Python Software Foundation CPython

• CVE-2026-119170 High 8.2 Regression in FIPS enforcement of hash algorithms affecting only Python 3.14.10 –
• CVE-2026-116566 Medium 5.3 socket.getaddrinfo() accepts embedded null bytes in host and port 0.3%
• CVE-2026-103995 Low 2.0 Lenient parsing of integers for response body and chunk framing 0.4%
• CVE-2026-115557 Critical 9.4 Distrust compromised intermediate certificates in ssl module 0.5%
• CVE-2026-114583 Medium 6.9 tar filter allows writing outside destination via empty-named symlink 0.3%
• CVE-2026-19553 High 7.6 SSLContext.wrap_bio() missing validation of server_hostname parameter 0.5%
• CVE-2026-19445 Critical 9.2 Use-after-free of a server-side SSLContext when sni_callback switches contexts 0.5%
• CVE-2026-12345 Medium 5.9 Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory 0.3%
• CVE-2026-82049 High 8.4 tarfile extraction filters allow file modification and content disclosure via hard link to symlink 0.2%
• CVE-2026-87910 Medium 5.7 tarfile hardlink fallback ignores custom extraction filter rejection via None 0.6%
• CVE-2026-15310 Low 2.1 zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits 0.5%
• CVE-2026-19672 Medium 6.3 tarfile extraction filter bypass allows creation of directories outside the destination 0.5%
• CVE-2026-15806 Medium 6.0 `HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching 0.5%
• CVE-2026-17084 Medium 6.0 stringprep.map_table_b2() deviates from RFC 3454 Table B.2 0.7%
• CVE-2026-18503 Low 2.4 Super-linear CPU usage for unbounded input to csv.Sniffer.sniff() 0.1%
• CVE-2026-6879 Low 2.0 Quadratic Behavior in xml.etree.ElementPath Index Predicates 0.4%
• CVE-2026-15308 High 8.7 Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations 0.6%
• CVE-2026-4360 Low 2.0 Tarfile.extract() doesn't fully respect filter parameter 0.5%
• CVE-2026-11972 High 8.2 tarfile opened in streaming mode mishandles EOF 0.7%
• CVE-2026-0864 Medium 4.1 Configuration Injection via Carriage Return (\r) in write() method 0.1%
• CVE-2026-11940 High 7.8 tarfile extraction filter bypass allows escaping the destination directory 0.8%
• CVE-2026-12003 Medium 5.3 CPython >3.11 Insecure Input Validation resulting in privilege escalation 0.1%
• CVE-2026-9669 High 8.2 bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow 0.4%
• CVE-2026-7774 Medium 6.9 tarfile.data_filter path traversal bypass allows writing outside the extraction directory 0.6%
• CVE-2026-3276 Medium 6.3 Potential DoS via quadratic complexity in unicodedata.normalize() 0.5%
• CVE-2026-8328 Medium 5.9 FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address 0.5%
• CVE-2026-7210 Medium 6.3 The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection 0.7%
• CVE-2026-3087 Medium 6.0 shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs 0.6%
• CVE-2026-6019 Low 2.1 BaseCookie.js_output() does not neutralize embedded characters 0.2%
• CVE-2026-3298 High 8.8 Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes 0.4%
• CVE-2026-5713 Medium 5.3 Out-of-bounds read/write during remote profiling and asyncio process introspection when connecting to malicious target 0.1%
• CVE-2026-4786 High 7.1 Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open() 0.3%
• CVE-2026-6100 High 8.1 Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure 0.6%
• CVE-2026-3446 Medium 6.0 Base64 decoding stops at first padded quad by default 0.2%
• CVE-2026-1502 Medium 5.7 HTTP client proxy tunnel headers not validated for CR/LF 0.6%
• CVE-2026-4519 High 7.1 webbrowser.open() allows leading dashes in URLs 0.3%
• CVE-2026-3479 None 0.0 pkgutil.get_data() does not enforce documented restrictions 0.3%
• CVE-2026-4224 Medium 6.0 Stack overflow parsing XML with deeply nested DTD content models 0.7%
• CVE-2026-3644 Medium 6.0 Incomplete control character validation in http.cookies 0.5%
• CVE-2025-13462 Low 2.0 tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling 0.2%
• CVE-2026-2297 Medium 5.7 SourcelessFileLoader does not use io.open_code() 0.2%
• CVE-2026-1299 Medium 6.0 email BytesGenerator header injection due to unquoted newlines 0.6%
• CVE-2025-12781 Medium 6.3 base64.b64decode() always accepts "+/" characters, despite setting altchars 0.9%
• CVE-2026-0672 Medium 6.0 Header injection in http.cookies.Morsel 0.5%
• CVE-2025-15367 Medium 5.9 POP3 command injection in user-controlled commands 0.4%
• CVE-2025-15366 Medium 5.9 IMAP command injection in user-controlled commands 0.4%
• CVE-2025-15282 Medium 6.0 Header injection via newlines in data URL mediatype 0.5%
• CVE-2026-0865 Medium 5.9 wsgiref.headers.Headers allows header newline injection 0.6%
• CVE-2025-11468 Medium 5.7 Folding email comments of unfoldable characters doesn't preserve parenthesis 0.6%
• CVE-2025-12084 Medium 6.3 Quadratic complexity in node ID cache clearing 0.9%