Skip to content

Numpy · product

Numpy

8 CVEs

Every dot is a CVE in what this vendor ships; the named ones are the most at risk.

likely to be exploited
1

Every one of the 8 is a mark on the map. Named now: 1 to 8, most at risk first.

  1. An issue was discovered in NumPy before 1.16.3. It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object,…CVE-2019-6446Numpy · 27% likely

    CWE-502

  2. The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or ndarray will stick into an infinite loop, which can allow attackers to caus…CVE-2017-12852Numpy · 2.7% likely

    CWE-835

  3. An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects.…CVE-2021-34141Numpy · 1.7% likely

    CWE-697

  4. A Buffer Overflow vulnerability exists in NumPy 1.9.x in the PyArray_NewFromDescr_int function of ctors.c when specifying arrays of large dimensions (over 32) from Python code, wh…CVE-2021-33430Numpy · 1.5% likely

    CWE-120

  5. Null Pointer Dereference vulnerability exists in numpy.sort in NumPy &lt and 1.19 in the PyArray_DescrNew function due to missing return-value validation, which allows attackers t…CVE-2021-41495Numpy · 1.2% likely

    CWE-476

  6. (1) core/tests/test_memmap.py, (2) core/tests/test_multiarray.py, (3) f2py/f2py2e.py, and (4) lib/tests/test_io.py in NumPy before 1.8.1 allow local users to write to arbitrary fi…CVE-2014-1859Numpy · 0.5% likely

    CWE-59

  7. __init__.py in f2py in NumPy before 1.8.1 allows local users to write to arbitrary files via a symlink attack on a temporary file.CVE-2014-1858Numpy · 0.4% likely

    CWE-20

  8. Buffer overflow in the array_from_pyobj function of fortranobject.c in NumPy < 1.19, which allows attackers to conduct a Denial of Service attacks by carefully constructing an arr…CVE-2021-41496Numpy · 0.4% likely

    CWE-120

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.