https://vulnogram.org/ Most recent CVEs assigned by Python Software Foundation (psf). https://vulnogram.org/seaview/icons/psf.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-19553 https://vulnogram.org/CVE-2026-19553 ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter check in SSLObject, if the server_hostname argument isn't supplied then hostname verification wo… High Network Exploitable Wed, 30 Sep 2026 16:17:39 GMT https://vulnogram.org/CVE-2026-19445 https://vulnogram.org/CVE-2026-19445 A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the… Critical Network Exploitable Wed, 30 Sep 2026 16:16:04 GMT https://vulnogram.org/CVE-2026-12345 https://vulnogram.org/CVE-2026-12345 The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have thei… Medium Tue, 29 Sep 2026 17:46:01 GMT https://vulnogram.org/CVE-2026-82049 https://vulnogram.org/CVE-2026-82049 In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a fil… High Mon, 14 Sep 2026 19:14:03 GMT https://vulnogram.org/CVE-2026-87910 https://vulnogram.org/CVE-2026-87910 When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the l… Medium Fri, 11 Sep 2026 17:27:04 GMT https://vulnogram.org/CVE-2026-15310 https://vulnogram.org/CVE-2026-15310 When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion. Low Network Exploitable Tue, 25 Aug 2026 15:07:58 GMT https://vulnogram.org/CVE-2026-19672 https://vulnogram.org/CVE-2026-19672 The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but inte… Medium Network Exploitable Wed, 19 Aug 2026 15:24:08 GMT https://vulnogram.org/CVE-2026-15806 https://vulnogram.org/CVE-2026-15806 The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Cre… Medium Network Exploitable Tue, 18 Aug 2026 15:50:57 GMT https://vulnogram.org/CVE-2026-17084 https://vulnogram.org/CVE-2026-17084 The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names u… Medium Network Exploitable Tue, 18 Aug 2026 13:57:31 GMT https://vulnogram.org/CVE-2026-18503 https://vulnogram.org/CVE-2026-18503 Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff(). Low Mon, 10 Aug 2026 13:45:31 GMT https://vulnogram.org/CVE-2026-13346 https://vulnogram.org/CVE-2026-13346 pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious pack… Medium Wed, 29 Jul 2026 18:33:50 GMT https://vulnogram.org/CVE-2026-6879 https://vulnogram.org/CVE-2026-6879 `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-tag siblings. `Element.find()` is only affected when… Low Tue, 28 Jul 2026 13:46:30 GMT https://vulnogram.org/CVE-2026-15308 https://vulnogram.org/CVE-2026-15308 The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data. High Network Exploitable Thu, 09 Jul 2026 17:10:57 GMT https://vulnogram.org/CVE-2026-4360 https://vulnogram.org/CVE-2026-4360 In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing… Low Tue, 30 Jun 2026 14:45:35 GMT https://vulnogram.org/CVE-2026-11972 https://vulnogram.org/CVE-2026-11972 When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer. High Network Exploitable Tue, 23 Jun 2026 22:02:45 GMT https://vulnogram.org/CVE-2026-0864 https://vulnogram.org/CVE-2026-0864 When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and values if the attacker controls the written value. Medium Tue, 23 Jun 2026 17:42:01 GMT https://vulnogram.org/CVE-2026-11940 https://vulnogram.org/CVE-2026-11940 tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived locatio… High Network Exploitable Tue, 23 Jun 2026 16:04:17 GMT https://vulnogram.org/CVE-2026-12003 https://vulnogram.org/CVE-2026-12003 To allow builds of Python to be run from an in-tree layout (rather than an installed file layout), the VPATH variable is defined at build time and used to locate certain landmarks - specifically, Modules/setup.local. When this landmark is found relat… Medium Tue, 16 Jun 2026 15:18:42 GMT https://vulnogram.org/CVE-2026-9669 https://vulnogram.org/CVE-2026-9669 bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and pe… High Network Exploitable Mon, 08 Jun 2026 22:01:15 GMT https://vulnogram.org/CVE-2026-7774 https://vulnogram.org/CVE-2026-7774 tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfil… Medium Network Exploitable Thu, 04 Jun 2026 14:21:23 GMT https://vulnogram.org/CVE-2026-3276 https://vulnogram.org/CVE-2026-3276 unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms. Medium Network Exploitable Wed, 03 Jun 2026 14:29:39 GMT https://vulnogram.org/CVE-2026-8643 https://vulnogram.org/CVE-2026-8643 pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory. High Mon, 01 Jun 2026 15:01:32 GMT https://vulnogram.org/CVE-2026-8328 https://vulnogram.org/CVE-2026-8328 The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly a… Medium Network Exploitable Wed, 13 May 2026 20:14:33 GMT https://vulnogram.org/CVE-2026-7210 https://vulnogram.org/CVE-2026-7210 `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2… Medium Network Exploitable Mon, 11 May 2026 17:19:09 GMT https://vulnogram.org/CVE-2026-3087 https://vulnogram.org/CVE-2026-3087 If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected… Medium Mon, 27 Apr 2026 20:46:43 GMT https://vulnogram.org/CVE-2026-6357 https://vulnogram.org/CVE-2026-6357 pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The p… Medium Mon, 27 Apr 2026 14:19:47 GMT https://vulnogram.org/CVE-2026-6019 https://vulnogram.org/CVE-2026-6019 http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes th… Low Wed, 22 Apr 2026 19:28:08 GMT https://vulnogram.org/CVE-2026-3298 https://vulnogram.org/CVE-2026-3298 The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-… High Network Exploitable Tue, 21 Apr 2026 14:45:01 GMT https://vulnogram.org/CVE-2026-3219 https://vulnogram.org/CVE-2026-3219 pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename… Medium Mon, 20 Apr 2026 14:55:38 GMT https://vulnogram.org/CVE-2026-5713 https://vulnogram.org/CVE-2026-5713 The "profiling.sampling" module (Python 3.15+) and "asyncio introspection capabilities" (3.14+, "python -m asyncio ps" and "python -m asyncio pstree") features could be used to read and write addresses in a privileged process if that process connecte… Medium Tue, 14 Apr 2026 15:11:51 GMT https://vulnogram.org/CVE-2026-4786 https://vulnogram.org/CVE-2026-4786 Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the underlying shell. See CVE-2026-4519 for details. High Network Exploitable Mon, 13 Apr 2026 21:52:19 GMT https://vulnogram.org/CVE-2026-6100 https://vulnogram.org/CVE-2026-6100 Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process… Critical Network Exploitable Mon, 13 Apr 2026 17:15:47 GMT https://vulnogram.org/CVE-2026-3446 https://vulnogram.org/CVE-2026-3446 When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to be processed. This can lead to data being accepted which may be processe… Medium Fri, 10 Apr 2026 18:17:35 GMT https://vulnogram.org/CVE-2026-1502 https://vulnogram.org/CVE-2026-1502 CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. Medium Fri, 10 Apr 2026 17:54:44 GMT https://vulnogram.org/CVE-2026-5271 https://vulnogram.org/CVE-2026-5271 pymanager included the current working directory in sys.path meaning modules could be shadowed by modules in the current working directory. As a result, if a user executes a pymanager-generated command (e.g., pip, pytest) from an attacker-controlled… Medium Wed, 01 Apr 2026 13:48:07 GMT https://vulnogram.org/CVE-2026-4519 https://vulnogram.org/CVE-2026-4519 The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open(… High Network Exploitable Fri, 20 Mar 2026 15:08:32 GMT https://vulnogram.org/CVE-2026-3479 https://vulnogram.org/CVE-2026-3479 DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if follow… Disputed Wed, 18 Mar 2026 18:13:42 GMT https://vulnogram.org/CVE-2026-4224 https://vulnogram.org/CVE-2026-4224 When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs. Medium Mon, 16 Mar 2026 17:52:26 GMT https://vulnogram.org/CVE-2026-3644 https://vulnogram.org/CVE-2026-3644 The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCo… Medium Mon, 16 Mar 2026 17:37:31 GMT https://vulnogram.org/CVE-2025-13462 https://vulnogram.org/CVE-2025-13462 The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the… Low Thu, 12 Mar 2026 17:59:26 GMT https://vulnogram.org/CVE-2026-2297 https://vulnogram.org/CVE-2026-2297 The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers for this audit event therefore do not… Medium Wed, 04 Mar 2026 22:10:43 GMT https://vulnogram.org/CVE-2026-1703 https://vulnogram.org/CVE-2026-1703 When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite exec… Low Mon, 02 Feb 2026 14:43:02 GMT https://vulnogram.org/CVE-2026-1299 https://vulnogram.org/CVE-2026-1299 The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized. This is only applicable if using "LiteralHeader"… Medium Fri, 23 Jan 2026 16:27:13 GMT https://vulnogram.org/CVE-2025-12781 https://vulnogram.org/CVE-2025-12781 When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars" parameter, typically used to establish an "alterna… Medium Network Exploitable Wed, 21 Jan 2026 19:34:47 GMT https://vulnogram.org/CVE-2026-0672 https://vulnogram.org/CVE-2026-0672 When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters. Medium Tue, 20 Jan 2026 21:52:33 GMT https://vulnogram.org/CVE-2025-15367 https://vulnogram.org/CVE-2025-15367 The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters. Medium Tue, 20 Jan 2026 21:47:09 GMT https://vulnogram.org/CVE-2025-15366 https://vulnogram.org/CVE-2025-15366 The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters. Medium Tue, 20 Jan 2026 21:40:24 GMT https://vulnogram.org/CVE-2025-15282 https://vulnogram.org/CVE-2025-15282 User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype. Medium Tue, 20 Jan 2026 21:35:13 GMT https://vulnogram.org/CVE-2026-0865 https://vulnogram.org/CVE-2026-0865 User-controlled header names and values containing newlines can allow injecting HTTP headers. Medium Tue, 20 Jan 2026 21:26:15 GMT https://vulnogram.org/CVE-2025-11468 https://vulnogram.org/CVE-2025-11468 When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized. Medium Tue, 20 Jan 2026 21:09:11 GMT