CVEs
Every published CVE. Without a filter the list holds those exploited, with a public check, or likely to be exploited; pick a year and month or a vendor for the rest.
| CVE | Vendor · product | Exploitation | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2016-9190Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the "crafted image file" approach, related to an "Insecure Sign Extension" issue affectin… | Python · Pillow | Possible | – | 1.9% | 2016-11-04 |
| CVE-2023-6507Groups not dropped before running subprocess when using empty 'extra_groups' parameter | Python Software Foundation · CPython | Possible | 6.1 | 1.3% | 2023-12-08 |
| CVE-2016-1000032TGCaptcha2 version 0.3.0 is vulnerable to a replay attack due to a missing nonce allowing attackers to use a single solved CAPTCHA multiple times. | Python · Tgcaptcha2 | Possible | – | 1.3% | 2016-10-25 |
| CVE-2026-4360Tarfile.extract() doesn't fully respect filter parameter | Python Software Foundation · CPython | Unlikely | 2.0 | 0.5% | 2026-06-30 |
| CVE-2014-1933The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the comma… | Python · Pillow | Unlikely | – | 0.5% | 2014-04-17 |
| CVE-2012-5578Python keyring has insecure permissions on new databases allowing world-readable files to be created | Python · Python keyring | Unlikely | – | 0.4% | 2019-11-25 |
| CVE-2011-4944Python 2.6 through 3.2 creates ~/.pypirc with world-readable permissions before changing them after data has been written, which introduces a race condition that allows local user… | Python · Python | Unlikely | – | 0.4% | 2012-08-27 |
| CVE-2024-4030tempfile.mkdtemp() may be readable and writeable by all users on Windows | Python Software Foundation · CPython | Unlikely | 7.1 | 0.3% | 2024-05-07 |
| CVE-2026-124249`http.cookiejar` applies expired `Set-Cookie` to cookie store before policy validation | Python Software Foundation · CPython | Unlikely | 6.3 | 0.3% | 2026-11-09 |
| CVE-2026-2297SourcelessFileLoader does not use io.open_code() | Python Software Foundation · CPython | Unlikely | 5.7 | 0.2% | 2026-03-04 |
Exploitation: exploited (CISA KEV), a public nuclei check, then EPSS: likely 10% or more, possible 1 to 10%, unlikely under 1%. Data as of 2026-11-15.