1
3.5.0.dev3
3.5.0.dev4
3.5.0.dev5
3.5.0.dev6
3.5.0.dev7
3.5.0.dev8
3.5.0rc1
3.5.0rc2
3.5.1
3.5.2
3.6.0
3.6.0.dev1
3.6.0rc1
3.6.0rc2
3.6.1
3.6.2
3.6.3
3.6.3rc1
3.6.3rc2
3.7.0
3.7.0.dev1
3.7.0.dev2
3.7.0.dev3
3.7.0.dev4
3.7.0.dev5
3.7.0.dev6
3.7.0.dev7
3.7.0.dev8
3.7.0.dev9
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.7.3
3.7.3rc1
3.7.3rc2
3.8.0
3.8.0.dev1
3.8.0.dev2
3.8.0.dev3
3.8.0.dev4
3.8.0rc1
3.8.0rc2
3.8.1
Fixed in
3.8.2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
3.7.3
patch
1 CVE
CVE-2026-21883
PYSEC-2026-1223
GHSA-793v-589g-574v
Jul 07, 2026
Bokeh server applications have Incomplete Origin Validation in WebSockets
Critical
Network
Low
None
This vulnerability allows for Cross-Site WebSocket Hijacking (CSWSH) of a deployed Bokeh server instance. ScopeThis vulnerability is only relevant to deployed Bokeh server instances. There is no impact on static HTML output, standalone embedded plots, or Jupyter notebook usage. This vulnerability does not prevent any requirements for up-front authentication on Bokeh servers that have authentication hooks in place, and cannot be used to make Bokeh servers deployed on private, internal networks accessible outside those networks. ImpactIf a Bokeh server is configured with an allowlist (e.g., Once connected, the attacker can interact with the Bokeh server on behalf of the victim, potentially accessing sensitive data, or modifying visualizations. PatchesPatched in versions 3.8.2 and later. WorkaroundsNone Technical descriptionThe Because the code only checks if the pattern is longer than the host (lines 232-233), but fails to check if the host is longer than the pattern, a host that starts with the pattern (but has additional segments) will successfully match. For example, if the allowlist is configured to
Affected versions
0.10.0
0.11.0
0.11.1
0.12.0
0.12.1
0.12.10
0.12.11
0.12.13
0.12.14
0.12.15
0.12.16
0.12.2
+ 232 more Show less
0.12.3
0.12.4
0.12.5
0.12.6
0.12.7
0.12.9
0.13.0
0.2
0.3
0.4
0.4.1
0.4.4
0.5.0
0.5.1
0.5.2
0.6.0
0.6.1
0.7.0
0.7.1
0.8.0
0.8.1
0.8.2
0.9.0
0.9.1
0.9.2
0.9.3
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.4
1.4.0
2.0.0
2.0.0rc1
2.0.0rc2
2.0.1
2.0.2
2.1.0
2.1.0rc1
2.1.0rc2
2.1.0rc3
2.1.1
2.2.0
2.2.0.dev4
2.2.0.dev6
2.2.0.dev7
2.2.0.dev8
2.2.0rc1
2.2.0rc2
2.2.0rc3
2.2.1
2.2.2
2.2.3
2.3.0
2.3.0.dev1
2.3.0.dev10
2.3.0.dev11
2.3.0.dev12
2.3.0.dev13
2.3.0.dev14
2.3.0.dev2
2.3.0.dev3
2.3.0.dev5
2.3.0.dev7
2.3.0.dev8
2.3.0.dev9
2.3.0rc2
2.3.0rc3
2.3.0rc4
2.3.1
2.3.1.dev1
2.3.1rc1
2.3.1rc2
2.3.2
2.3.2rc1
2.3.3
2.3.3rc1
2.4.0
2.4.0.dev1
2.4.0.dev2
2.4.0.dev4
2.4.0.dev5
2.4.0.dev6
2.4.0.dev7
2.4.0.dev8
2.4.0rc1
2.4.0rc2
2.4.0rc3
2.4.1
2.4.1rc1
2.4.2
2.4.2.dev1
2.4.2rc1
2.4.3
2.4.3.dev1
2.4.3.dev3
2.4.3.dev4
2.4.3rc1
3.0.0
3.0.0.dev1
3.0.0.dev10
3.0.0.dev11
3.0.0.dev13
3.0.0.dev14
3.0.0.dev15
3.0.0.dev16
3.0.0.dev17
3.0.0.dev18
3.0.0.dev19
3.0.0.dev2
3.0.0.dev20
3.0.0.dev3
3.0.0.dev4
3.0.0.dev5
3.0.0.dev6
3.0.0.dev7
3.0.0.dev8
3.0.0.dev9
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.0rc5
3.0.0rc6
3.0.1
3.0.1rc1
3.0.2
3.0.2rc1
3.0.3
3.0.3rc1
3.1.0
3.1.0.dev1
3.1.0.dev2
3.1.0.dev3
3.1.0.dev4
3.1.0.dev5
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.1
3.1.1rc1
3.2.0
3.2.0.dev1
3.2.0.dev2
3.2.0.dev3
3.2.0.dev4
3.2.0rc1
3.2.0rc2
3.2.0rc3
3.2.1
3.2.2
3.2.2rc1
3.3.0
3.3.0.dev1
3.3.0.dev2
3.3.0.dev3
3.3.0rc1
3.3.0rc2
3.3.0rc3
3.3.1
3.3.1.dev1
3.3.1rc1
3.3.2
3.3.3
3.3.4
3.3.4rc1
3.4.0
3.4.0.dev1
3.4.0.dev2
3.4.0.dev3
3.4.0.dev4
3.4.0.dev5
3.4.0.dev6
3.4.0.dev7
3.4.0.dev8
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.4.3
3.5.0
3.5.0.dev1
3.5.0.dev3
3.5.0.dev4
3.5.0.dev5
3.5.0.dev6
3.5.0.dev7
3.5.0.dev8
3.5.0rc1
3.5.0rc2
3.5.1
3.5.2
3.6.0
3.6.0.dev1
3.6.0rc1
3.6.0rc2
3.6.1
3.6.2
3.6.3
3.6.3rc1
3.6.3rc2
3.7.0
3.7.0.dev1
3.7.0.dev2
3.7.0.dev3
3.7.0.dev4
3.7.0.dev5
3.7.0.dev6
3.7.0.dev7
3.7.0.dev8
3.7.0.dev9
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.7.3
3.7.3rc1
3.7.3rc2
3.8.0
3.8.0.dev1
3.8.0.dev2
3.8.0.dev3
3.8.0.dev4
3.8.0rc1
3.8.0rc2
3.8.1
Fixed in
3.8.2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
3.7.3rc2
pre
1 CVE
CVE-2026-21883
PYSEC-2026-1223
GHSA-793v-589g-574v
Jul 07, 2026
Bokeh server applications have Incomplete Origin Validation in WebSockets
Critical
Network
Low
None
This vulnerability allows for Cross-Site WebSocket Hijacking (CSWSH) of a deployed Bokeh server instance. ScopeThis vulnerability is only relevant to deployed Bokeh server instances. There is no impact on static HTML output, standalone embedded plots, or Jupyter notebook usage. This vulnerability does not prevent any requirements for up-front authentication on Bokeh servers that have authentication hooks in place, and cannot be used to make Bokeh servers deployed on private, internal networks accessible outside those networks. ImpactIf a Bokeh server is configured with an allowlist (e.g., Once connected, the attacker can interact with the Bokeh server on behalf of the victim, potentially accessing sensitive data, or modifying visualizations. PatchesPatched in versions 3.8.2 and later. WorkaroundsNone Technical descriptionThe Because the code only checks if the pattern is longer than the host (lines 232-233), but fails to check if the host is longer than the pattern, a host that starts with the pattern (but has additional segments) will successfully match. For example, if the allowlist is configured to
Affected versions
0.10.0
0.11.0
0.11.1
0.12.0
0.12.1
0.12.10
0.12.11
0.12.13
0.12.14
0.12.15
0.12.16
0.12.2
+ 232 more Show less
0.12.3
0.12.4
0.12.5
0.12.6
0.12.7
0.12.9
0.13.0
0.2
0.3
0.4
0.4.1
0.4.4
0.5.0
0.5.1
0.5.2
0.6.0
0.6.1
0.7.0
0.7.1
0.8.0
0.8.1
0.8.2
0.9.0
0.9.1
0.9.2
0.9.3
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.4
1.4.0
2.0.0
2.0.0rc1
2.0.0rc2
2.0.1
2.0.2
2.1.0
2.1.0rc1
2.1.0rc2
2.1.0rc3
2.1.1
2.2.0
2.2.0.dev4
2.2.0.dev6
2.2.0.dev7
2.2.0.dev8
2.2.0rc1
2.2.0rc2
2.2.0rc3
2.2.1
2.2.2
2.2.3
2.3.0
2.3.0.dev1
2.3.0.dev10
2.3.0.dev11
2.3.0.dev12
2.3.0.dev13
2.3.0.dev14
2.3.0.dev2
2.3.0.dev3
2.3.0.dev5
2.3.0.dev7
2.3.0.dev8
2.3.0.dev9
2.3.0rc2
2.3.0rc3
2.3.0rc4
2.3.1
2.3.1.dev1
2.3.1rc1
2.3.1rc2
2.3.2
2.3.2rc1
2.3.3
2.3.3rc1
2.4.0
2.4.0.dev1
2.4.0.dev2
2.4.0.dev4
2.4.0.dev5
2.4.0.dev6
2.4.0.dev7
2.4.0.dev8
2.4.0rc1
2.4.0rc2
2.4.0rc3
2.4.1
2.4.1rc1
2.4.2
2.4.2.dev1
2.4.2rc1
2.4.3
2.4.3.dev1
2.4.3.dev3
2.4.3.dev4
2.4.3rc1
3.0.0
3.0.0.dev1
3.0.0.dev10
3.0.0.dev11
3.0.0.dev13
3.0.0.dev14
3.0.0.dev15
3.0.0.dev16
3.0.0.dev17
3.0.0.dev18
3.0.0.dev19
3.0.0.dev2
3.0.0.dev20
3.0.0.dev3
3.0.0.dev4
3.0.0.dev5
3.0.0.dev6
3.0.0.dev7
3.0.0.dev8
3.0.0.dev9
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.0rc5
3.0.0rc6
3.0.1
3.0.1rc1
3.0.2
3.0.2rc1
3.0.3
3.0.3rc1
3.1.0
3.1.0.dev1
3.1.0.dev2
3.1.0.dev3
3.1.0.dev4
3.1.0.dev5
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.1
3.1.1rc1
3.2.0
3.2.0.dev1
3.2.0.dev2
3.2.0.dev3
3.2.0.dev4
3.2.0rc1
3.2.0rc2
3.2.0rc3
3.2.1
3.2.2
3.2.2rc1
3.3.0
3.3.0.dev1
3.3.0.dev2
3.3.0.dev3
3.3.0rc1
3.3.0rc2
3.3.0rc3
3.3.1
3.3.1.dev1
3.3.1rc1
3.3.2
3.3.3
3.3.4
3.3.4rc1
3.4.0
3.4.0.dev1
3.4.0.dev2
3.4.0.dev3
3.4.0.dev4
3.4.0.dev5
3.4.0.dev6
3.4.0.dev7
3.4.0.dev8
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.4.3
3.5.0
3.5.0.dev1
3.5.0.dev3
3.5.0.dev4
3.5.0.dev5
3.5.0.dev6
3.5.0.dev7
3.5.0.dev8
3.5.0rc1
3.5.0rc2
3.5.1
3.5.2
3.6.0
3.6.0.dev1
3.6.0rc1
3.6.0rc2
3.6.1
3.6.2
3.6.3
3.6.3rc1
3.6.3rc2
3.7.0
3.7.0.dev1
3.7.0.dev2
3.7.0.dev3
3.7.0.dev4
3.7.0.dev5
3.7.0.dev6
3.7.0.dev7
3.7.0.dev8
3.7.0.dev9
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.7.3
3.7.3rc1
3.7.3rc2
3.8.0
3.8.0.dev1
3.8.0.dev2
3.8.0.dev3
3.8.0.dev4
3.8.0rc1
3.8.0rc2
3.8.1
Fixed in
3.8.2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
3.7.3rc1
pre
1 CVE
CVE-2026-21883
PYSEC-2026-1223
GHSA-793v-589g-574v
Jul 07, 2026
Bokeh server applications have Incomplete Origin Validation in WebSockets
Critical
Network
Low
None
This vulnerability allows for Cross-Site WebSocket Hijacking (CSWSH) of a deployed Bokeh server instance. ScopeThis vulnerability is only relevant to deployed Bokeh server instances. There is no impact on static HTML output, standalone embedded plots, or Jupyter notebook usage. This vulnerability does not prevent any requirements for up-front authentication on Bokeh servers that have authentication hooks in place, and cannot be used to make Bokeh servers deployed on private, internal networks accessible outside those networks. ImpactIf a Bokeh server is configured with an allowlist (e.g., Once connected, the attacker can interact with the Bokeh server on behalf of the victim, potentially accessing sensitive data, or modifying visualizations. PatchesPatched in versions 3.8.2 and later. WorkaroundsNone Technical descriptionThe Because the code only checks if the pattern is longer than the host (lines 232-233), but fails to check if the host is longer than the pattern, a host that starts with the pattern (but has additional segments) will successfully match. For example, if the allowlist is configured to
Affected versions
0.10.0
0.11.0
0.11.1
0.12.0
0.12.1
0.12.10
0.12.11
0.12.13
0.12.14
0.12.15
0.12.16
0.12.2
+ 232 more Show less
0.12.3
0.12.4
0.12.5
0.12.6
0.12.7
0.12.9
0.13.0
0.2
0.3
0.4
0.4.1
0.4.4
0.5.0
0.5.1
0.5.2
0.6.0
0.6.1
0.7.0
0.7.1
0.8.0
0.8.1
0.8.2
0.9.0
0.9.1
0.9.2
0.9.3
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.4
1.4.0
2.0.0
2.0.0rc1
2.0.0rc2
2.0.1
2.0.2
2.1.0
2.1.0rc1
2.1.0rc2
2.1.0rc3
2.1.1
2.2.0
2.2.0.dev4
2.2.0.dev6
2.2.0.dev7
2.2.0.dev8
2.2.0rc1
2.2.0rc2
2.2.0rc3
2.2.1
2.2.2
2.2.3
2.3.0
2.3.0.dev1
2.3.0.dev10
2.3.0.dev11
2.3.0.dev12
2.3.0.dev13
2.3.0.dev14
2.3.0.dev2
2.3.0.dev3
2.3.0.dev5
2.3.0.dev7
2.3.0.dev8
2.3.0.dev9
2.3.0rc2
2.3.0rc3
2.3.0rc4
2.3.1
2.3.1.dev1
2.3.1rc1
2.3.1rc2
2.3.2
2.3.2rc1
2.3.3
2.3.3rc1
2.4.0
2.4.0.dev1
2.4.0.dev2
2.4.0.dev4
2.4.0.dev5
2.4.0.dev6
2.4.0.dev7
2.4.0.dev8
2.4.0rc1
2.4.0rc2
2.4.0rc3
2.4.1
2.4.1rc1
2.4.2
2.4.2.dev1
2.4.2rc1
2.4.3
2.4.3.dev1
2.4.3.dev3
2.4.3.dev4
2.4.3rc1
3.0.0
3.0.0.dev1
3.0.0.dev10
3.0.0.dev11
3.0.0.dev13
3.0.0.dev14
3.0.0.dev15
3.0.0.dev16
3.0.0.dev17
3.0.0.dev18
3.0.0.dev19
3.0.0.dev2
3.0.0.dev20
3.0.0.dev3
3.0.0.dev4
3.0.0.dev5
3.0.0.dev6
3.0.0.dev7
3.0.0.dev8
3.0.0.dev9
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.0rc5
3.0.0rc6
3.0.1
3.0.1rc1
3.0.2
3.0.2rc1
3.0.3
3.0.3rc1
3.1.0
3.1.0.dev1
3.1.0.dev2
3.1.0.dev3
3.1.0.dev4
3.1.0.dev5
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.1
3.1.1rc1
3.2.0
3.2.0.dev1
3.2.0.dev2
3.2.0.dev3
3.2.0.dev4
3.2.0rc1
3.2.0rc2
3.2.0rc3
3.2.1
3.2.2
3.2.2rc1
3.3.0
3.3.0.dev1
3.3.0.dev2
3.3.0.dev3
3.3.0rc1
3.3.0rc2
3.3.0rc3
3.3.1
3.3.1.dev1
3.3.1rc1
3.3.2
3.3.3
3.3.4
3.3.4rc1
3.4.0
3.4.0.dev1
3.4.0.dev2
3.4.0.dev3
3.4.0.dev4
3.4.0.dev5
3.4.0.dev6
3.4.0.dev7
3.4.0.dev8
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.4.3
3.5.0
3.5.0.dev1
3.5.0.dev3
3.5.0.dev4
3.5.0.dev5
3.5.0.dev6
3.5.0.dev7
3.5.0.dev8
3.5.0rc1
3.5.0rc2
3.5.1
3.5.2
3.6.0
3.6.0.dev1
3.6.0rc1
3.6.0rc2
3.6.1
3.6.2
3.6.3
3.6.3rc1
3.6.3rc2
3.7.0
3.7.0.dev1
3.7.0.dev2
3.7.0.dev3
3.7.0.dev4
3.7.0.dev5
3.7.0.dev6
3.7.0.dev7
3.7.0.dev8
3.7.0.dev9
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.7.3
3.7.3rc1
3.7.3rc2
3.8.0
3.8.0.dev1
3.8.0.dev2
3.8.0.dev3
3.8.0.dev4
3.8.0rc1
3.8.0rc2
3.8.1
Fixed in
3.8.2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
3.7.2
patch
1 CVE
CVE-2026-21883
PYSEC-2026-1223
GHSA-793v-589g-574v
Jul 07, 2026
Bokeh server applications have Incomplete Origin Validation in WebSockets
Critical
Network
Low
None
This vulnerability allows for Cross-Site WebSocket Hijacking (CSWSH) of a deployed Bokeh server instance. ScopeThis vulnerability is only relevant to deployed Bokeh server instances. There is no impact on static HTML output, standalone embedded plots, or Jupyter notebook usage. This vulnerability does not prevent any requirements for up-front authentication on Bokeh servers that have authentication hooks in place, and cannot be used to make Bokeh servers deployed on private, internal networks accessible outside those networks. ImpactIf a Bokeh server is configured with an allowlist (e.g., Once connected, the attacker can interact with the Bokeh server on behalf of the victim, potentially accessing sensitive data, or modifying visualizations. PatchesPatched in versions 3.8.2 and later. WorkaroundsNone Technical descriptionThe Because the code only checks if the pattern is longer than the host (lines 232-233), but fails to check if the host is longer than the pattern, a host that starts with the pattern (but has additional segments) will successfully match. For example, if the allowlist is configured to
Affected versions
0.10.0
0.11.0
0.11.1
0.12.0
0.12.1
0.12.10
0.12.11
0.12.13
0.12.14
0.12.15
0.12.16
0.12.2
+ 232 more Show less
0.12.3
0.12.4
0.12.5
0.12.6
0.12.7
0.12.9
0.13.0
0.2
0.3
0.4
0.4.1
0.4.4
0.5.0
0.5.1
0.5.2
0.6.0
0.6.1
0.7.0
0.7.1
0.8.0
0.8.1
0.8.2
0.9.0
0.9.1
0.9.2
0.9.3
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.4
1.4.0
2.0.0
2.0.0rc1
2.0.0rc2
2.0.1
2.0.2
2.1.0
2.1.0rc1
2.1.0rc2
2.1.0rc3
2.1.1
2.2.0
2.2.0.dev4
2.2.0.dev6
2.2.0.dev7
2.2.0.dev8
2.2.0rc1
2.2.0rc2
2.2.0rc3
2.2.1
2.2.2
2.2.3
2.3.0
2.3.0.dev1
2.3.0.dev10
2.3.0.dev11
2.3.0.dev12
2.3.0.dev13
2.3.0.dev14
2.3.0.dev2
2.3.0.dev3
2.3.0.dev5
2.3.0.dev7
2.3.0.dev8
2.3.0.dev9
2.3.0rc2
2.3.0rc3
2.3.0rc4
2.3.1
2.3.1.dev1
2.3.1rc1
2.3.1rc2
2.3.2
2.3.2rc1
2.3.3
2.3.3rc1
2.4.0
2.4.0.dev1
2.4.0.dev2
2.4.0.dev4
2.4.0.dev5
2.4.0.dev6
2.4.0.dev7
2.4.0.dev8
2.4.0rc1
2.4.0rc2
2.4.0rc3
2.4.1
2.4.1rc1
2.4.2
2.4.2.dev1
2.4.2rc1
2.4.3
2.4.3.dev1
2.4.3.dev3
2.4.3.dev4
2.4.3rc1
3.0.0
3.0.0.dev1
3.0.0.dev10
3.0.0.dev11
3.0.0.dev13
3.0.0.dev14
3.0.0.dev15
3.0.0.dev16
3.0.0.dev17
3.0.0.dev18
3.0.0.dev19
3.0.0.dev2
3.0.0.dev20
3.0.0.dev3
3.0.0.dev4
3.0.0.dev5
3.0.0.dev6
3.0.0.dev7
3.0.0.dev8
3.0.0.dev9
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.0rc5
3.0.0rc6
3.0.1
3.0.1rc1
3.0.2
3.0.2rc1
3.0.3
3.0.3rc1
3.1.0
3.1.0.dev1
3.1.0.dev2
3.1.0.dev3
3.1.0.dev4
3.1.0.dev5
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.1
3.1.1rc1
3.2.0
3.2.0.dev1
3.2.0.dev2
3.2.0.dev3
3.2.0.dev4
3.2.0rc1
3.2.0rc2
3.2.0rc3
3.2.1
3.2.2
3.2.2rc1
3.3.0
3.3.0.dev1
3.3.0.dev2
3.3.0.dev3
3.3.0rc1
3.3.0rc2
3.3.0rc3
3.3.1
3.3.1.dev1
3.3.1rc1
3.3.2
3.3.3
3.3.4
3.3.4rc1
3.4.0
3.4.0.dev1
3.4.0.dev2
3.4.0.dev3
3.4.0.dev4
3.4.0.dev5
3.4.0.dev6
3.4.0.dev7
3.4.0.dev8
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.4.3
3.5.0
3.5.0.dev1
3.5.0.dev3
3.5.0.dev4
3.5.0.dev5
3.5.0.dev6
3.5.0.dev7
3.5.0.dev8
3.5.0rc1
3.5.0rc2
3.5.1
3.5.2
3.6.0
3.6.0.dev1
3.6.0rc1
3.6.0rc2
3.6.1
3.6.2
3.6.3
3.6.3rc1
3.6.3rc2
3.7.0
3.7.0.dev1
3.7.0.dev2
3.7.0.dev3
3.7.0.dev4
3.7.0.dev5
3.7.0.dev6
3.7.0.dev7
3.7.0.dev8
3.7.0.dev9
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.7.3
3.7.3rc1
3.7.3rc2
3.8.0
3.8.0.dev1
3.8.0.dev2
3.8.0.dev3
3.8.0.dev4
3.8.0rc1
3.8.0rc2
3.8.1
Fixed in
3.8.2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
3.7.1
patch
1 CVE
CVE-2026-21883
PYSEC-2026-1223
GHSA-793v-589g-574v
Jul 07, 2026
Bokeh server applications have Incomplete Origin Validation in WebSockets
Critical
Network
Low
None
This vulnerability allows for Cross-Site WebSocket Hijacking (CSWSH) of a deployed Bokeh server instance. ScopeThis vulnerability is only relevant to deployed Bokeh server instances. There is no impact on static HTML output, standalone embedded plots, or Jupyter notebook usage. This vulnerability does not prevent any requirements for up-front authentication on Bokeh servers that have authentication hooks in place, and cannot be used to make Bokeh servers deployed on private, internal networks accessible outside those networks. ImpactIf a Bokeh server is configured with an allowlist (e.g., Once connected, the attacker can interact with the Bokeh server on behalf of the victim, potentially accessing sensitive data, or modifying visualizations. PatchesPatched in versions 3.8.2 and later. WorkaroundsNone Technical descriptionThe Because the code only checks if the pattern is longer than the host (lines 232-233), but fails to check if the host is longer than the pattern, a host that starts with the pattern (but has additional segments) will successfully match. For example, if the allowlist is configured to
Affected versions
0.10.0
0.11.0
0.11.1
0.12.0
0.12.1
0.12.10
0.12.11
0.12.13
0.12.14
0.12.15
0.12.16
0.12.2
+ 232 more Show less
0.12.3
0.12.4
0.12.5
0.12.6
0.12.7
0.12.9
0.13.0
0.2
0.3
0.4
0.4.1
0.4.4
0.5.0
0.5.1
0.5.2
0.6.0
0.6.1
0.7.0
0.7.1
0.8.0
0.8.1
0.8.2
0.9.0
0.9.1
0.9.2
0.9.3
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.4
1.4.0
2.0.0
2.0.0rc1
2.0.0rc2
2.0.1
2.0.2
2.1.0
2.1.0rc1
2.1.0rc2
2.1.0rc3
2.1.1
2.2.0
2.2.0.dev4
2.2.0.dev6
2.2.0.dev7
2.2.0.dev8
2.2.0rc1
2.2.0rc2
2.2.0rc3
2.2.1
2.2.2
2.2.3
2.3.0
2.3.0.dev1
2.3.0.dev10
2.3.0.dev11
2.3.0.dev12
2.3.0.dev13
2.3.0.dev14
2.3.0.dev2
2.3.0.dev3
2.3.0.dev5
2.3.0.dev7
2.3.0.dev8
2.3.0.dev9
2.3.0rc2
2.3.0rc3
2.3.0rc4
2.3.1
2.3.1.dev1
2.3.1rc1
2.3.1rc2
2.3.2
2.3.2rc1
2.3.3
2.3.3rc1
2.4.0
2.4.0.dev1
2.4.0.dev2
2.4.0.dev4
2.4.0.dev5
2.4.0.dev6
2.4.0.dev7
2.4.0.dev8
2.4.0rc1
2.4.0rc2
2.4.0rc3
2.4.1
2.4.1rc1
2.4.2
2.4.2.dev1
2.4.2rc1
2.4.3
2.4.3.dev1
2.4.3.dev3
2.4.3.dev4
2.4.3rc1
3.0.0
3.0.0.dev1
3.0.0.dev10
3.0.0.dev11
3.0.0.dev13
3.0.0.dev14
3.0.0.dev15
3.0.0.dev16
3.0.0.dev17
3.0.0.dev18
3.0.0.dev19
3.0.0.dev2
3.0.0.dev20
3.0.0.dev3
3.0.0.dev4
3.0.0.dev5
3.0.0.dev6
3.0.0.dev7
3.0.0.dev8
3.0.0.dev9
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.0rc5
3.0.0rc6
3.0.1
3.0.1rc1
3.0.2
3.0.2rc1
3.0.3
3.0.3rc1
3.1.0
3.1.0.dev1
3.1.0.dev2
3.1.0.dev3
3.1.0.dev4
3.1.0.dev5
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.1
3.1.1rc1
3.2.0
3.2.0.dev1
3.2.0.dev2
3.2.0.dev3
3.2.0.dev4
3.2.0rc1
3.2.0rc2
3.2.0rc3
3.2.1
3.2.2
3.2.2rc1
3.3.0
3.3.0.dev1
3.3.0.dev2
3.3.0.dev3
3.3.0rc1
3.3.0rc2
3.3.0rc3
3.3.1
3.3.1.dev1
3.3.1rc1
3.3.2
3.3.3
3.3.4
3.3.4rc1
3.4.0
3.4.0.dev1
3.4.0.dev2
3.4.0.dev3
3.4.0.dev4
3.4.0.dev5
3.4.0.dev6
3.4.0.dev7
3.4.0.dev8
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.4.3
3.5.0
3.5.0.dev1
3.5.0.dev3
3.5.0.dev4
3.5.0.dev5
3.5.0.dev6
3.5.0.dev7
3.5.0.dev8
3.5.0rc1
3.5.0rc2
3.5.1
3.5.2
3.6.0
3.6.0.dev1
3.6.0rc1
3.6.0rc2
3.6.1
3.6.2
3.6.3
3.6.3rc1
3.6.3rc2
3.7.0
3.7.0.dev1
3.7.0.dev2
3.7.0.dev3
3.7.0.dev4
3.7.0.dev5
3.7.0.dev6
3.7.0.dev7
3.7.0.dev8
3.7.0.dev9
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.7.3
3.7.3rc1
3.7.3rc2
3.8.0
3.8.0.dev1
3.8.0.dev2
3.8.0.dev3
3.8.0.dev4
3.8.0rc1
3.8.0rc2
3.8.1
Fixed in
3.8.2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
3.7.0
minor
1 CVE
CVE-2026-21883
PYSEC-2026-1223
GHSA-793v-589g-574v
Jul 07, 2026
Bokeh server applications have Incomplete Origin Validation in WebSockets
Critical
Network
Low
None
This vulnerability allows for Cross-Site WebSocket Hijacking (CSWSH) of a deployed Bokeh server instance. ScopeThis vulnerability is only relevant to deployed Bokeh server instances. There is no impact on static HTML output, standalone embedded plots, or Jupyter notebook usage. This vulnerability does not prevent any requirements for up-front authentication on Bokeh servers that have authentication hooks in place, and cannot be used to make Bokeh servers deployed on private, internal networks accessible outside those networks. ImpactIf a Bokeh server is configured with an allowlist (e.g., Once connected, the attacker can interact with the Bokeh server on behalf of the victim, potentially accessing sensitive data, or modifying visualizations. PatchesPatched in versions 3.8.2 and later. WorkaroundsNone Technical descriptionThe Because the code only checks if the pattern is longer than the host (lines 232-233), but fails to check if the host is longer than the pattern, a host that starts with the pattern (but has additional segments) will successfully match. For example, if the allowlist is configured to
Affected versions
0.10.0
0.11.0
0.11.1
0.12.0
0.12.1
0.12.10
0.12.11
0.12.13
0.12.14
0.12.15
0.12.16
0.12.2
+ 232 more Show less
0.12.3
0.12.4
0.12.5
0.12.6
0.12.7
0.12.9
0.13.0
0.2
0.3
0.4
0.4.1
0.4.4
0.5.0
0.5.1
0.5.2
0.6.0
0.6.1
0.7.0
0.7.1
0.8.0
0.8.1
0.8.2
0.9.0
0.9.1
0.9.2
0.9.3
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.4
1.4.0
2.0.0
2.0.0rc1
2.0.0rc2
2.0.1
2.0.2
2.1.0
2.1.0rc1
2.1.0rc2
2.1.0rc3
2.1.1
2.2.0
2.2.0.dev4
2.2.0.dev6
2.2.0.dev7
2.2.0.dev8
2.2.0rc1
2.2.0rc2
2.2.0rc3
2.2.1
2.2.2
2.2.3
2.3.0
2.3.0.dev1
2.3.0.dev10
2.3.0.dev11
2.3.0.dev12
2.3.0.dev13
2.3.0.dev14
2.3.0.dev2
2.3.0.dev3
2.3.0.dev5
2.3.0.dev7
2.3.0.dev8
2.3.0.dev9
2.3.0rc2
2.3.0rc3
2.3.0rc4
2.3.1
2.3.1.dev1
2.3.1rc1
2.3.1rc2
2.3.2
2.3.2rc1
2.3.3
2.3.3rc1
2.4.0
2.4.0.dev1
2.4.0.dev2
2.4.0.dev4
2.4.0.dev5
2.4.0.dev6
2.4.0.dev7
2.4.0.dev8
2.4.0rc1
2.4.0rc2
2.4.0rc3
2.4.1
2.4.1rc1
2.4.2
2.4.2.dev1
2.4.2rc1
2.4.3
2.4.3.dev1
2.4.3.dev3
2.4.3.dev4
2.4.3rc1
3.0.0
3.0.0.dev1
3.0.0.dev10
3.0.0.dev11
3.0.0.dev13
3.0.0.dev14
3.0.0.dev15
3.0.0.dev16
3.0.0.dev17
3.0.0.dev18
3.0.0.dev19
3.0.0.dev2
3.0.0.dev20
3.0.0.dev3
3.0.0.dev4
3.0.0.dev5
3.0.0.dev6
3.0.0.dev7
3.0.0.dev8
3.0.0.dev9
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.0rc5
3.0.0rc6
3.0.1
3.0.1rc1
3.0.2
3.0.2rc1
3.0.3
3.0.3rc1
3.1.0
3.1.0.dev1
3.1.0.dev2
3.1.0.dev3
3.1.0.dev4
3.1.0.dev5
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.1
3.1.1rc1
3.2.0
3.2.0.dev1
3.2.0.dev2
3.2.0.dev3
3.2.0.dev4
3.2.0rc1
3.2.0rc2
3.2.0rc3
3.2.1
3.2.2
3.2.2rc1
3.3.0
3.3.0.dev1
3.3.0.dev2
3.3.0.dev3
3.3.0rc1
3.3.0rc2
3.3.0rc3
3.3.1
3.3.1.dev1
3.3.1rc1
3.3.2
3.3.3
3.3.4
3.3.4rc1
3.4.0
3.4.0.dev1
3.4.0.dev2
3.4.0.dev3
3.4.0.dev4
3.4.0.dev5
3.4.0.dev6
3.4.0.dev7
3.4.0.dev8
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.4.3
3.5.0
3.5.0.dev1
3.5.0.dev3
3.5.0.dev4
3.5.0.dev5
3.5.0.dev6
3.5.0.dev7
3.5.0.dev8
3.5.0rc1
3.5.0rc2
3.5.1
3.5.2
3.6.0
3.6.0.dev1
3.6.0rc1
3.6.0rc2
3.6.1
3.6.2
3.6.3
3.6.3rc1
3.6.3rc2
3.7.0
3.7.0.dev1
3.7.0.dev2
3.7.0.dev3
3.7.0.dev4
3.7.0.dev5
3.7.0.dev6
3.7.0.dev7
3.7.0.dev8
3.7.0.dev9
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.7.3
3.7.3rc1
3.7.3rc2
3.8.0
3.8.0.dev1
3.8.0.dev2
3.8.0.dev3
3.8.0.dev4
3.8.0rc1
3.8.0rc2
3.8.1
Fixed in
3.8.2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
3.8.0.dev1
pre
1 CVE
CVE-2026-21883
PYSEC-2026-1223
GHSA-793v-589g-574v
Jul 07, 2026
Bokeh server applications have Incomplete Origin Validation in WebSockets
Critical
Network
Low
None
This vulnerability allows for Cross-Site WebSocket Hijacking (CSWSH) of a deployed Bokeh server instance. ScopeThis vulnerability is only relevant to deployed Bokeh server instances. There is no impact on static HTML output, standalone embedded plots, or Jupyter notebook usage. This vulnerability does not prevent any requirements for up-front authentication on Bokeh servers that have authentication hooks in place, and cannot be used to make Bokeh servers deployed on private, internal networks accessible outside those networks. ImpactIf a Bokeh server is configured with an allowlist (e.g., Once connected, the attacker can interact with the Bokeh server on behalf of the victim, potentially accessing sensitive data, or modifying visualizations. PatchesPatched in versions 3.8.2 and later. WorkaroundsNone Technical descriptionThe Because the code only checks if the pattern is longer than the host (lines 232-233), but fails to check if the host is longer than the pattern, a host that starts with the pattern (but has additional segments) will successfully match. For example, if the allowlist is configured to
Affected versions
0.10.0
0.11.0
0.11.1
0.12.0
0.12.1
0.12.10
0.12.11
0.12.13
0.12.14
0.12.15
0.12.16
0.12.2
+ 232 more Show less
0.12.3
0.12.4
0.12.5
0.12.6
0.12.7
0.12.9
0.13.0
0.2
0.3
0.4
0.4.1
0.4.4
0.5.0
0.5.1
0.5.2
0.6.0
0.6.1
0.7.0
0.7.1
0.8.0
0.8.1
0.8.2
0.9.0
0.9.1
0.9.2
0.9.3
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.4
1.4.0
2.0.0
2.0.0rc1
2.0.0rc2
2.0.1
2.0.2
2.1.0
2.1.0rc1
2.1.0rc2
2.1.0rc3
2.1.1
2.2.0
2.2.0.dev4
2.2.0.dev6
2.2.0.dev7
2.2.0.dev8
2.2.0rc1
2.2.0rc2
2.2.0rc3
2.2.1
2.2.2
2.2.3
2.3.0
2.3.0.dev1
2.3.0.dev10
2.3.0.dev11
2.3.0.dev12
2.3.0.dev13
2.3.0.dev14
2.3.0.dev2
2.3.0.dev3
2.3.0.dev5
2.3.0.dev7
2.3.0.dev8
2.3.0.dev9
2.3.0rc2
2.3.0rc3
2.3.0rc4
2.3.1
2.3.1.dev1
2.3.1rc1
2.3.1rc2
2.3.2
2.3.2rc1
2.3.3
2.3.3rc1
2.4.0
2.4.0.dev1
2.4.0.dev2
2.4.0.dev4
2.4.0.dev5
2.4.0.dev6
2.4.0.dev7
2.4.0.dev8
2.4.0rc1
2.4.0rc2
2.4.0rc3
2.4.1
2.4.1rc1
2.4.2
2.4.2.dev1
2.4.2rc1
2.4.3
2.4.3.dev1
2.4.3.dev3
2.4.3.dev4
2.4.3rc1
3.0.0
3.0.0.dev1
3.0.0.dev10
3.0.0.dev11
3.0.0.dev13
3.0.0.dev14
3.0.0.dev15
3.0.0.dev16
3.0.0.dev17
3.0.0.dev18
3.0.0.dev19
3.0.0.dev2
3.0.0.dev20
3.0.0.dev3
3.0.0.dev4
3.0.0.dev5
3.0.0.dev6
3.0.0.dev7
3.0.0.dev8
3.0.0.dev9
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.0rc5
3.0.0rc6
3.0.1
3.0.1rc1
3.0.2
3.0.2rc1
3.0.3
3.0.3rc1
3.1.0
3.1.0.dev1
3.1.0.dev2
3.1.0.dev3
3.1.0.dev4
3.1.0.dev5
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.1
3.1.1rc1
3.2.0
3.2.0.dev1
3.2.0.dev2
3.2.0.dev3
3.2.0.dev4
3.2.0rc1
3.2.0rc2
3.2.0rc3
3.2.1
3.2.2
3.2.2rc1
3.3.0
3.3.0.dev1
3.3.0.dev2
3.3.0.dev3
3.3.0rc1
3.3.0rc2
3.3.0rc3
3.3.1
3.3.1.dev1
3.3.1rc1
3.3.2
3.3.3
3.3.4
3.3.4rc1
3.4.0
3.4.0.dev1
3.4.0.dev2
3.4.0.dev3
3.4.0.dev4
3.4.0.dev5
3.4.0.dev6
3.4.0.dev7
3.4.0.dev8
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.4.3
3.5.0
3.5.0.dev1
3.5.0.dev3
3.5.0.dev4
3.5.0.dev5
3.5.0.dev6
3.5.0.dev7
3.5.0.dev8
3.5.0rc1
3.5.0rc2
3.5.1
3.5.2
3.6.0
3.6.0.dev1
3.6.0rc1
3.6.0rc2
3.6.1
3.6.2
3.6.3
3.6.3rc1
3.6.3rc2
3.7.0
3.7.0.dev1
3.7.0.dev2
3.7.0.dev3
3.7.0.dev4
3.7.0.dev5
3.7.0.dev6
3.7.0.dev7
3.7.0.dev8
3.7.0.dev9
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.7.3
3.7.3rc1
3.7.3rc2
3.8.0
3.8.0.dev1
3.8.0.dev2
3.8.0.dev3
3.8.0.dev4
3.8.0rc1
3.8.0rc2
3.8.1
Fixed in
3.8.2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
3.7.0rc2
pre
1 CVE
CVE-2026-21883
PYSEC-2026-1223
GHSA-793v-589g-574v
Jul 07, 2026
Bokeh server applications have Incomplete Origin Validation in WebSockets
Critical
Network
Low
None
This vulnerability allows for Cross-Site WebSocket Hijacking (CSWSH) of a deployed Bokeh server instance. ScopeThis vulnerability is only relevant to deployed Bokeh server instances. There is no impact on static HTML output, standalone embedded plots, or Jupyter notebook usage. This vulnerability does not prevent any requirements for up-front authentication on Bokeh servers that have authentication hooks in place, and cannot be used to make Bokeh servers deployed on private, internal networks accessible outside those networks. ImpactIf a Bokeh server is configured with an allowlist (e.g., Once connected, the attacker can interact with the Bokeh server on behalf of the victim, potentially accessing sensitive data, or modifying visualizations. PatchesPatched in versions 3.8.2 and later. WorkaroundsNone Technical descriptionThe Because the code only checks if the pattern is longer than the host (lines 232-233), but fails to check if the host is longer than the pattern, a host that starts with the pattern (but has additional segments) will successfully match. For example, if the allowlist is configured to
Affected versions
0.10.0
0.11.0
0.11.1
0.12.0
0.12.1
0.12.10
0.12.11
0.12.13
0.12.14
0.12.15
0.12.16
0.12.2
+ 232 more Show less
0.12.3
0.12.4
0.12.5
0.12.6
0.12.7
0.12.9
0.13.0
0.2
0.3
0.4
0.4.1
0.4.4
0.5.0
0.5.1
0.5.2
0.6.0
0.6.1
0.7.0
0.7.1
0.8.0
0.8.1
0.8.2
0.9.0
0.9.1
0.9.2
0.9.3
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.4
1.4.0
2.0.0
2.0.0rc1
2.0.0rc2
2.0.1
2.0.2
2.1.0
2.1.0rc1
2.1.0rc2
2.1.0rc3
2.1.1
2.2.0
2.2.0.dev4
2.2.0.dev6
2.2.0.dev7
2.2.0.dev8
2.2.0rc1
2.2.0rc2
2.2.0rc3
2.2.1
2.2.2
2.2.3
2.3.0
2.3.0.dev1
2.3.0.dev10
2.3.0.dev11
2.3.0.dev12
2.3.0.dev13
2.3.0.dev14
2.3.0.dev2
2.3.0.dev3
2.3.0.dev5
2.3.0.dev7
2.3.0.dev8
2.3.0.dev9
2.3.0rc2
2.3.0rc3
2.3.0rc4
2.3.1
2.3.1.dev1
2.3.1rc1
2.3.1rc2
2.3.2
2.3.2rc1
2.3.3
2.3.3rc1
2.4.0
2.4.0.dev1
2.4.0.dev2
2.4.0.dev4
2.4.0.dev5
2.4.0.dev6
2.4.0.dev7
2.4.0.dev8
2.4.0rc1
2.4.0rc2
2.4.0rc3
2.4.1
2.4.1rc1
2.4.2
2.4.2.dev1
2.4.2rc1
2.4.3
2.4.3.dev1
2.4.3.dev3
2.4.3.dev4
2.4.3rc1
3.0.0
3.0.0.dev1
3.0.0.dev10
3.0.0.dev11
3.0.0.dev13
3.0.0.dev14
3.0.0.dev15
3.0.0.dev16
3.0.0.dev17
3.0.0.dev18
3.0.0.dev19
3.0.0.dev2
3.0.0.dev20
3.0.0.dev3
3.0.0.dev4
3.0.0.dev5
3.0.0.dev6
3.0.0.dev7
3.0.0.dev8
3.0.0.dev9
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.0rc5
3.0.0rc6
3.0.1
3.0.1rc1
3.0.2
3.0.2rc1
3.0.3
3.0.3rc1
3.1.0
3.1.0.dev1
3.1.0.dev2
3.1.0.dev3
3.1.0.dev4
3.1.0.dev5
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.1
3.1.1rc1
3.2.0
3.2.0.dev1
3.2.0.dev2
3.2.0.dev3
3.2.0.dev4
3.2.0rc1
3.2.0rc2
3.2.0rc3
3.2.1
3.2.2
3.2.2rc1
3.3.0
3.3.0.dev1
3.3.0.dev2
3.3.0.dev3
3.3.0rc1
3.3.0rc2
3.3.0rc3
3.3.1
3.3.1.dev1
3.3.1rc1
3.3.2
3.3.3
3.3.4
3.3.4rc1
3.4.0
3.4.0.dev1
3.4.0.dev2
3.4.0.dev3
3.4.0.dev4
3.4.0.dev5
3.4.0.dev6
3.4.0.dev7
3.4.0.dev8
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.4.3
3.5.0
3.5.0.dev1
3.5.0.dev3
3.5.0.dev4
3.5.0.dev5
3.5.0.dev6
3.5.0.dev7
3.5.0.dev8
3.5.0rc1
3.5.0rc2
3.5.1
3.5.2
3.6.0
3.6.0.dev1
3.6.0rc1
3.6.0rc2
3.6.1
3.6.2
3.6.3
3.6.3rc1
3.6.3rc2
3.7.0
3.7.0.dev1
3.7.0.dev2
3.7.0.dev3
3.7.0.dev4
3.7.0.dev5
3.7.0.dev6
3.7.0.dev7
3.7.0.dev8
3.7.0.dev9
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.7.3
3.7.3rc1
3.7.3rc2
3.8.0
3.8.0.dev1
3.8.0.dev2
3.8.0.dev3
3.8.0.dev4
3.8.0rc1
3.8.0rc2
3.8.1
Fixed in
3.8.2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
3.7.0rc1
pre
1 CVE
CVE-2026-21883
PYSEC-2026-1223
GHSA-793v-589g-574v
Jul 07, 2026
Bokeh server applications have Incomplete Origin Validation in WebSockets
Critical
Network
Low
None
This vulnerability allows for Cross-Site WebSocket Hijacking (CSWSH) of a deployed Bokeh server instance. ScopeThis vulnerability is only relevant to deployed Bokeh server instances. There is no impact on static HTML output, standalone embedded plots, or Jupyter notebook usage. This vulnerability does not prevent any requirements for up-front authentication on Bokeh servers that have authentication hooks in place, and cannot be used to make Bokeh servers deployed on private, internal networks accessible outside those networks. ImpactIf a Bokeh server is configured with an allowlist (e.g., Once connected, the attacker can interact with the Bokeh server on behalf of the victim, potentially accessing sensitive data, or modifying visualizations. PatchesPatched in versions 3.8.2 and later. WorkaroundsNone Technical descriptionThe Because the code only checks if the pattern is longer than the host (lines 232-233), but fails to check if the host is longer than the pattern, a host that starts with the pattern (but has additional segments) will successfully match. For example, if the allowlist is configured to
Affected versions
0.10.0
0.11.0
0.11.1
0.12.0
0.12.1
0.12.10
0.12.11
0.12.13
0.12.14
0.12.15
0.12.16
0.12.2
+ 232 more Show less
0.12.3
0.12.4
0.12.5
0.12.6
0.12.7
0.12.9
0.13.0
0.2
0.3
0.4
0.4.1
0.4.4
0.5.0
0.5.1
0.5.2
0.6.0
0.6.1
0.7.0
0.7.1
0.8.0
0.8.1
0.8.2
0.9.0
0.9.1
0.9.2
0.9.3
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.4
1.4.0
2.0.0
2.0.0rc1
2.0.0rc2
2.0.1
2.0.2
2.1.0
2.1.0rc1
2.1.0rc2
2.1.0rc3
2.1.1
2.2.0
2.2.0.dev4
2.2.0.dev6
2.2.0.dev7
2.2.0.dev8
2.2.0rc1
2.2.0rc2
2.2.0rc3
2.2.1
2.2.2
2.2.3
2.3.0
2.3.0.dev1
2.3.0.dev10
2.3.0.dev11
2.3.0.dev12
2.3.0.dev13
2.3.0.dev14
2.3.0.dev2
2.3.0.dev3
2.3.0.dev5
2.3.0.dev7
2.3.0.dev8
2.3.0.dev9
2.3.0rc2
2.3.0rc3
2.3.0rc4
2.3.1
2.3.1.dev1
2.3.1rc1
2.3.1rc2
2.3.2
2.3.2rc1
2.3.3
2.3.3rc1
2.4.0
2.4.0.dev1
2.4.0.dev2
2.4.0.dev4
2.4.0.dev5
2.4.0.dev6
2.4.0.dev7
2.4.0.dev8
2.4.0rc1
2.4.0rc2
2.4.0rc3
2.4.1
2.4.1rc1
2.4.2
2.4.2.dev1
2.4.2rc1
2.4.3
2.4.3.dev1
2.4.3.dev3
2.4.3.dev4
2.4.3rc1
3.0.0
3.0.0.dev1
3.0.0.dev10
3.0.0.dev11
3.0.0.dev13
3.0.0.dev14
3.0.0.dev15
3.0.0.dev16
3.0.0.dev17
3.0.0.dev18
3.0.0.dev19
3.0.0.dev2
3.0.0.dev20
3.0.0.dev3
3.0.0.dev4
3.0.0.dev5
3.0.0.dev6
3.0.0.dev7
3.0.0.dev8
3.0.0.dev9
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.0rc5
3.0.0rc6
3.0.1
3.0.1rc1
3.0.2
3.0.2rc1
3.0.3
3.0.3rc1
3.1.0
3.1.0.dev1
3.1.0.dev2
3.1.0.dev3
3.1.0.dev4
3.1.0.dev5
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.1
3.1.1rc1
3.2.0
3.2.0.dev1
3.2.0.dev2
3.2.0.dev3
3.2.0.dev4
3.2.0rc1
3.2.0rc2
3.2.0rc3
3.2.1
3.2.2
3.2.2rc1
3.3.0
3.3.0.dev1
3.3.0.dev2
3.3.0.dev3
3.3.0rc1
3.3.0rc2
3.3.0rc3
3.3.1
3.3.1.dev1
3.3.1rc1
3.3.2
3.3.3
3.3.4
3.3.4rc1
3.4.0
3.4.0.dev1
3.4.0.dev2
3.4.0.dev3
3.4.0.dev4
3.4.0.dev5
3.4.0.dev6
3.4.0.dev7
3.4.0.dev8
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.4.3
3.5.0
3.5.0.dev1
3.5.0.dev3
3.5.0.dev4
3.5.0.dev5
3.5.0.dev6
3.5.0.dev7
3.5.0.dev8
3.5.0rc1
3.5.0rc2
3.5.1
3.5.2
3.6.0
3.6.0.dev1
3.6.0rc1
3.6.0rc2
3.6.1
3.6.2
3.6.3
3.6.3rc1
3.6.3rc2
3.7.0
3.7.0.dev1
3.7.0.dev2
3.7.0.dev3
3.7.0.dev4
3.7.0.dev5
3.7.0.dev6
3.7.0.dev7
3.7.0.dev8
3.7.0.dev9
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.7.3
3.7.3rc1
3.7.3rc2
3.8.0
3.8.0.dev1
3.8.0.dev2
3.8.0.dev3
3.8.0.dev4
3.8.0rc1
3.8.0rc2
3.8.1
Fixed in
3.8.2
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
3.7.0.dev9
pre
1 CVE
CVE-2026-21883
PYSEC-2026-1223
GHSA-793v-589g-574v
Jul 07, 2026
Bokeh server applications have Incomplete Origin Validation in WebSockets
Critical
Network
Low
None
This vulnerability allows for Cross-Site WebSocket Hijacking (CSWSH) of a deployed Bokeh server instance. ScopeThis vulnerability is only relevant to deployed Bokeh server instances. There is no impact on static HTML output, standalone embedded plots, or Jupyter notebook usage. This vulnerability does not prevent any requirements for up-front authentication on Bokeh servers that have authentication hooks in place, and cannot be used to make Bokeh servers deployed on private, internal networks accessible outside those networks. ImpactIf a Bokeh server is configured with an allowlist (e.g., Once connected, the attacker can interact with the Bokeh server on behalf of the victim, potentially accessing sensitive data, or modifying visualizations. PatchesPatched in versions 3.8.2 and later. WorkaroundsNone Technical descriptionThe Because the code only checks if the pattern is longer than the host (lines 232-233), but fails to check if the host is longer than the pattern, a host that starts with the pattern (but has additional segments) will successfully match. For example, if the allowlist is configured to
Affected versions
0.10.0
0.11.0
0.11.1
0.12.0
0.12.1
0.12.10
0.12.11
0.12.13
0.12.14
0.12.15
0.12.16
0.12.2
+ 232 more Show less
0.12.3
0.12.4
0.12.5
0.12.6
0.12.7
0.12.9
0.13.0
0.2
0.3
0.4
0.4.1
0.4.4
0.5.0
0.5.1
0.5.2
0.6.0
0.6.1
0.7.0
0.7.1
0.8.0
0.8.1
0.8.2
0.9.0
0.9.1
0.9.2
0.9.3
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.4
1.4.0
2.0.0
2.0.0rc1
2.0.0rc2
2.0.1
2.0.2
2.1.0
2.1.0rc1
2.1.0rc2
2.1.0rc3
2.1.1
2.2.0
2.2.0.dev4
2.2.0.dev6
2.2.0.dev7
2.2.0.dev8
2.2.0rc1
2.2.0rc2
2.2.0rc3
2.2.1
2.2.2
2.2.3
2.3.0
2.3.0.dev1
2.3.0.dev10
2.3.0.dev11
2.3.0.dev12
2.3.0.dev13
2.3.0.dev14
2.3.0.dev2
2.3.0.dev3
2.3.0.dev5
2.3.0.dev7
2.3.0.dev8
2.3.0.dev9
2.3.0rc2
2.3.0rc3
2.3.0rc4
2.3.1
2.3.1.dev1
2.3.1rc1
2.3.1rc2
2.3.2
2.3.2rc1
2.3.3
2.3.3rc1
2.4.0
2.4.0.dev1
2.4.0.dev2
2.4.0.dev4
2.4.0.dev5
2.4.0.dev6
2.4.0.dev7
2.4.0.dev8
2.4.0rc1
2.4.0rc2
2.4.0rc3
2.4.1
2.4.1rc1
2.4.2
2.4.2.dev1
2.4.2rc1
2.4.3
2.4.3.dev1
2.4.3.dev3
2.4.3.dev4
2.4.3rc1
3.0.0
3.0.0.dev1
3.0.0.dev10
3.0.0.dev11
3.0.0.dev13
3.0.0.dev14
3.0.0.dev15
3.0.0.dev16
3.0.0.dev17
3.0.0.dev18
3.0.0.dev19
3.0.0.dev2
3.0.0.dev20
3.0.0.dev3
3.0.0.dev4
3.0.0.dev5
3.0.0.dev6
3.0.0.dev7
3.0.0.dev8
3.0.0.dev9
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.0rc5
3.0.0rc6
3.0.1
3.0.1rc1
3.0.2
3.0.2rc1
3.0.3
3.0.3rc1
3.1.0
3.1.0.dev1
3.1.0.dev2
3.1.0.dev3
3.1.0.dev4
3.1.0.dev5
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.1
3.1.1rc1
3.2.0
3.2.0.dev1
3.2.0.dev2
3.2.0.dev3
3.2.0.dev4
3.2.0rc1
3.2.0rc2
3.2.0rc3
3.2.1
3.2.2
3.2.2rc1
3.3.0
3.3.0.dev1
3.3.0.dev2
3.3.0.dev3
3.3.0rc1
3.3.0rc2
3.3.0rc3
3.3.1
3.3.1.dev1
3.3.1rc1
3.3.2
3.3.3
3.3.4
3.3.4rc1
3.4.0
3.4.0.dev1
3.4.0.dev2
3.4.0.dev3
3.4.0.dev4
3.4.0.dev5
3.4.0.dev6
3.4.0.dev7
3.4.0.dev8
3.4.0rc1
3.4.0rc2
3.4.1
3.4.2
3.4.3
3.5.0
3.5.0.dev1
3.5.0.dev3
3.5.0.dev4
3.5.0.dev5
3.5.0.dev6
3.5.0.dev7
3.5.0.dev8
3.5.0rc1
3.5.0rc2
3.5.1
3.5.2
3.6.0
3.6.0.dev1
3.6.0rc1
3.6.0rc2
3.6.1
3.6.2
3.6.3
3.6.3rc1
3.6.3rc2
3.7.0
3.7.0.dev1
3.7.0.dev2
3.7.0.dev3
3.7.0.dev4
3.7.0.dev5
3.7.0.dev6
3.7.0.dev7
3.7.0.dev8
3.7.0.dev9
3.7.0rc1
3.7.0rc2
3.7.1
3.7.2
3.7.3
3.7.3rc1
3.7.3rc2
3.8.0
3.8.0.dev1
3.8.0.dev2
3.8.0.dev3
3.8.0.dev4
3.8.0rc1
3.8.0rc2
3.8.1
Fixed in
3.8.2
References
Updated Jul 07, 2026 · Source: OSV.dev |