Product by Open Source
Python
24 known vulnerabilities in Python (Open Source), 0 of them actively exploited (CISA KEV).
Key figures
24
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
2
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2007-4559 | Python Software Foundation CPython: Path Traversal | 9.8 | |
| High | CVE-2023-24329 | Python Software Foundation CPython: security vulnerability | 7.5 | |
| High | CVE-2022-45061 | Python Software Foundation CPython: Denial of Service | 7.5 | |
| High | CVE-2024-6232 | Regular-expression DoS when parsing TarFile headers | 7.5 | |
| Medium | CVE-2023-27043 | Python Software Foundation CPython: security vulnerability | 5.3 | |
| High | CVE-2025-4138 | Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory | 7.5 | |
| High | CVE-2026-15308 | Python Software Foundation CPython: Uncontrolled Resource Consumption | 7.5 | |
| Critical | CVE-2026-19445 | Use-after-free of a server-side SSLContext when sni_callback switches contexts | — | |
| High | CVE-2026-7210 | The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection | 7.5 | |
| High | CVE-2026-19553 | SSLContext.wrap_bio() missing validation of server_hostname parameter | — | |
| High | CVE-2022-42919 | Python Software Foundation CPython: Deserialization of Untrusted Data | 7.8 | |
| Medium | CVE-2025-12781 | base64.b64decode() always accepts "+/" characters, despite setting altchars | 5.3 | |
| Medium | CVE-2026-17084 | stringprep.map_table_b2() deviates from RFC 3454 Table B.2 | — | |
| Medium | CVE-2023-40217 | Python Software Foundation CPython: security vulnerability | 5.3 | |
| High | CVE-2026-4519 | webbrowser.open() allows leading dashes in URLs | 3.3 | |
| Medium | CVE-2026-15806 | `HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching | — | |
| Medium | CVE-2026-12345 | Python Software Foundation CPython: Race Condition | — | |
| Medium | CVE-2026-3276 | Potential DoS via quadratic complexity in unicodedata.normalize() | — | |
| Medium | CVE-2025-6075 | Quadratic complexity in os.path.expandvars() with user-controlled template | 5.5 | |
| Low | CVE-2024-3220 | Default mimetype known files writeable on Windows | — | |
| Low | CVE-2025-1795 | Mishandling of comma during folding and unicode-encoding of email headers | — | |
| Medium | CVE-2026-0864 | Configuration Injection via Carriage Return (\r) in write() method | 5.5 | |
| Low | CVE-2025-13462 | tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling | 3.3 | |
| Medium | CVE-2026-12003 | CPython >3.11 Insecure Input Validation resulting in privilege escalation | — |