| CVE-2026-7210 |
`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which…
|
6.3
Medium
|
May 11, 2026 |
| CVE-2026-3087 |
If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then…
|
6.0
Medium
|
Apr 27, 2026 |
| CVE-2026-6019 |
http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context
|
2.1
Low
|
Apr 22, 2026 |
| CVE-2026-3298 |
The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the…
|
8.8
High
|
Apr 21, 2026 |
| CVE-2026-5713 |
The "profiling.sampling" module (Python 3.15+) and "asyncio introspection capabilities" (3.14+, "python -m asyncio ps"…
|
5.3
Medium
|
Apr 14, 2026 |
| CVE-2026-4786 |
Mitgation of CVE-2026-4519 was incomplete
|
7.0
High
|
Apr 13, 2026 |
| CVE-2026-6100 |
Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a…
|
9.1
Critical
|
Apr 13, 2026 |
| CVE-2026-3446 |
When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded…
|
6.0
Medium
|
Apr 10, 2026 |
| CVE-2026-1502 |
CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host
|
5.7
Medium
|
Apr 10, 2026 |
| CVE-2026-4519 |
The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for…
|
7.0
High
|
Mar 20, 2026 |
| CVE-2026-3479 |
DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same…
|
0.0
Not rated
|
Mar 18, 2026 |
| CVE-2026-4224 |
When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a…
|
6.0
Medium
|
Mar 16, 2026 |
| CVE-2026-3644 |
The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete
|
6.0
Medium
|
Mar 16, 2026 |
| CVE-2025-13462 |
The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a…
|
2.0
Low
|
Mar 12, 2026 |
| CVE-2026-2297 |
The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader…
|
5.7
Medium
|
Mar 4, 2026 |
| CVE-2026-1299 |
The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when …
|
6.0
Medium
|
Jan 23, 2026 |
| CVE-2025-12781 |
When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the…
|
6.3
Medium
|
Jan 21, 2026 |
| CVE-2026-0672 |
When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into…
|
6.0
Medium
|
Jan 20, 2026 |
| CVE-2025-15367 |
The poplib module, when passed a user-controlled command, can have
additional commands injected using newlines
|
5.9
Medium
|
Jan 20, 2026 |
| CVE-2025-15366 |
The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines
|
5.9
Medium
|
Jan 20, 2026 |
| CVE-2025-15282 |
User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data…
|
6.0
Medium
|
Jan 20, 2026 |
| CVE-2026-0865 |
User-controlled header names and values containing newlines can allow injecting HTTP headers
|
5.9
Medium
|
Jan 20, 2026 |
| CVE-2025-11468 |
When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not…
|
5.7
Medium
|
Jan 20, 2026 |
| CVE-2025-12084 |
When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on…
|
6.3
Medium
|
Dec 3, 2025 |
| CVE-2025-13837 |
When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file…
|
2.1
Low
|
Dec 1, 2025 |