Python Software Foundation · weakness class
Input Validation and Logic
10 CVEs
Out of date: the sync last ran 4 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
- likely to be exploited
- 1
Every one of the 10 is a mark on the map. Named now: 1 to 10, most at risk first.
- An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.
- The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value o…
- mwlib 0.13 through 0.13.4 has a denial of service vulnerability when parsing #iferror magic functions
- URL parser allowed square brackets in domain names
- Incorrect IPv4 and IPv6 private ranges
- stringprep.map_table_b2() deviates from RFC 3454 Table B.2
- tarfile opened in streaming mode mishandles EOF
- Tarfile extracts filtered members when errorlevel=0
- ZIP64 End of Central Directory (EOCD) Locator record offset not checked
- webbrowser.open() allows leading dashes in URLs
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.