CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 08:20 UTC)

What this means for you

This week: 5,438 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,438; Show in the list
Critical, last 7 days: 355; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product python:python. Show all products

66 CVEs, showing 51 to 66PreviousPage 2 of 2

CVE	Severity	Title	Published
CVE-2022-48560	High 7.5	A use-after-free exists in Python through 3.9 via heappushpop in heapq. Assigned by mitre	Aug 22, 2023
CVE-2025-6075	Medium 5.5	If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.	Oct 31, 2025
CVE-2025-13836	High 7.5	When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length.	Dec 1, 2025
CVE-2025-13837	Medium 5.5	When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues	Dec 1, 2025
CVE-2025-12084	Medium 5.3	When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic.	Dec 3, 2025
CVE-2025-12781	Medium 5.3	When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars"…	Jan 21, 2026
CVE-2025-13462	Low 3.3	The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK.	Mar 12, 2026
CVE-2026-3644	High 7.5	The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete.	Mar 16, 2026
CVE-2026-4224	High 7.5	When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.	Mar 16, 2026
CVE-2026-4519	Low 3.3	The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers.	Mar 20, 2026
CVE-2026-6019	Medium 6.1	http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context.	Apr 22, 2026
CVE-2026-3087	High 7.5	If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different tha…	Apr 27, 2026
CVE-2026-7210	High 7.5	`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this…	May 11, 2026
CVE-2026-0864	Medium 5.5	When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file could be injected with unexpected keys and…	Jun 23, 2026
CVE-2026-4360	Medium 5.3	In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks.	Jun 30, 2026
CVE-2026-15308	High 7.5	The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.	Jul 9, 2026

PreviousPage 2 of 2

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.