Python · product
CPython
85 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
Every one of the 85 is a mark on the map. Named now: 53 to 78, most at risk first.
- IMAP command injection in user-controlled commands
- bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow
- Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes
- POP3 command injection in user-controlled commands
- Lenient parsing of integers for response body and chunk framing
- Quadratic Behavior in xml.etree.ElementPath Index Predicates
- Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory
- Quoted zip-bomb protection for zipfile
- webbrowser.open() allows leading dashes in URLs
- An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory cla…
- Cookie Attribute Injection via Unescaped Semicolons in http.cookies.Morsel
- ssl.get_server_certificate(addr, ca_certs=...) verifies the chain but never the identity
- tempfile.mkdtemp() may be readable and writeable by all users on Windows
- Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()
- imaplib STARTTLS serves plaintext bytes buffered before the handshake as if they came over TLS
- `http.cookiejar` applies expired `Set-Cookie` to cookie store before policy validation
- pkgutil.get_data() does not enforce documented restrictions
- tar filter allows writing outside destination via empty-named symlink
- socket.getaddrinfo() accepts embedded null bytes in host and port
- Pure-Python fallback of socket.socketpair() doesn’t authenticate peer connection
- Out-of-memory when loading Plist
- Use-after-free in "unicode_escape" decoder with error handler
- SourcelessFileLoader does not use io.open_code()
- BaseCookie.js_output() does not neutralize embedded characters
- tarfile extraction filters allow file modification and content disclosure via hard link to symlink
- tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.