CVEs
Every published CVE. Without a filter the list holds those exploited, with a public check, or likely to be exploited; pick a year and month or a vendor for the rest.
| CVE | Vendor · product | Exploitation | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2016-2183The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which ma… | Python · Python | Likely | 7.5 | 95% | 2016-09-01 |
| CVE-2014-1912Buffer overflow in the socket.recvfrom_into function in Modules/socketmodule.c in Python 2.5 before 2.7.7, 3.x before 3.3.4, and 3.4.x before 3.4rc1 allows remote attackers to exe… | Python · Python | Likely | – | 27% | 2014-02-28 |
| CVE-2007-4559Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary file… | Python · Python | Likely | 9.8 | 27% | 2007-08-28 |
| CVE-2016-5636Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 allows remote attackers to have unspecifie… | Python · Python | Likely | – | 25% | 2016-09-02 |
| CVE-2021-3177Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-po… | Python · Python | Likely | 9.8 | 24% | 2021-01-19 |
| CVE-2014-4650The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script so… | Python · Python | Likely | – | 24% | 2020-02-20 |
| CVE-2008-1721Integer signedness error in the zlib extension module in Python 2.5.2 and earlier allows remote attackers to execute arbitrary code via a negative signed integer, which triggers i… | Python · Python | Likely | – | 23% | 2008-04-10 |
| CVE-2008-4864Multiple integer overflows in imageop.c in the imageop module in Python 1.5.2 through 2.5.1 allow context-dependent attackers to break out of the Python VM and execute arbitrary c… | Python · Python | Likely | – | 21% | 2008-10-31 |
| CVE-2019-5010An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL poi… | Python · Python | Likely | 5.9 | 21% | 2019-10-31 |
| CVE-2023-24329An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters. | Python · Python | Likely | 7.5 | 20% | 2023-02-17 |
| CVE-2018-1000802Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shu… | Python · Python | Likely | – | 20% | 2018-09-18 |
| CVE-2016-0772The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an error when StartTLS fails, which might allow man-in-the-midd… | Python · Python | Likely | – | 15% | 2016-09-02 |
| CVE-2010-2089The audioop module in Python 2.7 and 3.2 does not verify the relationships between size arguments and byte string lengths, which allows context-dependent attackers to cause a deni… | Python · Python | Likely | – | 15% | 2010-05-27 |
| CVE-2007-2052Off-by-one error in the PyLocale_strxfrm function in Modules/_localemodule.c for Python 2.4 and 2.5 causes an incorrect buffer size to be used for the strxfrm function, which allo… | Python · Python | Likely | – | 14% | 2007-04-16 |
| CVE-2007-4965Multiple integer overflows in the imageop module in Python 2.5.1 and earlier allow context-dependent attackers to cause a denial of service (application crash) and possibly obtain… | Python · Python | Likely | – | 14% | 2007-09-18 |
| CVE-2021-3737A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client scr… | Python · python | Likely | 7.5 | 13% | 2022-03-04 |
| CVE-2020-14422Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of s… | Python · Python | Likely | – | 13% | 2020-06-18 |
| CVE-2019-9948urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demon… | Python · Python | Likely | 9.1 | 12% | 2019-03-23 |
| CVE-2018-14647Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by cons… | The Python Project · Python | Likely | 5.3 | 11% | 2018-09-25 |
| CVE-2016-5699CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) before 2.7.10 and 3.x before 3.4.4 allows remote attackers to i… | Python · Python | Possible | – | 9.9% | 2016-09-02 |
| CVE-2022-0391A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the… | Python · python | Possible | 7.5 | 8.5% | 2022-02-09 |
| CVE-2020-27619In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP. | Python · Python | Possible | – | 8.3% | 2020-10-22 |
| CVE-2017-1000158CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possib… | Python · Python | Possible | – | 7.9% | 2017-11-17 |
| CVE-2014-4616Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process… | Python · Python | Possible | – | 7.8% | 2017-08-24 |
| CVE-2019-9636Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Inform… | Python · Python | Possible | 5.3 | 7.7% | 2019-03-08 |
| CVE-2021-29921In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access… | Python · Python | Possible | – | 6.8% | 2021-05-06 |
| CVE-2020-8492Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (R… | Python · Python | Possible | 6.5 | 6.6% | 2020-01-30 |
| CVE-2020-26116http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as… | Python · Python | Possible | – | 6.4% | 2020-09-27 |
| CVE-2008-1887Python 2.5.2 and earlier allows context-dependent attackers to execute arbitrary code via multiple vectors that cause a negative size value to be provided to the PyString_FromStri… | Python · Python | Possible | – | 6.3% | 2008-04-18 |
| CVE-2005-0089The SimpleXMLRPCServer library module in Python 2.2, 2.3 before 2.3.5, and 2.4, when used by XML-RPC servers that use the register_instance method to register an object without a… | Python · Python | Possible | – | 6.0% | 2005-02-06 |
| CVE-2018-20406Modules/_pickle.c in Python before 3.7.1 has an integer overflow via a large LONG_BINPUT value that is mishandled during a "resize to twice the size" attempt. This issue might cau… | Python · Python | Possible | – | 5.8% | 2018-12-23 |
| CVE-2019-9674Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb. | Python · Python | Possible | – | 5.6% | 2020-02-04 |
| CVE-2006-4980Buffer overflow in the repr function in Python 2.3 through 2.6 before 20060822 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code… | Python · Python | Possible | – | 5.6% | 2006-10-09 |
| CVE-2019-9740An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as dem… | Python · Python | Possible | 6.5 | 5.4% | 2019-03-13 |
| CVE-2012-0845SimpleXMLRPCServer.py in SimpleXMLRPCServer in Python before 2.6.8, 2.7.x before 2.7.3, 3.x before 3.1.5, and 3.2.x before 3.2.3 allows remote attackers to cause a denial of servi… | Python · Python | Possible | – | 5.4% | 2012-10-05 |
| CVE-2013-4238The ssl.match_hostname function in the SSL module in Python 2.6 through 3.4 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an… | Python · Python | Possible | – | 5.3% | 2013-08-18 |
| CVE-2019-9947An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as dem… | Python · Python | Possible | 5.4 | 5.3% | 2019-03-23 |
| CVE-2022-48565An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilitie… | Python · Python | Possible | – | 5.2% | 2023-08-22 |
| CVE-2019-10160A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 throu… | Python · python | Possible | 9.8 | 5.2% | 2019-06-07 |
| CVE-2014-7185Integer overflow in bufferobject.c in Python before 2.7.8 allows context-dependent attackers to obtain sensitive information from process memory via a large size and offset in a "… | Python · Python | Possible | – | 5.1% | 2014-10-08 |
| CVE-2019-16056An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain mul… | Python · Python | Possible | 5.3 | 5.1% | 2019-09-06 |
| CVE-2004-0150Buffer overflow in the getaddrinfo function in Python 2.2 before 2.2.2, when IPv6 support is disabled, allows remote attackers to execute arbitrary code via an IPv6 address that i… | Python · Python | Possible | – | 5.1% | 2004-09-01 |
| CVE-2012-1150Python before 2.6.8, 2.7.x before 2.7.3, 3.x before 3.1.5, and 3.2.x before 3.2.3 computes hash values without restricting the ability to trigger hash collisions predictably, whic… | Python · Python | Possible | – | 5.1% | 2012-10-05 |
| CVE-2013-7338Python before 3.3.4 RC1 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a file size value larger than the size of the zip file to the… | Python · Python | Possible | – | 5.1% | 2014-04-22 |
| CVE-2018-1060python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause… | Python · python | Possible | 4.3 | 5.0% | 2018-06-18 |
| CVE-2010-1450Multiple buffer overflows in the RLE decoder in the rgbimg module in Python 2.5 allow remote attackers to have an unspecified impact via an image file containing crafted data that… | Python · Python | Possible | – | 4.9% | 2010-05-27 |
| CVE-2010-1449Integer overflow in rgbimgmodule.c in the rgbimg module in Python 2.5 allows remote attackers to have an unspecified impact via a large image that triggers a buffer overflow. NOTE… | Python · Python | Possible | – | 4.9% | 2010-05-27 |
| CVE-2013-2099Algorithmic complexity vulnerability in the ssl.match_hostname function in Python 3.2.x, 3.3.x, and earlier, and unspecified versions of python-backports-ssl_match_hostname as use… | Python · Python | Possible | – | 4.9% | 2013-10-09 |
| CVE-2021-3733There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a… | Python · python | Possible | – | 4.8% | 2022-03-07 |
| CVE-2018-1061python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method. An attacker could use this flaw t… | Python · python | Possible | 6.5 | 4.7% | 2018-06-19 |
Exploitation: exploited (CISA KEV), a public nuclei check, then EPSS: likely 10% or more, possible 1 to 10%, unlikely under 1%. Data as of 2026-11-15.