Python Software Foundation

Products

Exploited and recent CVEs

• CVE-2026-119170 High 8.2 Regression in FIPS enforcement of hash algorithms affecting only Python 3.14.10 –
• CVE-2026-116566 Medium 5.3 socket.getaddrinfo() accepts embedded null bytes in host and port 0.3%
• CVE-2026-103995 Low 2.0 Lenient parsing of integers for response body and chunk framing 0.4%
• CVE-2026-115557 Critical 9.4 Distrust compromised intermediate certificates in ssl module 0.5%
• CVE-2026-114583 Medium 6.9 tar filter allows writing outside destination via empty-named symlink 0.3%
• CVE-2026-19553 High 7.6 SSLContext.wrap_bio() missing validation of server_hostname parameter 0.5%
• CVE-2026-19445 Critical 9.2 Use-after-free of a server-side SSLContext when sni_callback switches contexts 0.5%
• CVE-2026-12345 Medium 5.9 Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory 0.3%
• CVE-2026-82049 High 8.4 tarfile extraction filters allow file modification and content disclosure via hard link to symlink 0.2%
• CVE-2026-87910 Medium 5.7 tarfile hardlink fallback ignores custom extraction filter rejection via None 0.6%
• CVE-2026-15310 Low 2.1 zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits 0.5%
• CVE-2026-19672 Medium 6.3 tarfile extraction filter bypass allows creation of directories outside the destination 0.5%
• CVE-2026-15806 Medium 6.0 `HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching 0.5%
• CVE-2026-17084 Medium 6.0 stringprep.map_table_b2() deviates from RFC 3454 Table B.2 0.7%
• CVE-2026-18503 Low 2.4 Super-linear CPU usage for unbounded input to csv.Sniffer.sniff() 0.1%
• CVE-2026-6879 Low 2.0 Quadratic Behavior in xml.etree.ElementPath Index Predicates 0.4%
• CVE-2026-15308 High 8.7 Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations 0.6%
• CVE-2026-4360 Low 2.0 Tarfile.extract() doesn't fully respect filter parameter 0.5%
• CVE-2026-11972 High 8.2 tarfile opened in streaming mode mishandles EOF 0.7%
• CVE-2026-0864 Medium 4.1 Configuration Injection via Carriage Return (\r) in write() method 0.1%
• CVE-2026-11940 High 7.8 tarfile extraction filter bypass allows escaping the destination directory 0.8%
• CVE-2026-12003 Medium 5.3 CPython >3.11 Insecure Input Validation resulting in privilege escalation 0.1%
• CVE-2026-9669 High 8.2 bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow 0.4%
• CVE-2026-7774 Medium 6.9 tarfile.data_filter path traversal bypass allows writing outside the extraction directory 0.6%
• CVE-2026-3276 Medium 6.3 Potential DoS via quadratic complexity in unicodedata.normalize() 0.5%
• CVE-2026-8328 Medium 5.9 FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address 0.5%
• CVE-2026-7210 Medium 6.3 The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection 0.7%
• CVE-2026-3087 Medium 6.0 shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs 0.6%
• CVE-2026-6019 Low 2.1 BaseCookie.js_output() does not neutralize embedded characters 0.2%
• CVE-2026-3298 High 8.8 Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes 0.4%