CVEs
Every published CVE. Without a filter the list holds those exploited, with a public check, or likely to be exploited; pick a year and month or a vendor for the rest.
| CVE | Vendor · product | Exploitation | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2021-3737A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client scr… | Python · python | Likely | 7.5 | 13% | 2022-03-04 |
| CVE-2020-8492Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (R… | Python · Python | Possible | 6.5 | 6.6% | 2020-01-30 |
| CVE-2019-9674Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb. | Python · Python | Possible | – | 5.6% | 2020-02-04 |
| CVE-2012-0845SimpleXMLRPCServer.py in SimpleXMLRPCServer in Python before 2.6.8, 2.7.x before 2.7.3, 3.x before 3.1.5, and 3.2.x before 3.2.3 allows remote attackers to cause a denial of servi… | Python · Python | Possible | – | 5.4% | 2012-10-05 |
| CVE-2013-2099Algorithmic complexity vulnerability in the ssl.match_hostname function in Python 3.2.x, 3.3.x, and earlier, and unspecified versions of python-backports-ssl_match_hostname as use… | Python · Python | Possible | – | 4.9% | 2013-10-09 |
| CVE-2021-3733There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a… | Python · python | Possible | – | 4.8% | 2022-03-07 |
| CVE-2011-1521The urllib and urllib2 modules in Python 2.x before 2.7.2 and 3.x before 3.2.1 process Location headers that specify redirection to file: URLs, which makes it easier for remote at… | Python · Python | Possible | – | 3.6% | 2011-05-24 |
| CVE-2020-7212The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denial of service (CPU consumption) because of an inefficient al… | Python · Urllib3 | Possible | – | 3.4% | 2020-03-06 |
| CVE-2022-45061An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a craf… | Python · Python | Possible | 7.5 | 3.3% | 2022-11-09 |
| CVE-2021-33503An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catas… | Python · Urllib3 | Possible | – | 3.3% | 2021-06-29 |
| CVE-2019-16865An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extreme… | Python · Pillow | Possible | – | 3.1% | 2019-10-04 |
| CVE-2019-20907In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header valid… | Python · Python | Possible | 5.5 | 3.0% | 2020-07-13 |
| CVE-2022-40897Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is… | Python · Setuptools | Possible | 5.9 | 2.6% | 2022-12-22 |
| CVE-2021-28676An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load. | Python · Pillow | Possible | – | 2.5% | 2021-06-02 |
| CVE-2024-7592Quadratic complexity parsing cookies with backslashes | Python Software Foundation · CPython | Possible | 7.5 | 2.3% | 2024-08-19 |
| CVE-2024-6232Regular-expression DoS when parsing TarFile headers | Python Software Foundation · CPython | Possible | 7.5 | 2.2% | 2024-09-03 |
| CVE-2014-3598The Jpeg2KImagePlugin plugin in Pillow before 2.5.3 allows remote attackers to cause a denial of service via a crafted image. | Python · Pillow | Possible | – | 2.0% | 2015-05-01 |
| CVE-2016-6581A HTTP/2 implementation built using any version of the Python HPACK library between v1.0.0 and v2.2.0 could be targeted for a denial of service attack, specifically a so-called "H… | Python · Hpack | Possible | – | 1.9% | 2017-01-10 |
| CVE-2024-12254Unbounded memory buffering in SelectorSocketTransport.writelines() | Python Software Foundation · CPython | Possible | 7.5 | 1.9% | 2024-12-06 |
| CVE-2016-6580A HTTP/2 implementation built using any version of the Python priority library prior to version 1.2.0 could be targeted by a malicious peer by having that peer assign priority inf… | Python · Python Priority Library | Possible | – | 1.8% | 2017-01-10 |
| CVE-2025-13836Excessive read buffering DoS in http.client | Python Software Foundation · CPython | Possible | 6.3 | 1.7% | 2025-12-01 |
| CVE-2021-25292An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex. | Python · Pillow | Possible | – | 1.7% | 2021-03-19 |
| CVE-2022-48564read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary f… | Python · Python | Possible | – | 1.7% | 2023-08-22 |
| CVE-2023-36632The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError: maximum recursion depth exceeded while calling a Python object" via… | Python · Python | Possible | – | 1.6% | 2023-06-25 |
| CVE-2022-45199Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL. | Python · Pillow | Possible | – | 1.5% | 2022-11-14 |
| CVE-2023-44271An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by… | Python · Pillow | Possible | – | 1.4% | 2023-11-03 |
| CVE-2017-18207The Wave_read._read_fmt_chunk function in Lib/wave.py in Python through 3.6.4 does not ensure a nonzero channel value, which allows attackers to cause a denial of service (divide-… | Python · Python | Possible | – | 1.3% | 2018-03-01 |
| CVE-2024-8088Infinite loop when iterating over zip archive entry names from zipfile.Path | Python Software Foundation · CPython | Possible | 8.7 | 1.3% | 2024-08-22 |
| CVE-2025-12084Quadratic complexity in node ID cache clearing | Python Software Foundation · CPython | Unlikely | 6.3 | 0.9% | 2025-12-03 |
| CVE-2026-4224Stack overflow parsing XML with deeply nested DTD content models | Python Software Foundation · CPython | Unlikely | 6.0 | 0.8% | 2026-03-16 |
| CVE-2025-8194Tarfile infinite loop during parsing with negative member offset | Python Software Foundation · CPython | Unlikely | 7.5 | 0.8% | 2025-07-28 |
| CVE-2026-0994Denial of Service in Python Protobuf | Python · Protobuf | Unlikely | 7.5 | 0.7% | 2026-01-23 |
| CVE-2026-15308Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations | Python Software Foundation · CPython | Unlikely | 8.7 | 0.6% | 2026-07-09 |
| CVE-2025-6069HTMLParser quadratic complexity when processing malformed inputs | Python Software Foundation · CPython | Unlikely | 4.3 | 0.6% | 2025-06-17 |
| CVE-2026-15310zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits | Python Software Foundation · CPython | Unlikely | 2.1 | 0.5% | 2026-08-25 |
| CVE-2026-3276Potential DoS via quadratic complexity in unicodedata.normalize() | Python Software Foundation · CPython | Unlikely | 6.3 | 0.5% | 2026-06-03 |
| CVE-2026-6879Quadratic Behavior in xml.etree.ElementPath Index Predicates | Python Software Foundation · CPython | Unlikely | 2.0 | 0.4% | 2026-07-28 |
| CVE-2024-0450Quoted zip-bomb protection for zipfile | Python Software Foundation · CPython | Unlikely | 6.2 | 0.3% | 2024-03-19 |
| CVE-2025-13837Out-of-memory when loading Plist | Python Software Foundation · CPython | Unlikely | 2.1 | 0.2% | 2025-12-01 |
| CVE-2025-6075Quadratic complexity in os.path.expandvars() with user-controlled template | Python Software Foundation · CPython | Unlikely | 1.8 | 0.1% | 2025-10-31 |
| CVE-2026-18503Super-linear CPU usage for unbounded input to csv.Sniffer.sniff() | Python Software Foundation · CPython | Unlikely | 2.4 | 0.1% | 2026-08-10 |
Exploitation: exploited (CISA KEV), a public nuclei check, then EPSS: likely 10% or more, possible 1 to 10%, unlikely under 1%. Data as of 2026-11-15.