PY
Product
python
140
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 17High 42Medium 34Low 3
Watch
Add python to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-1000117 | 6.7 | Mar 7 | Python Software Foundation CPython version From 3.2 until 3.6.4 on Windows contains a Buffer Overflow vulnerability in os.symlink() function on Windows that can result in… Affected: 3.2.0 before 3.4.9; 3.5.0 before 3.5.6; 3.6.0 before 3.6.5; 3.7.0; 3.7.0; 3.7.0; +2 more |
| CVE-2022-48564 | 6.5 | Aug 22 | read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary… Affected: before 3.6.13; 3.7.0 before 3.7.10; 3.8.0 before 3.8.7; 3.9.0 before 3.9.1 |
| CVE-2021-3733 | 6.5 | Mar 7 | There's a flaw in urllib's AbstractBasicAuthHandler class Affected: before 3.6.14; 3.7.0 before 3.7.11; 3.8.0 before 3.8.10; 3.9.0 before 3.9.5; 3.10.0 |
| CVE-2020-8492 | 6.5 | Jan 30 | Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service… Affected: 2.7.0 through 2.7.17; 3.5.0 through 3.5.9; 3.6.0 through 3.6.10; 3.7.0 through 3.7.6; 3.8.0 through 3.8.1 |
| CVE-2017-18207 | 6.5 | Mar 1 | The Wave_read._read_fmt_chunk function in Lib/wave.py in Python through 3.6.4 does not ensure a nonzero channel value, which allows attackers to cause a denial of service… Affected: through 3.6.4 |
| CVE-2016-0772 | 6.5 | Sep 2 | The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an error when StartTLS fails, which might allow… Affected: 3.5.0; 3.5.1; 3.0; 3.0.1; 3.1.0; 3.1.1; +24 more |
| CVE-2016-3189 | 6.5 | Jun 30 | Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to… Affected: 3.7.0 before 3.7.13; 3.8.0 before 3.8.13; 3.9.0 before 3.9.11; 3.10.0 before 3.10.3 |
| CVE-2026-6019 | 6.1 | Apr 22 | BaseCookie.js_output() does not neutralize embedded characters Affected: before 3.13.14; 3.14.0 through 3.14.4; 3.15.0; 3.15.0; 3.15.0; 3.15.0; +4 more |
| CVE-2016-1000110 | 6.1 | Nov 27 | The CGIHandler class in Python before 2.7.12 does not protect against the HTTP_PROXY variable name clash in a CGI script, which could allow a remote attacker to redirect HTTP… Affected: 2.7.0 before 2.7.13; 3.3.0 before 3.3.7; 3.4.0 before 3.4.6; 3.5.0 before 3.5.3 |
| CVE-2019-18348 | 6.1 | Oct 23 | An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0 Affected: 2.0 through 2.7.17; 3.0 before 3.5.10; 3.6.0 before 3.6.11; 3.7.0 before 3.7.8; 3.8.0 before 3.8.3 |
| CVE-2019-16935 | 6.1 | Sep 28 | The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field Affected: 2.7.0 before 2.7.17; 3.0.0 before 3.5.8; 3.6.0 before 3.6.10; 3.7.0 before 3.7.5 |
| CVE-2019-9947 | 6.1 | Mar 23 | An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3 Affected: 2.7.0 before 2.7.17; 3.5.0 before 3.5.8; 3.6.0 before 3.6.9; 3.7.0 before 3.7.4 |
| CVE-2019-9740 | 6.1 | Mar 13 | An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3 Affected: 2.0 before 2.7.17; 3.5.0 before 3.5.8; 3.6.0 before 3.6.9; 3.7.0 before 3.7.4 |
| CVE-2016-5699 | 6.1 | Sep 2 | CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) before 2.7.10 and 3.x before 3.4.4 allows remote attackers to… Affected: through 2.7.9; 3.0; 3.0.1; 3.1.0; 3.1.1; 3.1.2; +21 more |
| CVE-2022-48566 | 5.9 | Aug 22 | An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1 Affected: before 3.6.13; 3.7.0 before 3.7.10; 3.8.0 before 3.8.7; 3.9.0 before 3.9.1 |
| CVE-2021-23336 | 5.9 | Feb 15 | Web Cache Poisoning Affected: before 3.6.13; 3.7.0 before 3.7.10; 3.8.0 before 3.8.8; 3.9.0 before 3.9.2 |
| CVE-2020-14422 | 5.9 | Jun 18 | Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of… Affected: 3.0.0 before 3.5.10; 3.6.0 before 3.6.12; 3.7.0 before 3.7.9; 3.8.0 before 3.8.4 |
| CVE-2014-4616 | 5.9 | Aug 24 | Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process… Affected: 2.7.0 before 2.7.7; 3.0.0 before 3.2.6; 3.3.0 before 3.3.6; 3.4.0 before 3.4.1 |
| CVE-2013-7440 | 5.9 | Jun 7 | The ssl.match_hostname function in CPython (aka Python) before 2.7.9 and 3.x before 3.3.3 does not properly handle wildcards in hostnames, which might allow man-in-the-middle… Affected: through 2.7.8; 3.0; 3.0.1; 3.1; 3.1.1; 3.1.2; +20 more |
| CVE-2021-3426 | 5.7 | May 20 | There's a flaw in Python 3's pydoc Affected: before 2.7.18; 3.6.0 before 3.6.13; 3.7.0 before 3.7.10; 3.8.0 before 3.8.8; 3.9.0 before 3.9.3; 3.10.0; +5 more |
| CVE-2026-0864 | 5.5 | Jun 23 | Configuration Injection via Carriage Return (\r) in write() method Affected: before 3.10.21; 3.11.0 before 3.11.16; 3.12.0 before 3.12.14; 3.13.0 before 3.13.15; 3.14.0 before 3.14.7; 3.15.0; +10 more |
| CVE-2025-13837 | 5.5 | Dec 1 | When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues Affected: before 3.13.10; 3.14.0 before 3.14.1; 3.15.0; 3.15.0 |
| CVE-2025-6075 | 5.5 | Oct 31 | If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables Affected: before 3.9.0; 3.13.1 before 3.13.11; 3.14.0 before 3.14.1; 3.15.0 |
| CVE-2023-33595 | 5.5 | Jun 7 | CPython v3.12.0 alpha 7 was discovered to contain a heap use-after-free via the function ascii_decode at /Objects/unicodeobject.c Affected: 3.12.0 |
| CVE-2020-8315 | 5.5 | Jan 28 | In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load upon launch on Windows 7 may result in an attacker's copy of… Affected: 3.6.0 through 3.6.10; 3.7.0 through 3.7.6; 3.8.0 through 3.8.1 |
| CVE-2026-4360 | 5.3 | Jun 30 | Tarfile.extract() doesn't fully respect filter parameter Affected: before 3.1.5 |
| CVE-2025-12781 | 5.3 | Jan 21 | When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the… Affected: before 3.13.10; 3.14.0 before 3.14.1; 3.15.0 |
| CVE-2025-12084 | 5.3 | Dec 3 | When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic Affected: before 3.13.11; 3.14.0 before 3.14.2; 3.15.0; 3.15.0 |
| CVE-2023-40217 | 5.3 | Aug 25 | An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5 Affected: before 3.8.18; 3.9.0 before 3.9.18; 3.10.0 before 3.10.13; 3.11.0 before 3.11.5 |
| CVE-2023-38898 | 5.3 | Aug 15 | An issue in Python cpython v.3.7 allows an attacker to obtain sensitive information via the _asyncio._swap_current_task component Affected: 3.13.0 |
| CVE-2023-27043 | 5.3 | Apr 19 | The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character Affected: through 2.7.18; 3.0 before 3.8.20; 3.9.0 before 3.9.20; 3.10.0 before 3.10.15; 3.11.0 before 3.11.10; 3.12.0 before 3.12.6 |
| CVE-2021-4189 | 5.3 | Aug 24 | A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode Affected: 3.6.0 before 3.6.14; 3.7.0 before 3.7.11; 3.8.0 before 3.8.9; 3.9.0 before 3.9.3; 3.10.0 |
| CVE-2023-6507 | 4.9 | Dec 8 | An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms Affected: 3.12.0; 3.13.0; 3.13.0 |
| CVE-2018-20852 | 4.3 | Jul 13 | http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing… Affected: 2.0 through 2.7.16; 3.0.0 before 3.4.10; 3.5.0 before 3.5.7; 3.6.0 before 3.6.9; 3.7.0 before 3.7.3 |
Showing 34