CVEs
Every published CVE. Without a filter the list holds those exploited, with a public check, or likely to be exploited; pick a year and month or a vendor for the rest.
| CVE | Vendor · product | Exploitation | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2020-27619In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP. | Python · Python | Possible | – | 8.3% | 2020-10-22 |
| CVE-2021-29921In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access… | Python · Python | Possible | – | 6.8% | 2021-05-06 |
| CVE-2005-0089The SimpleXMLRPCServer library module in Python 2.2, 2.3 before 2.3.5, and 2.4, when used by XML-RPC servers that use the register_instance method to register an object without a… | Python · Python | Possible | – | 6.0% | 2005-02-06 |
| CVE-2006-4980Buffer overflow in the repr function in Python 2.3 through 2.6 before 20060822 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code… | Python · Python | Possible | – | 5.6% | 2006-10-09 |
| CVE-2007-1657Stack-based buffer overflow in the file_compress function in minigzip (Modules/zlib) in Python 2.5 allows context-dependent attackers to execute arbitrary code via a long file arg… | Python Software Foundation · Python | Possible | – | 4.7% | 2007-03-24 |
| CVE-2012-2135The utf-16 decoder in Python 3.1 through 3.3 does not update the aligned_end variable after calling the unicode_decode_call_errorhandler function, which allows remote attackers to… | Python · Python | Possible | – | 4.5% | 2012-08-14 |
| CVE-2018-20060urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can… | Python · Urllib3 | Possible | – | 4.5% | 2018-12-11 |
| CVE-2022-22817PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be used. | Python · Pillow | Possible | 9.8 | 3.6% | 2022-01-07 |
| CVE-2013-1753The gzip_decode function in the xmlrpc client library in Python 3.4 and earlier allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP reques… | Python · Python | Possible | – | 3.5% | 2020-03-11 |
| CVE-2010-3492The asyncore module in Python before 3.2 does not properly handle unsuccessful calls to the accept function, and does not have accompanying documentation describing how daemon app… | Python · Python | Possible | – | 3.4% | 2010-10-19 |
| CVE-2015-2296The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a re… | Python · Requests | Possible | – | 3.2% | 2015-03-18 |
| CVE-2014-9365The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS UR… | Python · Python | Possible | – | 3.0% | 2014-12-12 |
| CVE-2022-24303Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled. | Python · Pillow | Possible | – | 2.7% | 2022-03-28 |
| CVE-2021-28677An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It us… | Python · Pillow | Possible | – | 2.5% | 2021-06-02 |
| CVE-2022-28470marcador package in PyPI 0.1 through 0.13 included a code-execution backdoor. | Python · Pypi | Possible | – | 2.3% | 2022-05-08 |
| CVE-2023-38898An issue in Python cpython v.3.7 allows an attacker to obtain sensitive information via the _asyncio._swap_current_task component. NOTE: this is disputed by the vendor because (1)… | Python · Python | Possible | – | 1.7% | 2023-08-15 |
| CVE-2022-45198Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification). | Python · Pillow | Possible | – | 1.6% | 2022-11-14 |
| CVE-2008-0299common.py in Paramiko 1.7.1 and earlier, when using threads or forked processes, does not properly use RandomPool, which allows one session to obtain sensitive information from an… | Python Software Foundation · Paramiko | Possible | – | 1.6% | 2008-01-16 |
| CVE-2021-42576The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Python (in pybluemonday), does not properly enforce policies associated with the SELECT, STYLE, and OPTION elem… | Python · Pybluemonday | Possible | – | 1.6% | 2021-10-18 |
| CVE-2006-1542Stack-based buffer overflow in Python 2.4.2 and earlier, running on Linux 2.6.12.5 under gcc 4.0.3 with libc 2.3.5, allows local users to cause a "stack overflow," and possibly ga… | Python · Python | Unlikely | – | 0.9% | 2006-03-30 |
| CVE-2023-40217An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use… | Python · Python | Unlikely | – | 0.8% | 2023-08-25 |
| CVE-2024-5642Buffer overread when using an empty list with SSLContext.set_npn_protocols() | Python Software Foundation · CPython | Unlikely | 6.5 | 0.7% | 2024-06-27 |
| CVE-2015-5652Untrusted search path vulnerability in python.exe in Python through 3.5.0 on Windows allows local users to gain privileges via a Trojan horse readline.pyd file in the current work… | Python · Python | Unlikely | – | 0.6% | 2015-10-05 |
| CVE-2002-1119os._execvpe from os.py in Python 2.2.1 and earlier creates temporary files with predictable names, which could allow local users to execute arbitrary code via a symlink attack. | Python · Python | Unlikely | – | 0.5% | 2004-09-01 |
| CVE-2014-1604The parser cache functionality in parsergenerator.py in RPLY (aka python-rply) before 0.7.1 allows local users to spoof cache data by pre-creating a temporary rply-*.json file wit… | Python · Rply | Unlikely | – | 0.4% | 2014-01-28 |
| CVE-2023-6597An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory cla… | Python Software Foundation · CPython | Unlikely | 7.8 | 0.3% | 2024-03-19 |
| CVE-2026-115559imaplib STARTTLS serves plaintext bytes buffered before the handshake as if they came over TLS | Python Software Foundation · CPython | Unlikely | 6.3 | 0.3% | 2026-11-10 |
Exploitation: exploited (CISA KEV), a public nuclei check, then EPSS: likely 10% or more, possible 1 to 10%, unlikely under 1%. Data as of 2026-11-15.