| CVE-2026-116566 |
socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be…
|
5.3
Medium
|
Oct 29, 2026 |
| CVE-2026-103995 |
Lenient parsing of integers for response body and chunk framing
|
2.0
Low
|
Oct 27, 2026 |
| CVE-2026-115557 |
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without…
|
9.4
Critical
|
Oct 24, 2026 |
| CVE-2026-114583 |
tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like…
|
6.9
Medium
|
Oct 22, 2026 |
| CVE-2026-19553 |
ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname…
|
7.6
High
|
Sep 30, 2026 |
| CVE-2026-19445 |
A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns…
|
9.2
Critical
|
Sep 30, 2026 |
| CVE-2026-12345 |
The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition
|
5.9
Medium
|
Sep 29, 2026 |
| CVE-2026-82049 |
In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives…
|
8.4
High
|
Sep 14, 2026 |
| CVE-2026-87910 |
When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the…
|
5.7
Medium
|
Sep 11, 2026 |
| CVE-2026-15310 |
When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an…
|
2.1
Low
|
Aug 25, 2026 |
| CVE-2026-19672 |
The tarfile module's tar and data extraction filters created directories outside the destination for members whose…
|
6.3
Medium
|
Aug 19, 2026 |
| CVE-2026-15806 |
The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and…
|
6.0
Medium
|
Aug 18, 2026 |
| CVE-2026-17084 |
The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode…
|
6.0
Medium
|
Aug 18, 2026 |
| CVE-2026-18503 |
Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume…
|
2.4
Low
|
Aug 10, 2026 |
| CVE-2026-6879 |
`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index…
|
2.0
Low
|
Jul 28, 2026 |
| CVE-2026-15308 |
The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated…
|
8.7
High
|
Jul 9, 2026 |
| CVE-2026-4360 |
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks
|
2.0
Low
|
Jun 30, 2026 |
| CVE-2026-11972 |
When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly…
|
8.2
High
|
Jun 23, 2026 |
| CVE-2026-0864 |
When using the "configparser" module to write configuration files containing multi-line text values with carriage return…
|
4.1
Medium
|
Jun 23, 2026 |
| CVE-2026-11940 |
tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink …
|
7.8
High
|
Jun 23, 2026 |
| CVE-2026-12003 |
To allow builds of Python to be run from an in-tree layout (rather than an installed file layout), the VPATH variable is…
|
5.3
Medium
|
Jun 16, 2026 |
| CVE-2026-9669 |
bz2.BZ2Decompressor objects could be reused after a decompression error
|
8.2
High
|
Jun 8, 2026 |
| CVE-2026-7774 |
tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names,…
|
6.9
Medium
|
Jun 4, 2026 |
| CVE-2026-3276 |
unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs…
|
6.3
Medium
|
Jun 3, 2026 |
| CVE-2026-8328 |
The ftpcp() function in Lib/ftplib.py was not updated when
CVE-2021-4189 was fixed
|
5.9
Medium
|
May 13, 2026 |