Skip to content

Python Software Foundation · no weakness in the record

No weakness recorded

9 CVEs

Every dot is a CVE in what this vendor ships; the named ones are the most at risk.

Every one of the 9 is a mark on the map. Named now: 1 to 9, most at risk first.

  1. PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be used.CVE-2022-22817Python · CVSS 9.8 · 3.6% likely
  2. Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.CVE-2022-24303Python · 2.7% likely
  3. marcador package in PyPI 0.1 through 0.13 included a code-execution backdoor.CVE-2022-28470Python · 2.3% likely
  4. An issue in Python cpython v.3.7 allows an attacker to obtain sensitive information via the _asyncio._swap_current_task component. NOTE: this is disputed by the vendor because (1)…CVE-2023-38898Python · 1.7% likely
  5. Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).CVE-2022-45198Python · 1.6% likely
  6. An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use…CVE-2023-40217Python · 0.8% likely
  7. Buffer overread when using an empty list with SSLContext.set_npn_protocols()CVE-2024-5642Python Software Foundation · CVSS 6.5 · 0.7% likely
  8. An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory cla…CVE-2023-6597Python Software Foundation · CVSS 7.8 · 0.3% likely
  9. imaplib STARTTLS serves plaintext bytes buffered before the handshake as if they came over TLSCVE-2026-115559Python Software Foundation · CVSS 6.3 · 0.3% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

Updated AboutDevelopersSign in