Skip to content

Vendor

python vulnerabilities

315 published CVES affecting python, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
315
Critical
36
High
143
Medium
120
Low
16
Unscored
0
CISA KEV
0
Atom feed of python alerts

Products

Latest python CVEs

Newest publication first · page 4 of 13

  3. CVE-2026-31900 Black's vulnerable version parsing leads to RCE in GitHub Action

    Published
    HighCVSS 8.7 EPSS 0.52%

    Black is the uncompromising Python code formatter. Black provides a GitHub action for formatting code. This action supports an option, use_pyproject: true, for reading the version of Black to use from the repository pyproject.toml. A malicious pull request could edit pyproject.to...

  5. CVE-2026-0994 Denial of Service in Python Protobuf

    Published
    HighCVSS 8.2 EPSS 0.71%

    A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the internal Any-handling lo...

  8. CVE-2025-66471 urllib3 Streaming API improperly handles highly compressed data

    Published
    HighCVSS 8.9 EPSS 0.73%

    urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chu...

  10. CVE-2025-12084 Quadratic complexity in node ID cache clearing

    Published
    MediumCVSS 6.3 EPSS 0.86%

    When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.

  11. CVE-2025-13837 Out-of-memory when loading Plist

    Published
    LowCVSS 2.1 EPSS 0.24%

    When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues

  12. CVE-2025-13836 Excessive read buffering DoS in http.client

    Published
    MediumCVSS 6.3 EPSS 1.7%

    When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.

  14. CVE-2025-48379 Pillow Vulnerable to Write Buffer Overflow on BCn encoding

    Published
    MediumCVSS 5.5 EPSS 0.33%

    Pillow is a Python imaging library. In versions 11.2.0 to before 11.3.0, there is a heap buffer overflow when writing a sufficiently large (>64k encoded with default settings) image in the DDS format due to writing into a buffer without checking for available space. This only aff...

  15. CVE-2025-50182 urllib3 does not control redirects in browsers and Node.js

    Published
    MediumCVSS 6.1 EPSS 0.60%

    urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpReque...

  19. CVE-2024-9287 Virtual environment (venv) activation scripts don't quote paths

    Published
    MediumCVSS 5.3 EPSS 0.65%

    A vulnerability has been found in the CPython venv module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This me...

  21. CVE-2024-7592 Quadratic complexity parsing cookies with backslashes

    Published
    HighCVSS 7.5 EPSS 2.3%

    There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in e...

  22. CVE-2024-6923 Email header injection due to unquoted newlines

    Published
    MediumCVSS 5.5 EPSS 1.1%

    There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized.

  23. CVE-2024-6345 Remote Code Execution in pypa/setuptools

    Published
    HighCVSS 8.8 EPSS 1.9%

    A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are suscepti...

  25. CVE-2024-4032 Incorrect IPv4 and IPv6 private ranges

    Published
    HighCVSS 7.5 EPSS 1.1%

    The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Addr...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.