bokeh vulnerabilities

Products

• bokeh 1

Latest bokeh CVEs

Newest publication first

1. CVE-2026-21883 Bokeh server applications have Incomplete Origin Validation in WebSockets

   Published 2026-01-08

   Medium·CVSS 4.5 EPSS 0.18%

   Bokeh is an interactive visualization library written in Python. In versions 3.8.1 and below, if a server is configured with an allowlist (e.g., dashboard.corp), an attacker can register a domain like dashboard.corp.attacker.com (or use a subdomain if applicable) and lure a victi...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.