Login Request a demo
PS
Vendor
Python Software Foundation
4 products with CVEs on record
71
CVEs
0
On KEV
6
New 30D
Products
CP
CPython
Python Software Foundation
9.4
67 CVEs0 on KEV6 new
PY
Python
Python Software Foundation
–
2 CVEs0 on KEV0 new
PA
Paramiko
Python Software Foundation
–
1 CVEs0 on KEV0 new
PY
pymanager
Python Software Foundation
7.8
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-103995
New
CP
CPython
Python Software Foundation
2.0
0%
Oct 27Lenient parsing of integers for response body and chunk framing
CVE-2026-115557
New
CP
CPython
Python Software Foundation
9.4
1%
Oct 24Distrust compromised intermediate certificates in ssl module
CVE-2026-114583
New
CP
CPython
Python Software Foundation
6.9
0%
Oct 22tar filter allows writing outside destination via empty-named symlink
CVE-2026-19553
CP
CPython
Python Software Foundation
7.6
1%
Sep 30SSLContext.wrap_bio() missing validation of server_hostname parameter
CVE-2026-19445
CP
CPython
Python Software Foundation
9.2
1%
Sep 30Use-after-free of a server-side SSLContext when sni_callback switches contexts
CVE-2026-12345
CP
CPython
Python Software Foundation
5.9
0%
Sep 29Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory
CVE-2026-82049
CP
CPython
Python Software Foundation
8.4
0%
Sep 14tarfile extraction filters allow file modification and content disclosure via hard link to symlink
CVE-2026-87910
CP
CPython
Python Software Foundation
5.7
1%
Sep 11tarfile hardlink fallback ignores custom extraction filter rejection via None
CVE-2026-15310
CP
CPython
Python Software Foundation
2.1
1%
Aug 25zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits
CVE-2026-19672
CP
CPython
Python Software Foundation
6.3
0%
Aug 19tarfile extraction filter bypass allows creation of directories outside the destination
CVE-2026-15806
CP
CPython
Python Software Foundation
6.0
1%
Aug 18`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching
CVE-2026-17084
CP
CPython
Python Software Foundation
6.0
1%
Aug 18stringprep.map_table_b2() deviates from RFC 3454 Table B.2
CVE-2026-18503
CP
CPython
Python Software Foundation
2.4
0%
Aug 10Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()
CVE-2026-6879
CP
CPython
Python Software Foundation
2.0
0%
Jul 28Quadratic Behavior in xml.etree.ElementPath Index Predicates
CVE-2026-15308
CP
CPython
Python Software Foundation
7.5
1%
Jul 9Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations
CVE-2026-4360
CP
CPython
Python Software Foundation
5.3
0%
Jun 30Tarfile.extract() doesn't fully respect filter parameter
CVE-2026-11972
CP
CPython
Python Software Foundation
8.2
1%
Jun 23tarfile opened in streaming mode mishandles EOF
CVE-2026-0864
CP
CPython
Python Software Foundation
5.5
0%
Jun 23Configuration Injection via Carriage Return (\r) in write() method
CVE-2026-11940
CP
CPython
Python Software Foundation
7.8
1%
Jun 23tarfile extraction filter bypass allows escaping the destination directory
CVE-2026-12003
CP
CPython
Python Software Foundation
5.3
0%
Jun 16CPython >3.11 Insecure Input Validation resulting in privilege escalation
CVE-2026-9669
CP
CPython
Python Software Foundation
8.2
0%
Jun 8bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow
CVE-2026-7774
CP
CPython
Python Software Foundation
6.9
1%
Jun 4tarfile.data_filter path traversal bypass allows writing outside the extraction directory
CVE-2026-3276
CP
CPython
Python Software Foundation
6.3
0%
Jun 3Potential DoS via quadratic complexity in unicodedata.normalize()
CVE-2026-8328
CP
CPython
Python Software Foundation
5.9
0%
May 13FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address
CVE-2026-7210
CP
CPython
Python Software Foundation
7.5
1%
May 11The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection
CVE-2026-3087
CP
CPython
Python Software Foundation
7.5
1%
Apr 27shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs
CVE-2026-6019
CP
CPython
Python Software Foundation
6.1
0%
Apr 22BaseCookie.js_output() does not neutralize embedded characters
CVE-2026-3298
CP
CPython
Python Software Foundation
8.8
0%
Apr 21Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes
CVE-2026-5713
CP
CPython
Python Software Foundation
5.3
0%
Apr 14Out-of-bounds read/write during remote profiling and asyncio process introspection when connecting to malicious target
CVE-2026-4786
CP
CPython
Python Software Foundation
7.1
0%
Apr 13Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()
CVE-2026-6100
CP
CPython
Python Software Foundation
8.1
1%
Apr 13Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure
CVE-2026-3446
CP
CPython
Python Software Foundation
6.0
0%
Apr 10Base64 decoding stops at first padded quad by default
CVE-2026-1502
CP
CPython
Python Software Foundation
5.7
1%
Apr 10HTTP client proxy tunnel headers not validated for CR/LF
CVE-2026-5271
PY
pymanager
Python Software Foundation
7.8
0%
Apr 1Possible to hijack modules in current working directory
CVE-2026-4519
CP
CPython
Python Software Foundation
3.3
0%
Mar 20webbrowser.open() allows leading dashes in URLs
CVE-2026-3479
CP
CPython
Python Software Foundation
0.0
0%
Mar 18pkgutil.get_data() does not enforce documented restrictions
CVE-2026-4224
CP
CPython
Python Software Foundation
7.5
1%
Mar 16Stack overflow parsing XML with deeply nested DTD content models
CVE-2026-3644
CP
CPython
Python Software Foundation
7.5
0%
Mar 16Incomplete control character validation in http.cookies
CVE-2025-13462
CP
CPython
Python Software Foundation
3.3
0%
Mar 12tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling
CVE-2026-2297
CP
CPython
Python Software Foundation
5.7
0%
Mar 4SourcelessFileLoader does not use io.open_code()
CVE-2026-1299
CP
CPython
Python Software Foundation
6.0
1%
Jan 23email BytesGenerator header injection due to unquoted newlines
CVE-2025-12781
CP
CPython
Python Software Foundation
5.3
1%
Jan 21base64.b64decode() always accepts "+/" characters, despite setting altchars
CVE-2026-0672
CP
CPython
Python Software Foundation
6.0
0%
Jan 20Header injection in http.cookies.Morsel
CVE-2025-15367
CP
CPython
Python Software Foundation
5.9
0%
Jan 20POP3 command injection in user-controlled commands
CVE-2025-15366
CP
CPython
Python Software Foundation
5.9
0%
Jan 20IMAP command injection in user-controlled commands
CVE-2025-15282
CP
CPython
Python Software Foundation
6.0
1%
Jan 20Header injection via newlines in data URL mediatype
CVE-2026-0865
CP
CPython
Python Software Foundation
5.9
1%
Jan 20wsgiref.headers.Headers allows header newline injection
CVE-2025-11468
CP
CPython
Python Software Foundation
5.7
1%
Jan 20Folding email comments of unfoldable characters doesn't preserve parenthesis
CVE-2025-12084
CP
CPython
Python Software Foundation
5.3
1%
Dec 3Quadratic complexity in node ID cache clearing
CVE-2025-13837
CP
CPython
Python Software Foundation
5.5
0%
Dec 1Out-of-memory when loading Plist
CVE-2025-13836
CP
CPython
Python Software Foundation
7.5
2%
Dec 1Excessive read buffering DoS in http.client
CVE-2025-6075
CP
CPython
Python Software Foundation
5.5
0%
Oct 31Quadratic complexity in os.path.expandvars() with user-controlled template
CVE-2025-8291
CP
CPython
Python Software Foundation
4.3
0%
Oct 7ZIP64 End of Central Directory (EOCD) Locator record offset not checked
CVE-2025-8194
CP
CPython
Python Software Foundation
7.5
1%
Jul 28Tarfile infinite loop during parsing with negative member offset
CVE-2025-6069
CP
CPython
Python Software Foundation
4.3
1%
Jun 17HTMLParser quadratic complexity when processing malformed inputs
CVE-2024-12718
CP
CPython
Python Software Foundation
5.3
1%
Jun 3Bypass extraction filter to modify file metadata outside extraction directory
CVE-2025-4435
CP
CPython
Python Software Foundation
7.5
1%
Jun 3Tarfile extracts filtered members when errorlevel=0
CVE-2025-4138
CP
CPython
Python Software Foundation
7.5
1%
Jun 3Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory
CVE-2025-4330
CP
CPython
Python Software Foundation
7.5
1%
Jun 3Extraction filter bypass for linking outside extraction directory
CVE-2025-4517
CP
CPython
Python Software Foundation
9.4
1%
Jun 3Arbitrary writes via tarfile realpath overflow