| CVE-2025-13836 |
When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use…
|
6.3
Medium
|
Dec 1, 2025 |
| CVE-2025-6075 |
If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding…
|
1.8
Low
|
Oct 31, 2025 |
| CVE-2025-8291 |
The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset…
|
4.3
Medium
|
Oct 7, 2025 |
| CVE-2025-8194 |
There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs
|
7.5
High
|
Jul 28, 2025 |
| CVE-2025-6069 |
The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs…
|
4.3
Medium
|
Jun 17, 2025 |
| CVE-2024-12718 |
Allows modifying some file metadata (e.g
|
5.3
Medium
|
Jun 3, 2025 |
| CVE-2025-4435 |
When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any filtered members…
|
7.5
High
|
Jun 3, 2025 |
| CVE-2025-4138 |
Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the…
|
7.5
High
|
Jun 3, 2025 |
| CVE-2025-4330 |
Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the…
|
7.5
High
|
Jun 3, 2025 |
| CVE-2025-4517 |
Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data"
|
9.4
Critical
|
Jun 3, 2025 |
| CVE-2025-4516 |
There is an issue in CPython when using `bytes.decode("unicode_escape", error="ignore|replace")`
|
5.9
Medium
|
May 15, 2025 |
| CVE-2025-1795 |
During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded…
|
2.3
Low
|
Feb 28, 2025 |
| CVE-2024-3220 |
There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of known file…
|
2.3
Low
|
Feb 14, 2025 |
| CVE-2025-0938 |
The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included…
|
6.3
Medium
|
Jan 31, 2025 |
| CVE-2024-12254 |
Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and…
|
8.7
High
|
Dec 6, 2024 |
| CVE-2024-11168 |
The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that…
|
6.3
Medium
|
Nov 12, 2024 |
| CVE-2024-9287 |
A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual…
|
5.3
Medium
|
Oct 22, 2024 |
| CVE-2024-6232 |
There is a MEDIUM severity vulnerability affecting CPython
|
7.5
High
|
Sep 3, 2024 |
| CVE-2024-8088 |
There is a HIGH severity vulnerability affecting the CPython "zipfile"
module affecting "zipfile.Path"
|
8.7
High
|
Aug 22, 2024 |
| CVE-2024-7592 |
There is a LOW severity vulnerability affecting CPython, specifically the
'http.cookies' standard library module
|
7.5
High
|
Aug 19, 2024 |
| CVE-2024-6923 |
There is a MEDIUM severity vulnerability affecting CPython
|
5.5
Medium
|
Aug 1, 2024 |
| CVE-2024-3219 |
The “socket” module provides a pure-Python fallback to the socket.socketpair() function for platforms that don’t…
|
5.1
Medium
|
Jul 29, 2024 |
| CVE-2024-5642 |
CPython 3.9 and earlier doesn't disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols() which is an…
|
6.5
Medium
|
Jun 27, 2024 |
| CVE-2024-0397 |
A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext…
|
7.4
High
|
Jun 17, 2024 |
| CVE-2024-4032 |
The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated…
|
7.5
High
|
Jun 17, 2024 |