Skip to contentPython vulnerabilities
Newest
- python pillowPillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of serviceCVE-2026-59204Fix available8.7 High
- python, python software foundation cpython, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 moreIncremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarationsCVE-2026-15308Fix available8.7 High
- pypa setuptoolssetuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+CVE-2026-59890Fix available6.1 Medium
- python pillowPillow BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loadingCVE-2026-55379Fix available7.5 High
- python pillowPillow GdImageFile decompression bomb protection bypassCVE-2026-55380Fix available7.5 High
- python pillowPillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`CVE-2026-54060Fix available7.5 High
- python pillowPillow: PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loadingCVE-2026-54059Fix available7.5 High
- python pillowPillow: WindowsViewer.get_command() OS command injection via unescaped shell pathCVE-2026-55798Fix available4.5 Medium
- python, python software foundation cpython +1 moreTarfile.extract() doesn't fully respect filter parameterCVE-2026-4360Fix available2.0 Low
- python, python software foundation cpython +1 moreConfiguration Injection via Carriage Return (\r) in write() methodCVE-2026-0864Fix available4.1 Medium
- python, python software foundation cpython +1 moreThe expat and elementtree parsers use insufficient entropy for XML hash-flooding protectionCVE-2026-7210Fix available6.3 Medium
- python urllib3, red hat exploit intelligence, external secrets operator for red hat openshift +48 more +50 moreurllib3: Decompression-bomb safeguards bypassed in parts of the streaming APICVE-2026-44432Fix available8.9 High
- python urllib3urllib3: Sensitive headers forwarded across origins in proxied low-level redirectsCVE-2026-44431Fix available8.2 High
- python pillowPillow: OOB Write with Invalid PSD Tile Extents (Integer Overflow)CVE-2026-42311Fix available8.6 High
- python pillowPillow: PDF Parsing Trailer Infinite Loop (DoS)CVE-2026-42310Fix available5.1 Medium
- python pillowPillow: Integer overflow when processing fontsCVE-2026-42308Fix available5.1 Medium
- python pillowPillow: Heap buffer overflow with nested list coordinatesCVE-2026-42309Fix available5.1 Medium
- python, python software foundation cpython +1 moreshutil.unpack_archive() doesn't check for Windows absolute paths in ZIPsCVE-2026-3087Fix available6.0 Medium
- python, python software foundation cpython, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 moreBaseCookie.js_output() does not neutralize embedded charactersCVE-2026-6019Fix available2.1 Low
- python pillow, red hat lightspeed core, openshift lightspeed +27 more +29 morePillow is vulnerable to a FITS GZIP decompression bombCVE-2026-40192Fix available8.7 High
- python pymanagerPossible to hijack modules in current working directoryCVE-2026-52715.6 Medium
- psf requestsRequests has Insecure Temp File Reuse in its extract_zipped_paths() utility functionCVE-2026-25645Public exploitFix available4.4 Medium
- python, python software foundation cpython, red hat ai inference server 3.2 +24 more +26 morewebbrowser.open() allows leading dashes in URLsCVE-2026-4519Fix available7.0 High
- python, python software foundation cpython +1 moreStack overflow parsing XML with deeply nested DTD content modelsCVE-2026-4224Fix available6.0 Medium
- python, python software foundation cpython +1 moreIncomplete control character validation in http.cookiesCVE-2026-3644Fix available6.0 Medium
- psf black, red hat openshift lightspeed, ansible automation platform 2 +6 more +8 moreBlack: Arbitrary file writes from unsanitized user input in cache file nameCVE-2026-32274Fix available8.7 High
- python, python software foundation cpython +1 moretarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handlingCVE-2025-13462Fix available2.0 Low
- psf blackBlack's vulnerable version parsing leads to RCE in GitHub ActionCVE-2026-31900Public exploitFix available8.7 High
- python pillow, red hat openshift lightspeed, ai inference server +24 more +26 morePillow has an out-of-bounds write when loading PSD imagesCVE-2026-25990Fix available8.6 High
- google protobuf, red hat ai inference server 3.2, ai inference server 3.3 +14 more +16 moreDenial of Service in Python ProtobufCVE-2026-0994Public exploitFix available8.2 High
- python, python software foundation cpython +1 morebase64.b64decode() always accepts "+/" characters, despite setting altcharsCVE-2025-12781Fix available6.3 Medium
- python urllib3, red hat assisted installer for red hat openshift container platform 2, cert-manager operator for red hat openshift 1.18 +105 more +107 moreurllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)CVE-2026-21441Fix available8.9 High
- python urllib3urllib3 Streaming API improperly handles highly compressed dataCVE-2025-66471Fix available8.9 High
- python urllib3urllib3 allows an unbounded number of links in the decompression chainCVE-2025-66418Fix available8.9 High
- python, python software foundation cpython +1 moreQuadratic complexity in node ID cache clearingCVE-2025-12084Fix available6.3 Medium
- python, python software foundation cpython +1 moreOut-of-memory when loading PlistCVE-2025-13837Fix available2.1 Low
- python, python software foundation cpython +1 moreExcessive read buffering DoS in http.clientCVE-2025-13836Fix available6.3 Medium
- python, python software foundation cpython +1 moreQuadratic complexity in os.path.expandvars() with user-controlled templateCVE-2025-6075Fix available1.8 Low
- python pillowPillow Vulnerable to Write Buffer Overflow on BCn encodingCVE-2025-48379Fix available7.1 High
- python urllib3urllib3 does not control redirects in browsers and Node.jsCVE-2025-50182Fix available5.3 Medium
- python urllib3urllib3 redirects are not disabled when retries are disabled on PoolManager instantiationCVE-2025-50181Fix available5.3 Medium
- pypa setuptools, debian linux +1 moresetuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File WriteCVE-2025-47273Public exploitFix available7.7 High
- python protobufCrash due to uncontrolled recursion in protobuf crateCVE-2025-53605Fix available5.9 Medium
- aio-libs aiohttpaiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensionsCVE-2024-52304Fix available6.3 Medium
- python, python software foundation cpython +1 moreVirtual environment (venv) activation scripts don't quote pathsCVE-2024-9287Fix available5.3 Medium
- python cpython, python +1 moreRegular-expression DoS when parsing TarFile headersCVE-2024-6232Public exploitFix available7.5 High
- python cpython, python +1 moreQuadratic complexity parsing cookies with backslashesCVE-2024-7592Fix available7.5 High
- python cpythonEmail header injection due to unquoted newlinesCVE-2024-6923Fix available5.5 Medium
- pypa pypa/setuptools, python setuptools +1 moreRemote Code Execution in pypa/setuptoolsCVE-2024-6345Fix available8.8 High
- python urllib3, debian linux, netapp active iq unified manager +2 moreProxy-Authorization request header isn't stripped during cross-origin redirects in urllib3CVE-2024-37891Fix available4.4 Medium
- Show moreLoading…