| CVE-2026-116566 |
socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be…
|
5.3
Moyenne
|
29 oct. 2026 |
| CVE-2026-103995 |
Lenient parsing of integers for response body and chunk framing
|
2.0
Faible
|
27 oct. 2026 |
| CVE-2026-115557 |
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without…
|
9.4
Critique
|
24 oct. 2026 |
| CVE-2026-114583 |
tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like…
|
6.9
Moyenne
|
22 oct. 2026 |
| CVE-2026-19553 |
ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname…
|
7.6
Élevée
|
30 sept. 2026 |
| CVE-2026-19445 |
A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns…
|
9.2
Critique
|
30 sept. 2026 |
| CVE-2026-12345 |
The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition
|
5.9
Moyenne
|
29 sept. 2026 |
| CVE-2026-82049 |
In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives…
|
8.4
Élevée
|
14 sept. 2026 |
| CVE-2026-87910 |
When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the…
|
5.7
Moyenne
|
11 sept. 2026 |
| CVE-2026-15310 |
When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an…
|
2.1
Faible
|
25 août 2026 |
| CVE-2026-19672 |
The tarfile module's tar and data extraction filters created directories outside the destination for members whose…
|
6.3
Moyenne
|
19 août 2026 |
| CVE-2026-15806 |
The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and…
|
6.0
Moyenne
|
18 août 2026 |
| CVE-2026-17084 |
The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode…
|
6.0
Moyenne
|
18 août 2026 |
| CVE-2026-18503 |
Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume…
|
2.4
Faible
|
10 août 2026 |
| CVE-2026-6879 |
`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index…
|
2.0
Faible
|
28 juil. 2026 |
| CVE-2026-15308 |
The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated…
|
8.7
Élevée
|
9 juil. 2026 |
| CVE-2026-4360 |
In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks
|
2.0
Faible
|
30 juin 2026 |
| CVE-2026-11972 |
When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly…
|
8.2
Élevée
|
23 juin 2026 |
| CVE-2026-0864 |
When using the "configparser" module to write configuration files containing multi-line text values with carriage return…
|
4.1
Moyenne
|
23 juin 2026 |
| CVE-2026-11940 |
tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink …
|
7.8
Élevée
|
23 juin 2026 |
| CVE-2026-12003 |
To allow builds of Python to be run from an in-tree layout (rather than an installed file layout), the VPATH variable is…
|
5.3
Moyenne
|
16 juin 2026 |
| CVE-2026-9669 |
bz2.BZ2Decompressor objects could be reused after a decompression error
|
8.2
Élevée
|
8 juin 2026 |
| CVE-2026-7774 |
tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names,…
|
6.9
Moyenne
|
4 juin 2026 |
| CVE-2026-3276 |
unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs…
|
6.3
Moyenne
|
3 juin 2026 |
| CVE-2026-8328 |
The ftpcp() function in Lib/ftplib.py was not updated when
CVE-2021-4189 was fixed
|
5.9
Moyenne
|
13 mai 2026 |