CP
Product
CPython
35
CVEs
0
On KEV
9.4
Max CVSS
6
New 30D
Severity mix
Critical 2High 12Medium 16Low 5
Watch
Add CPython to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-3298 | 8.8 | Apr 21 | Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes Affected: before 3.11.16; 3.12.0 before 3.12.14; 3.13.0 before 3.13.14; 3.14.0a1 before 3.14.5rc1; 3.15.0a1 before 3.15.0b1 |
| CVE-2026-82049 | 8.4 | Sep 14 | tarfile extraction filters allow file modification and content disclosure via hard link to symlink Affected: before 3.10.22; 3.11.0 before 3.11.17; 3.12.0 before 3.12.15; 3.13.0 before 3.13.16; 3.14.0a1 before 3.14.0b1 |
| CVE-2026-11972 | 8.2 | Jun 23 | tarfile opened in streaming mode mishandles EOF Affected: before 3.10.21; 3.11.0 before 3.11.16; 3.12.0 before 3.12.14; 3.13.0 before 3.13.15; 3.14.0 before 3.14.7; 3.15.0a1 before 3.15.0b4 |
| CVE-2026-9669 | 8.2 | Jun 8 | bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow Affected: before 3.10.21; 3.11.0 before 3.11.16; 3.12.0 before 3.12.14; 3.13.0 before 3.13.14; 3.14.0 before 3.14.6; 3.15.0a1 before 3.15.0b3 |
| CVE-2026-6100 | 8.1 | Apr 13 | Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure Affected: before 3.10.21; 3.11.0 before 3.11.16; 3.12.0 before 3.12.14; 3.13.0 before 3.13.14; 3.14.0a1 before 3.14.5rc1; 3.15.0a1 before 3.15.0b1 |
| CVE-2026-11940 | 7.8 | Jun 23 | tarfile extraction filter bypass allows escaping the destination directory Affected: before 3.10.21; 3.11.0 before 3.11.16; 3.12.0 before 3.12.14; 3.13.0 before 3.13.15; 3.14.0 before 3.14.7; 3.15.0a1 before 3.15.0b4 |
| CVE-2026-19553 | 7.6 | Sep 30 | SSLContext.wrap_bio() missing validation of server_hostname parameter Affected: before 3.10.22; 3.11.0 before 3.11.17; 3.12.0 before 3.12.15; 3.13.0 before 3.13.16; 3.14.0 before 3.14.8; 3.15.0a1 before 3.15.0rc3 |
| CVE-2026-15308 | 7.5 | Jul 9 | Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations Affected: before 3.10.21; 3.11.0 before 3.11.16; 3.12.0 before 3.12.14; 3.13.0 before 3.13.15; 3.14.0 before 3.14.7; 3.15.0a1 before 3.15.0b4 |
| CVE-2026-7210 | 7.5 | May 11 | The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection Affected: before 3.10.22; 3.11.0 before 3.11.16; 3.12.0 before 3.12.14; 3.13.0 before 3.13.14; 3.14.0 before 3.14.6; 3.15.0a1 before 3.15.0b2 |
| CVE-2026-3087 | 7.5 | Apr 27 | shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs Affected: before 3.10.21; 3.11.0 before 3.11.16; 3.12.0 before 3.12.14; 3.13.0 before 3.13.14; 3.14.0a1 before 3.14.5rc1; 3.15.0a1 before 3.15.0b1 |
| CVE-2024-6232 | 7.5 | Sep 3 | Regular-expression DoS when parsing TarFile headers Affected: before 3.8.20; 3.9.0 before 3.9.20; 3.10.0 before 3.10.15; 3.11.0 before 3.11.10; 3.12.0 before 3.12.6; 3.13.0a1 before 3.13.0rc2 |
| CVE-2026-4786 | 7.1 | Apr 13 | Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open() Affected: before 3.10.21; 3.11.0 before 3.11.16; 3.12.0 before 3.12.14; 3.13.0 before 3.13.14; 3.14.0a1 before 3.14.5rc1; 3.15.0a1 before 3.15.0b1 |
Showing 12