Python Software Foundation · product
CPython
85 CVEs
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
Every one of the 85 is a mark on the map. Named now: 1 to 26, most at risk first.
- Quadratic complexity parsing cookies with backslashes
- Regular-expression DoS when parsing TarFile headers
- Unbounded memory buffering in SelectorSocketTransport.writelines()
- Excessive read buffering DoS in http.client
- URL parser allowed square brackets in domain names
- Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory
- Arbitrary writes via tarfile realpath overflow
- Groups not dropped before running subprocess when using empty 'extra_groups' parameter
- Infinite loop when iterating over zip archive entry names from zipfile.Path
- Email header injection due to unquoted newlines
- Incorrect IPv4 and IPv6 private ranges
- Extraction filter bypass for linking outside extraction directory
- base64.b64decode() always accepts "+/" characters, despite setting altchars
- Quadratic complexity in node ID cache clearing
- Bypass extraction filter to modify file metadata outside extraction directory
- Memory race condition in ssl.SSLContext certificate store methods
- Stack overflow parsing XML with deeply nested DTD content models
- stringprep.map_table_b2() deviates from RFC 3454 Table B.2
- Tarfile infinite loop during parsing with negative member offset
- tarfile extraction filter bypass allows escaping the destination directory
- Buffer overread when using an empty list with SSLContext.set_npn_protocols()
- tarfile opened in streaming mode mishandles EOF
- Default mimetype known files writeable on Windows
- The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection
- Improper validation of IPv6 and IPvFuture addresses
- Virtual environment (venv) activation scripts don't quote paths
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.