CP
Product
CPython
67
CVEs
0
On KEV
9.4
Max CVSS
6
New 30D
Severity mix
Critical 3High 21Medium 33Low 9
Watch
Add CPython to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-12003 | 5.3 | Jun 16 | CPython >3.11 Insecure Input Validation resulting in privilege escalation Affected: before 3.11.16; 3.12.0 before 3.12.14; 3.13.0 before 3.13.15; 3.14.0 before 3.14.7; 3.15.0a1 before 3.15.0b3 |
| CVE-2026-5713 | 5.3 | Apr 14 | Out-of-bounds read/write during remote profiling and asyncio process introspection when connecting to malicious target Affected: before 3.14.5; 3.15.0a1 before 3.15.0b1 |
| CVE-2025-12781 | 5.3 | Jan 21 | base64.b64decode() always accepts "+/" characters, despite setting altchars Affected: before 3.13.10; 3.14.0 before 3.14.1; 3.15.0a1 before 3.15.0a2 |
| CVE-2025-12084 | 5.3 | Dec 3 | Quadratic complexity in node ID cache clearing Affected: before 3.10.20; 3.11.0 before 3.11.15; 3.12.0 before 3.12.13; 3.13.0 before 3.13.11; 3.14.0 before 3.14.2; 3.15.0a1 before 3.15.0a3 |
| CVE-2024-12718 | 5.3 | Jun 3 | Bypass extraction filter to modify file metadata outside extraction directory Affected: before 3.9.23; 3.10.0 before 3.10.18; 3.11.0 before 3.11.13; 3.12.0 before 3.12.11; 3.13.0 before 3.13.4; 3.14.0a1 before 3.14.0b3 |
| CVE-2025-8291 | 4.3 | Oct 7 | ZIP64 End of Central Directory (EOCD) Locator record offset not checked Affected: before 3.9.24; 3.10.0 before 3.10.19; 3.11.0 before 3.11.14; 3.12.0 before 3.12.12; 3.13.0 before 3.13.10; 3.14.0 before 3.14.1 |
| CVE-2025-6069 | 4.3 | Jun 17 | HTMLParser quadratic complexity when processing malformed inputs Affected: before 3.9.24; 3.10.0 before 3.10.19; 3.11.0 before 3.11.14; 3.12.0 before 3.12.12; 3.13.0 before 3.13.6; 3.14.0a1 before 3.14.0b3 |
| CVE-2024-11168 | 3.7 | Nov 12 | Improper validation of IPv6 and IPvFuture addresses Affected: before 3.9.21; 3.10.0 before 3.10.16; 3.11.0 before 3.11.4; 3.12.0a1 before 3.12.0b1 |
| CVE-2026-4519 | 3.3 | Mar 20 | webbrowser.open() allows leading dashes in URLs Affected: before 3.10.21; 3.11.0 before 3.11.16; 3.12.0 before 3.12.14; 3.13.0 before 3.13.13; 3.14.0 before 3.14.4; 3.15.0a1 before 3.15.0a8 |
| CVE-2025-13462 | 3.3 | Mar 12 | tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling Affected: before 3.10.21; 3.11.0 before 3.11.16; 3.12.0 before 3.12.14; 3.13.0 before 3.13.13; 3.14.0 before 3.14.4; 3.15.0a1 before 3.15.0a8 |
| CVE-2026-18503 | 2.4 | Aug 10 | Super-linear CPU usage for unbounded input to csv.Sniffer.sniff() Affected: before 3.10.21; 3.11.0 before 3.11.16; 3.12.0 before 3.12.14; 3.13.0 before 3.13.15; 3.14.0 before 3.14.7; 3.15.0a1 before 3.15.0rc1; +1 more |
| CVE-2025-1795 | 2.3 | Feb 28 | Mishandling of comma during folding and unicode-encoding of email headers Affected: before 3.9.23; 3.10.0 before 3.10.17; 3.11.0 before 3.11.9; 3.12.0 before 3.12.3; 3.13.0a1 before 3.13.0a5 |
| CVE-2024-3220 | 2.3 | Feb 14 | Default mimetype known files writeable on Windows Affected: before 3.11.18; 3.12.0 before 3.12.16; 3.13.0 before 3.13.18; 3.14.0 before 3.14.9; 3.15.0 before 3.15.1; 3.16.0a1 before 3.16.0 |
| CVE-2026-15310 | 2.1 | Aug 25 | zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits Affected: before 3.10.22; 3.11.0 before 3.11.17; 3.12.0 before 3.12.15; 3.13.0 before 3.13.16; 3.14.0 before 3.14.8; 3.15.0a1 before 3.15.0rc2 |
| CVE-2026-103995 New | 2.0 | Oct 27 | Lenient parsing of integers for response body and chunk framing Affected: before 3.16.0 |
| CVE-2026-6879 | 2.0 | Jul 28 | Quadratic Behavior in xml.etree.ElementPath Index Predicates Affected: before 3.10.21; 3.11.0 before 3.11.16; 3.12.0 before 3.12.14; 3.13.0 before 3.13.15; 3.14.0 before 3.14.7; 3.15.0a1 before 3.15.0rc1 |
| CVE-2026-3479 | 0.0 | Mar 18 | pkgutil.get_data() does not enforce documented restrictions Affected: before 3.13.13; 3.14.0 before 3.14.4; 3.15.0a1 before 3.15.0a8 |