Injection and Smuggling

Every one of the 16 is a mark on the map. Named now: 1 to 16, most at risk first.

1. A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the…CVE-2022-0391Python · CVSS 7.5 · 8.5% likely

   CWE-74

2. An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilitie…CVE-2022-48565Python · 5.2% likely

   CWE-611

3. A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 throu…CVE-2019-10160Python · CVSS 9.8 · 5.2% likely

   CWE-172

4. Mishandling of comma during folding and unicode-encoding of email headersCVE-2025-1795Python Software Foundation · CVSS 2.3 · 0.6% likely

   CWE-116

5. Folding email comments of unfoldable characters doesn't preserve parenthesisCVE-2025-11468Python Software Foundation · CVSS 5.7 · 0.6% likely

   CWE-93

6. email BytesGenerator header injection due to unquoted newlinesCVE-2026-1299Python Software Foundation · CVSS 6 · 0.6% likely

   CWE-93

7. wsgiref.headers.Headers allows header newline injectionCVE-2026-0865Python Software Foundation · CVSS 5.9 · 0.6% likely

   CWE-74

8. Incomplete control character validation in http.cookiesCVE-2026-3644Python Software Foundation · CVSS 6 · 0.5% likely

   CWE-116

9. Header injection via newlines in data URL mediatypeCVE-2025-15282Python Software Foundation · CVSS 6 · 0.5% likely

   CWE-93

10. HTTP client proxy tunnel headers not validated for CR/LFCVE-2026-1502Python Software Foundation · CVSS 5.7 · 0.5% likely

    CWE-93

11. Header injection in http.cookies.MorselCVE-2026-0672Python Software Foundation · CVSS 6 · 0.5% likely

    CWE-93

12. Lenient parsing of integers for response body and chunk framingCVE-2026-103995Python Software Foundation · CVSS 2 · 0.4% likely

    CWE-444

13. Cookie Attribute Injection via Unescaped Semicolons in http.cookies.MorselCVE-2026-16052Python Software Foundation · CVSS 2.3 · 0.3% likely

    CWE-74

14. socket.getaddrinfo() accepts embedded null bytes in host and portCVE-2026-116566Python Software Foundation · CVSS 5.3 · 0.3% likely

    CWE-158

15. BaseCookie.js_output() does not neutralize embedded charactersCVE-2026-6019Python Software Foundation · CVSS 2.1 · 0.2% likely

    CWE-150

16. Configuration Injection via Carriage Return (\r) in write() methodCVE-2026-0864Python Software Foundation · CVSS 4.1 · 0.1% likely

    CWE-74

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.