Python Software Foundation · no weakness in the record
No weakness recorded
9 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
Every one of the 9 is a mark on the map. Named now: 1 to 9, most at risk first.
- PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be used.
- Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.
- marcador package in PyPI 0.1 through 0.13 included a code-execution backdoor.
- An issue in Python cpython v.3.7 allows an attacker to obtain sensitive information via the _asyncio._swap_current_task component. NOTE: this is disputed by the vendor because (1)…
- Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).
- An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use…
- Buffer overread when using an empty list with SSLContext.set_npn_protocols()
- An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory cla…
- imaplib STARTTLS serves plaintext bytes buffered before the handshake as if they came over TLS
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.