CVEs
Every published CVE. Without a filter the list holds those exploited, with a public check, or likely to be exploited; pick a year and month or a vendor for the rest.
| CVE | Vendor · product | Exploitation | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2021-23336Web Cache Poisoning | Python · python/cpython | Likely | 5.9 | 41% | 2021-02-15 |
| CVE-2016-5699CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) before 2.7.10 and 3.x before 3.4.4 allows remote attackers to i… | Python · Python | Possible | – | 9.9% | 2016-09-02 |
| CVE-2022-0391A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the… | Python · python | Possible | 7.5 | 8.5% | 2022-02-09 |
| CVE-2019-9636Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Inform… | Python · Python | Possible | 5.3 | 7.7% | 2019-03-08 |
| CVE-2020-26116http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as… | Python · Python | Possible | – | 6.4% | 2020-09-27 |
| CVE-2019-9740An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as dem… | Python · Python | Possible | 6.5 | 5.4% | 2019-03-13 |
| CVE-2019-9947An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as dem… | Python · Python | Possible | 5.4 | 5.3% | 2019-03-23 |
| CVE-2022-48565An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilitie… | Python · Python | Possible | – | 5.2% | 2023-08-22 |
| CVE-2019-10160A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 throu… | Python · python | Possible | 9.8 | 5.2% | 2019-06-07 |
| CVE-2017-17522Lib/webbrowser.py in Python through 3.6.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers… | Python · Python | Possible | – | 3.6% | 2017-12-14 |
| CVE-2019-18348An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as dem… | Python · Python | Possible | 5.4 | 3.5% | 2019-10-23 |
| CVE-2020-26137urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of pu… | Python · Urllib3 | Possible | – | 2.3% | 2020-09-29 |
| CVE-2019-11236In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter. | Python · Urllib3 | Possible | – | 2.1% | 2019-04-15 |
| CVE-2017-5992Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document. | Python · Openpyxl | Possible | – | 1.4% | 2017-02-15 |
| CVE-2025-1795Mishandling of comma during folding and unicode-encoding of email headers | Python Software Foundation · CPython | Unlikely | 2.3 | 0.6% | 2025-02-28 |
| CVE-2025-11468Folding email comments of unfoldable characters doesn't preserve parenthesis | Python Software Foundation · CPython | Unlikely | 5.7 | 0.6% | 2026-01-20 |
| CVE-2026-1299email BytesGenerator header injection due to unquoted newlines | Python Software Foundation · CPython | Unlikely | 6.0 | 0.6% | 2026-01-23 |
| CVE-2026-0865wsgiref.headers.Headers allows header newline injection | Python Software Foundation · CPython | Unlikely | 5.9 | 0.6% | 2026-01-20 |
| CVE-2026-3644Incomplete control character validation in http.cookies | Python Software Foundation · CPython | Unlikely | 6.0 | 0.5% | 2026-03-16 |
| CVE-2025-15282Header injection via newlines in data URL mediatype | Python Software Foundation · CPython | Unlikely | 6.0 | 0.5% | 2026-01-20 |
| CVE-2026-1502HTTP client proxy tunnel headers not validated for CR/LF | Python Software Foundation · CPython | Unlikely | 5.7 | 0.5% | 2026-04-10 |
| CVE-2026-0672Header injection in http.cookies.Morsel | Python Software Foundation · CPython | Unlikely | 6.0 | 0.5% | 2026-01-20 |
| CVE-2026-103995Lenient parsing of integers for response body and chunk framing | Python Software Foundation · CPython | Unlikely | 2.0 | 0.4% | 2026-10-27 |
| CVE-2026-16052Cookie Attribute Injection via Unescaped Semicolons in http.cookies.Morsel | Python Software Foundation · CPython | Unlikely | 2.3 | 0.3% | 2026-11-12 |
| CVE-2026-116566socket.getaddrinfo() accepts embedded null bytes in host and port | Python Software Foundation · CPython | Unlikely | 5.3 | 0.3% | 2026-10-29 |
| CVE-2026-6019BaseCookie.js_output() does not neutralize embedded characters | Python Software Foundation · CPython | Unlikely | 2.1 | 0.2% | 2026-04-22 |
| CVE-2026-0864Configuration Injection via Carriage Return (\r) in write() method | Python Software Foundation · CPython | Unlikely | 4.1 | 0.1% | 2026-06-23 |
Exploitation: exploited (CISA KEV), a public nuclei check, then EPSS: likely 10% or more, possible 1 to 10%, unlikely under 1%. Data as of 2026-11-15.