CVEs
Every published CVE. Without a filter the list holds those exploited, with a public check, or likely to be exploited; pick a year and month or a vendor for the rest.
| CVE | Vendor · product | Exploitation | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2020-14422Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of s… | Python · Python | Likely | – | 13% | 2020-06-18 |
| CVE-2012-1150Python before 2.6.8, 2.7.x before 2.7.3, 3.x before 3.1.5, and 3.2.x before 3.2.3 computes hash values without restricting the ability to trigger hash collisions predictably, whic… | Python · Python | Possible | – | 5.1% | 2012-10-05 |
| CVE-2013-7040Python 2.7 before 3.4 only uses the last eight bits of the prefix to randomize hash values, which causes it to compute hash values without restricting the ability to trigger hash… | Python · Python | Possible | – | 3.1% | 2014-05-19 |
| CVE-2019-11324The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in… | Python · Urllib3 | Possible | – | 2.9% | 2019-04-18 |
| CVE-2012-3458Beaker before 1.6.4, when using PyCrypto to encrypt sessions, uses AES in ECB cipher mode, which might allow remote attackers to obtain portions of sensitive session data via unsp… | Python · Beaker | Possible | – | 2.5% | 2012-09-15 |
| CVE-2021-28363The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if… | Python · Urllib3 | Possible | – | 2.2% | 2021-03-15 |
| CVE-2016-9015Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS certificates. This p… | Python · Urllib3 | Unlikely | – | 0.8% | 2017-01-11 |
| CVE-2021-28678An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a… | Python · Pillow | Unlikely | – | 0.7% | 2021-06-02 |
| CVE-2026-7210The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection | Python Software Foundation · CPython | Unlikely | 6.3 | 0.7% | 2026-05-11 |
| CVE-2026-19553SSLContext.wrap_bio() missing validation of server_hostname parameter | Python Software Foundation · CPython | Unlikely | 7.6 | 0.5% | 2026-09-30 |
| CVE-2026-115557Distrust compromised intermediate certificates in ssl module | Python Software Foundation · CPython | Unlikely | 9.4 | 0.5% | 2026-10-24 |
| CVE-2026-15806`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching | Python Software Foundation · CPython | Unlikely | 6.0 | 0.5% | 2026-08-18 |
| CVE-2012-4571Python Keyring 0.9.1 does not securely initialize the cipher when encrypting passwords for CryptedFileKeyring files, which makes it easier for local users to obtain passwords via… | Python · Keyring | Unlikely | – | 0.4% | 2012-11-30 |
| CVE-2026-19552ssl.get_server_certificate(addr, ca_certs=...) verifies the chain but never the identity | Python Software Foundation · CPython | Unlikely | 0.0 | 0.3% | 2026-11-09 |
| CVE-2026-3446Base64 decoding stops at first padded quad by default | Python Software Foundation · CPython | Unlikely | 6.0 | 0.2% | 2026-04-10 |
Exploitation: exploited (CISA KEV), a public nuclei check, then EPSS: likely 10% or more, possible 1 to 10%, unlikely under 1%. Data as of 2026-11-15.