PY
Product
python
140
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 17High 42Medium 34Low 3
Watch
Add python to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-48565 | 9.8 | Aug 22 | An XML External Entity (XXE) issue was discovered in Python through 3.9.1 Affected: before 3.6.13; 3.7.0 before 3.7.10; 3.8.0 before 3.8.7; 3.9.0 before 3.9.1 |
| CVE-2022-37454 | 9.8 | Oct 21 | The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate… Affected: 3.6.0 before 3.7.16; 3.8.0 before 3.8.16; 3.9.0 before 3.9.16; 3.10.0 before 3.10.9 |
| CVE-2021-29921 | 9.8 | May 6 | In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string Affected: 3.8.0 before 3.8.12; 3.9.0 before 3.9.5 |
| CVE-2021-3177 | 9.8 | Jan 19 | Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept… Affected: 3.6.0 through 3.6.12; 3.7.0 through 3.7.9; 3.8.0 through 3.8.7; 3.9.0 through 3.9.1 |
| CVE-2020-27619 | 9.8 | Oct 22 | In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP Affected: 3.0.0 before 3.6.13; 3.7.0 before 3.7.10; 3.8.0 before 3.8.7; 3.9.0 before 3.9.1 |
| CVE-2020-15801 | 9.8 | Jul 17 | In Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations Affected: 3.7.0 before 3.7.9; 3.8.0 before 3.8.5 |
| CVE-2014-4650 | 9.8 | Feb 20 | The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script… Affected: 2.7.0 before 2.7.8; 3.2.0 before 3.2.6; 3.3.0 before 3.3.6; 3.4.0 before 3.4.2 |
| CVE-2019-12900 | 9.8 | Jun 19 | BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors Affected: 3.7.0 before 3.7.13; 3.8.0 before 3.8.13; 3.9.0 before 3.9.11; 3.10.0 before 3.10.3 |
| CVE-2019-10160 | 9.8 | Jun 7 | A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4… Affected: affects 2.7, 3.5, 3.6, 3.7, >= v3.8.0a4 and < v3.8.0b1 |
| CVE-2019-9636 | 9.8 | Mar 8 | Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization Affected: 2.7.0 before 2.7.17; 3.0.0 before 3.4.10; 3.5.0 before 3.5.7; 3.6.0 before 3.6.9; 3.7.0 before 3.7.3 |
| CVE-2018-1000802 | 9.8 | Sep 18 | Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in… Affected: 2.7.0 before 2.7.16 |
| CVE-2016-9063 | 9.8 | Jun 11 | An integer overflow during the parsing of XML using the Expat library Affected: 2.7.0 before 2.7.15; 3.3.0 before 3.3.7; 3.4.0 before 3.4.7; 3.5.0 before 3.5.4; 3.6.0 before 3.6.2 |
| CVE-2017-1000158 | 9.8 | Nov 17 | CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and… Affected: before 2.7.15; 3.4.0 before 3.4.8; 3.5.0 before 3.5.5 |
| CVE-2016-5636 | 9.8 | Sep 2 | Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 allows remote attackers to have… Affected: 3.0; 3.0.1; 3.1.0; 3.1.1; 3.1.2; 3.1.3; +24 more |
| CVE-2016-0718 | 9.8 | May 26 | Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow Affected: 2.7.0 before 2.7.15; 3.3.0 before 3.3.7; 3.4.0 before 3.4.7; 3.5.0 before 3.5.4; 3.6.0 before 3.6.2 |
| CVE-2007-4559 | 9.8 | Aug 28 | Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary… Affected: before 3.6.16; 3.7.0 before 3.8.17; 3.9.0 before 3.9.17; 3.10.0 before 3.10.12; 3.11.0 before 3.11.4 |
| CVE-2019-9948 | 9.1 | Mar 23 | urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as… Affected: 2.0 before 2.7.17; 3.5.0 before 3.5.8; 3.6.0 before 3.6.9; 3.7.0 before 3.7.4 |
Showing 17