CVEs
Every published CVE. Without a filter the list holds those exploited, with a public check, or likely to be exploited; pick a year and month or a vendor for the rest.
| CVE | Vendor · product | Exploitation | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2023-24329An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters. | Python · Python | Likely | 7.5 | 20% | 2023-02-17 |
| CVE-2019-6690python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled b… | Python · Python-Gnupg | Possible | – | 8.6% | 2019-03-17 |
| CVE-2016-1494The verify function in the RSA package for Python (Python-RSA) before 3.3 allows attackers to spoof signatures with a small public exponent via crafted signature padding, aka a BE… | Python · Rsa | Possible | – | 7.0% | 2016-01-13 |
| CVE-2013-4238The ssl.match_hostname function in the SSL module in Python 2.6 through 3.4 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an… | Python · Python | Possible | – | 5.3% | 2013-08-18 |
| CVE-2019-16056An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain mul… | Python · Python | Possible | 5.3 | 5.1% | 2019-09-06 |
| CVE-2013-7338Python before 3.3.4 RC1 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a file size value larger than the size of the zip file to the… | Python · Python | Possible | – | 5.1% | 2014-04-22 |
| CVE-2018-1060python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause… | Python · python | Possible | 4.3 | 5.0% | 2018-06-18 |
| CVE-2021-27922Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICNS container… | Python · Pillow | Possible | – | 4.9% | 2021-03-03 |
| CVE-2018-1061python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method. An attacker could use this flaw t… | Python · python | Possible | 6.5 | 4.7% | 2018-06-19 |
| CVE-2019-17514library/glob.html in the Python 2 and 3 documentation before 2016 has potentially misleading information about whether sorting occurs, as demonstrated by irreproducible cancer-res… | Python · Python | Possible | – | 4.7% | 2019-10-12 |
| CVE-2014-9601Pillow before 2.7.0 allows remote attackers to cause a denial of service via a compressed text chunk in a PNG image that has a large size when it is decompressed. | Python · Pillow | Possible | – | 4.7% | 2015-01-16 |
| CVE-2018-20852http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cooki… | Python · Python | Possible | 4.3 | 3.7% | 2019-07-13 |
| CVE-2014-3589PIL/IcnsImagePlugin.py in Python Imaging Library (PIL) and Pillow before 2.3.2 and 2.5.x before 2.5.2 allows remote attackers to cause a denial of service via a crafted block size. | Python · Pillow | Possible | – | 3.4% | 2014-08-25 |
| CVE-2021-27921Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container,… | Python · Pillow | Possible | – | 3.2% | 2021-03-03 |
| CVE-2021-27923Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container,… | Python · Pillow | Possible | – | 3.0% | 2021-03-03 |
| CVE-2023-27043The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value o… | Python · Python | Possible | 5.3 | 2.5% | 2023-04-18 |
| CVE-2012-1109mwlib 0.13 through 0.13.4 has a denial of service vulnerability when parsing #iferror magic functions | Python · mwlib | Possible | – | 2.1% | 2019-11-12 |
| CVE-2013-1633easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-m… | Python · Setuptools | Possible | – | 2.0% | 2013-08-06 |
| CVE-2025-0938URL parser allowed square brackets in domain names | Python Software Foundation · CPython | Possible | 6.3 | 1.5% | 2025-01-31 |
| CVE-2024-4032Incorrect IPv4 and IPv6 private ranges | Python Software Foundation · CPython | Possible | 7.5 | 1.1% | 2024-06-17 |
| CVE-2021-28675An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could… | Python · Pillow | Unlikely | – | 1.0% | 2021-06-02 |
| CVE-2026-17084stringprep.map_table_b2() deviates from RFC 3454 Table B.2 | Python Software Foundation · CPython | Unlikely | 6.0 | 0.8% | 2026-08-18 |
| CVE-2026-11972tarfile opened in streaming mode mishandles EOF | Python Software Foundation · CPython | Unlikely | 8.2 | 0.7% | 2026-06-23 |
| CVE-2025-4435Tarfile extracts filtered members when errorlevel=0 | Python Software Foundation · CPython | Unlikely | 7.5 | 0.6% | 2025-06-03 |
| CVE-2025-8291ZIP64 End of Central Directory (EOCD) Locator record offset not checked | Python Software Foundation · CPython | Unlikely | 4.3 | 0.5% | 2025-10-07 |
| CVE-2026-4519webbrowser.open() allows leading dashes in URLs | Python Software Foundation · CPython | Unlikely | 7.1 | 0.3% | 2026-03-20 |
Exploitation: exploited (CISA KEV), a public nuclei check, then EPSS: likely 10% or more, possible 1 to 10%, unlikely under 1%. Data as of 2026-11-15.