CVEs
Every published CVE. Without a filter the list holds those exploited, with a public check, or likely to be exploited; pick a year and month or a vendor for the rest.
| CVE | Vendor · product | Exploitation | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2018-1000802Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shu… | Python · Python | Likely | – | 20% | 2018-09-18 |
| CVE-2014-3007Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to C… | Python · Pillow | Likely | – | 10% | 2014-04-27 |
| CVE-2020-13388An exploitable vulnerability exists in the configuration-loading functionality of the jw.util package before 2.3 for Python. When loading a configuration with FromString or FromSt… | Python · Jw.util | Possible | – | 4.5% | 2020-05-22 |
| CVE-2015-20107In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject she… | Python · Python | Possible | 7.8 | 2.8% | 2022-04-13 |
| CVE-2019-12761A code injection issue was discovered in PyXDG before 0.26 via crafted Python code in a Category element of a Menu XML document in a .menu file. XDG_CONFIG_DIRS must be set up to… | Python · Pyxdg | Possible | – | 2.1% | 2019-06-06 |
| CVE-2023-50447Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expressi… | Python · Pillow | Possible | 8.1 | 1.7% | 2024-01-19 |
| CVE-2024-6923Email header injection due to unquoted newlines | Python Software Foundation · CPython | Possible | 5.5 | 1.1% | 2024-08-01 |
| CVE-2025-15366IMAP command injection in user-controlled commands | Python Software Foundation · CPython | Unlikely | 5.9 | 0.4% | 2026-01-20 |
| CVE-2025-15367POP3 command injection in user-controlled commands | Python Software Foundation · CPython | Unlikely | 5.9 | 0.4% | 2026-01-20 |
| CVE-2026-4786Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open() | Python Software Foundation · CPython | Unlikely | 7.1 | 0.3% | 2026-04-13 |
Exploitation: exploited (CISA KEV), a public nuclei check, then EPSS: likely 10% or more, possible 1 to 10%, unlikely under 1%. Data as of 2026-11-15.