CVEs
Every published CVE. Without a filter the list holds those exploited, with a public check, or likely to be exploited; pick a year and month or a vendor for the rest.
| CVE | Vendor · product | Exploitation | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2007-1657Stack-based buffer overflow in the file_compress function in minigzip (Modules/zlib) in Python 2.5 allows context-dependent attackers to execute arbitrary code via a long file arg… | Python Software Foundation · Python | Possible | – | 4.7% | 2007-03-24 |
| CVE-2019-17514library/glob.html in the Python 2 and 3 documentation before 2016 has potentially misleading information about whether sorting occurs, as demonstrated by irreproducible cancer-res… | Python · Python | Possible | – | 4.7% | 2019-10-12 |
| CVE-2019-16935The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in… | Python · Python | Possible | 6.1 | 4.7% | 2019-09-28 |
| CVE-2012-2135The utf-16 decoder in Python 3.1 through 3.3 does not update the aligned_end variable after calling the unicode_decode_call_errorhandler function, which allows remote attackers to… | Python · Python | Possible | – | 4.5% | 2012-08-14 |
| CVE-2020-10735A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,0… | Python · python | Possible | 6.2 | 4.5% | 2022-09-09 |
| CVE-2016-1000110The CGIHandler class in Python before 2.7.12 does not protect against the HTTP_PROXY variable name clash in a CGI script, which could allow a remote attacker to redirect HTTP requ… | Python · Python | Possible | – | 4.5% | 2019-11-27 |
| CVE-2008-3142Multiple buffer overflows in Python 2.5.2 and earlier on 32bit platforms allow context-dependent attackers to cause a denial of service (crash) or have unspecified other impact vi… | Python · Python | Possible | – | 4.5% | 2008-08-01 |
| CVE-2009-4134Buffer underflow in the rgbimg module in Python 2.5 allows remote attackers to cause a denial of service (application crash) via a large ZSIZE value in a black-and-white (aka B/W)… | Python · Python | Possible | – | 4.4% | 2010-05-27 |
| CVE-2008-2315Multiple integer overflows in Python 2.5.2 and earlier allow context-dependent attackers to have an unknown impact via vectors related to the (1) stringobject, (2) unicodeobject,… | Python · Python | Possible | – | 4.4% | 2008-08-01 |
| CVE-2008-3144Multiple integer overflows in the PyOS_vsnprintf function in Python/mysnprintf.c in Python 2.5.2 and earlier allow context-dependent attackers to cause a denial of service (memory… | Python · Python | Possible | – | 4.2% | 2008-08-01 |
| CVE-2010-1634Multiple integer overflows in audioop.c in the audioop module in Python 2.6, 2.7, 3.1, and 3.2 allow context-dependent attackers to cause a denial of service (application crash) v… | Python · Python | Possible | – | 4.2% | 2010-05-27 |
| CVE-2008-2316Integer overflow in _hashopenssl.c in the hashlib module in Python 2.5.2 and earlier might allow context-dependent attackers to defeat cryptographic digests, related to "partial h… | Python · Python | Possible | – | 4.1% | 2008-08-01 |
| CVE-2008-1679Multiple integer overflows in imageop.c in Python before 2.5.3 allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via craft… | Python · Python | Possible | – | 4.1% | 2008-04-21 |
| CVE-2011-1015The is_cgi method in CGIHTTPServer.py in the CGIHTTPServer module in Python 2.5, 2.6, and 3.0 allows remote attackers to read script source code via an HTTP GET request that lacks… | Python · Python | Possible | – | 3.8% | 2011-05-09 |
| CVE-2018-20852http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cooki… | Python · Python | Possible | 4.3 | 3.7% | 2019-07-13 |
| CVE-2020-15801In Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The <executable-name>._pth file (e.g., t… | Python · Python | Possible | – | 3.6% | 2020-07-17 |
| CVE-2017-17522Lib/webbrowser.py in Python through 3.6.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers… | Python · Python | Possible | – | 3.6% | 2017-12-14 |
| CVE-2011-1521The urllib and urllib2 modules in Python 2.x before 2.7.2 and 3.x before 3.2.1 process Location headers that specify redirection to file: URLs, which makes it easier for remote at… | Python · Python | Possible | – | 3.6% | 2011-05-24 |
| CVE-2019-18348An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as dem… | Python · Python | Possible | 5.4 | 3.5% | 2019-10-23 |
| CVE-2013-1753The gzip_decode function in the xmlrpc client library in Python 3.4 and earlier allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP reques… | Python · Python | Possible | – | 3.5% | 2020-03-11 |
| CVE-2010-3492The asyncore module in Python before 3.2 does not properly handle unsuccessful calls to the accept function, and does not have accompanying documentation describing how daemon app… | Python · Python | Possible | – | 3.4% | 2010-10-19 |
| CVE-2022-45061An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a craf… | Python · Python | Possible | 7.5 | 3.3% | 2022-11-09 |
| CVE-2011-4940The list_directory function in Lib/SimpleHTTPServer.py in SimpleHTTPServer in Python before 2.5.6c1, 2.6.x before 2.6.7 rc2, and 2.7.x before 2.7.2 does not place a charset parame… | Python · Python | Possible | – | 3.2% | 2012-06-27 |
| CVE-2013-7040Python 2.7 before 3.4 only uses the last eight bits of the prefix to randomize hash values, which causes it to compute hash values without restricting the ability to trigger hash… | Python · Python | Possible | – | 3.1% | 2014-05-19 |
| CVE-2008-3143Multiple integer overflows in Python before 2.5.2 might allow context-dependent attackers to have an unknown impact via vectors related to (1) Include/pymem.h; (2) _csv.c, (3) _st… | Python · Python | Possible | – | 3.1% | 2008-08-01 |
| CVE-2014-9365The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS UR… | Python · Python | Possible | – | 3.0% | 2014-12-12 |
| CVE-2008-5031Multiple integer overflows in Python 2.2.3 through 2.5.1, and 2.6, allow context-dependent attackers to have an unknown impact via a large integer value in the tabsize argument to… | Python · Python | Possible | – | 3.0% | 2008-11-10 |
| CVE-2019-20907In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header valid… | Python · Python | Possible | 5.5 | 3.0% | 2020-07-13 |
| CVE-2021-28861Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to infor… | Python · Python | Possible | 6.5 | 2.8% | 2022-08-23 |
| CVE-2010-3493Multiple race conditions in smtpd.py in the smtpd module in Python 2.6, 2.7, 3.1, and 3.2 alpha allow remote attackers to cause a denial of service (daemon outage) by establishing… | Python · Python | Possible | – | 2.8% | 2010-10-19 |
| CVE-2015-20107In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject she… | Python · Python | Possible | 7.8 | 2.8% | 2022-04-13 |
| CVE-2023-41105An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath(), the path will be truncated unexpectedly at the first '\0' b… | Python · Python | Possible | – | 2.6% | 2023-08-23 |
| CVE-2023-27043The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value o… | Python · Python | Possible | 5.3 | 2.5% | 2023-04-18 |
| CVE-2013-7440The ssl.match_hostname function in CPython (aka Python) before 2.7.9 and 3.x before 3.3.3 does not properly handle wildcards in hostnames, which might allow man-in-the-middle atta… | Python · Python | Possible | – | 1.9% | 2016-06-07 |
| CVE-2021-3426There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the serve… | Python · python | Possible | 5.7 | 1.9% | 2021-05-20 |
| CVE-2023-38898An issue in Python cpython v.3.7 allows an attacker to obtain sensitive information via the _asyncio._swap_current_task component. NOTE: this is disputed by the vendor because (1)… | Python · Python | Possible | – | 1.7% | 2023-08-15 |
| CVE-2022-48564read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary f… | Python · Python | Possible | – | 1.7% | 2023-08-22 |
| CVE-2023-36632The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError: maximum recursion depth exceeded while calling a Python object" via… | Python · Python | Possible | – | 1.6% | 2023-06-25 |
| CVE-2022-26488In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. The installer may allow a local attacker to add user-writable… | Python · Python | Possible | – | 1.5% | 2022-03-07 |
| CVE-2020-8315In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load upon launch on Windows 7 may result in an attacker's copy of api-ms-w… | Python · Python | Possible | – | 1.5% | 2020-01-28 |
| CVE-2017-18207The Wave_read._read_fmt_chunk function in Lib/wave.py in Python through 3.6.4 does not ensure a nonzero channel value, which allows attackers to cause a denial of service (divide-… | Python · Python | Possible | – | 1.3% | 2018-03-01 |
| CVE-2017-20052Python pgAdmin4 uncontrolled search path | Python · Python | Possible | 5.0 | 1.3% | 2022-06-16 |
| CVE-2022-48566An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variable in hmac.compare_d… | Python · Python | Possible | – | 1.3% | 2023-08-22 |
| CVE-2019-13404The MSI installer for Python through 2.7.16 on Windows defaults to the C:\Python27 directory, which makes it easier for local users to deploy Trojan horse code. (This also affects… | Python · Python | Possible | – | 1.3% | 2019-07-08 |
| CVE-2018-1000030Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions prior to 2.7.14 may also be vulnerable and it appears that Python 2.7.17 an… | Python · Python | Possible | 3.6 | 1.2% | 2018-02-08 |
| CVE-2018-1000117Python Software Foundation CPython version From 3.2 until 3.6.4 on Windows contains a Buffer Overflow vulnerability in os.symlink() function on Windows that can result in Arbitrar… | Python · Python | Possible | – | 1.0% | 2018-03-07 |
| CVE-2020-15523In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan horse python3.dll might be used in cases where CPython is embed… | Python · Python | Unlikely | – | 0.9% | 2020-07-04 |
| CVE-2006-1542Stack-based buffer overflow in Python 2.4.2 and earlier, running on Linux 2.6.12.5 under gcc 4.0.3 with libc 2.3.5, allows local users to cause a "stack overflow," and possibly ga… | Python · Python | Unlikely | – | 0.9% | 2006-03-30 |
| CVE-2022-42919Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-default configuration. The Python multiprocessing library, when used with t… | Python · Python | Unlikely | 7.8 | 0.8% | 2022-11-06 |
| CVE-2023-40217An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use… | Python · Python | Unlikely | – | 0.8% | 2023-08-25 |
Exploitation: exploited (CISA KEV), a public nuclei check, then EPSS: likely 10% or more, possible 1 to 10%, unlikely under 1%. Data as of 2026-11-15.