Python Software Foundation · product
CPython
85 CVEs
Out of date: the sync last ran 5 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
Every one of the 85 is a mark on the map. Named now: 27 to 52, most at risk first.
- Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations
- HTMLParser quadratic complexity when processing malformed inputs
- Mishandling of comma during folding and unicode-encoding of email headers
- Tarfile extracts filtered members when errorlevel=0
- Folding email comments of unfoldable characters doesn't preserve parenthesis
- tarfile hardlink fallback ignores custom extraction filter rejection via None
- tarfile.data_filter path traversal bypass allows writing outside the extraction directory
- Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure
- email BytesGenerator header injection due to unquoted newlines
- wsgiref.headers.Headers allows header newline injection
- shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs
- SSLContext.wrap_bio() missing validation of server_hostname parameter
- Incomplete control character validation in http.cookies
- Header injection via newlines in data URL mediatype
- HTTP client proxy tunnel headers not validated for CR/LF
- Distrust compromised intermediate certificates in ssl module
- `HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching
- zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits
- Use-after-free of a server-side SSLContext when sni_callback switches contexts
- Potential DoS via quadratic complexity in unicodedata.normalize()
- Regression in FIPS enforcement of hash algorithms affecting only Python 3.14.10
- Tarfile.extract() doesn't fully respect filter parameter
- Header injection in http.cookies.Morsel
- tarfile extraction filter bypass allows creation of directories outside the destination
- ZIP64 End of Central Directory (EOCD) Locator record offset not checked
- FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.