CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 07:23 UTC)

What this means for you

This week: 5,443 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,443; Show in the list
Critical, last 7 days: 355; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product python:python. Show all products

66 CVEs, showing 1 to 50Page 1 of 2Next

CVE	Severity	Title	Published
CVE-2013-0340	Medium 6.8	expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of s… Assigned by redhat	Jan 21, 2014
CVE-2016-0718	Critical 9.8	Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow. Assigned by redhat	May 26, 2016
CVE-2016-3189	Medium 6.5	Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the… Assigned by mitre	Jun 30, 2016
CVE-2016-4472	High 8.1	The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via… Assigned by redhat	Jun 30, 2016
CVE-2017-9233	High 7.5	XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an… Assigned by mitre	Jul 25, 2017
CVE-2017-1000158	Critical 9.8	CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code ex… Assigned by mitre	Nov 17, 2017
CVE-2018-1000030	Low 3.6	Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Assigned by mitre	Feb 8, 2018
CVE-2016-9063	Critical 9.8	An integer overflow during the parsing of XML using the Expat library. Assigned by mozilla	Jun 11, 2018
CVE-2018-1060	Medium 4.3	python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. Assigned by redhat	Jun 18, 2018
CVE-2018-1061	Medium 6.5	python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method. Assigned by redhat	Jun 19, 2018
CVE-2018-1000802	Critical 9.8	Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_arc… Assigned by mitre	Sep 18, 2018
CVE-2018-14647	High 7.5	Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization.	Sep 25, 2018
CVE-2018-20406	High 7.5	Modules/_pickle.c in Python before 3.7.1 has an integer overflow via a large LONG_BINPUT value that is mishandled during a "resize to twice the size" attempt. Assigned by mitre	Dec 23, 2018
CVE-2019-9636	Medium 5.3	Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. Assigned by mitre	Mar 8, 2019
CVE-2019-9740	Medium 6.5	An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. Assigned by mitre	Mar 13, 2019
CVE-2019-9947	Medium 5.4	An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. Assigned by mitre	Mar 23, 2019
CVE-2019-9948	Critical 9.1	urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggerin… Assigned by mitre	Mar 23, 2019
CVE-2019-10160	Critical 9.8	A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which s… Assigned by redhat	Jun 7, 2019
CVE-2019-12900	Critical 9.8	BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors. Assigned by mitre	Jun 19, 2019
CVE-2018-20852	Medium 4.3	http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong serv…	Jul 13, 2019
CVE-2019-15903	Medium 6.5	In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumn… Assigned by mitre	Sep 4, 2019
CVE-2019-16056	Medium 5.3	An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. Assigned by mitre	Sep 6, 2019
CVE-2019-16935	Medium 6.1	The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field.	Sep 28, 2019
CVE-2019-18348	Medium 5.4	An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. Assigned by mitre	Oct 23, 2019
CVE-2019-5010	High 7.5	An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6.	Oct 31, 2019
CVE-2020-8315	Medium 5.5	In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load upon launch on Windows 7 may result in an attacker's copy of api-ms-win-core-path-l1-1-0.… Assigned by mitre	Jan 28, 2020
CVE-2020-8492	Medium 6.5	Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks agains… Assigned by mitre	Jan 30, 2020
CVE-2019-9674	High 7.5	Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb. Assigned by mitre	Feb 4, 2020
CVE-2020-14422	Medium 5.9	Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an applica… Assigned by mitre	Jun 18, 2020
CVE-2020-15523	High 7.8	In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan horse python3.dll might be used in cases where CPython is embedded in a native appl… Assigned by mitre	Jul 4, 2020
CVE-2019-20907	Medium 5.5	In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation. Assigned by mitre	Jul 13, 2020
CVE-2020-15801	Critical 9.8	In Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. Assigned by mitre	Jul 17, 2020
CVE-2020-26116	High 7.2	http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by ins… Assigned by mitre	Sep 27, 2020
CVE-2020-27619	Critical 9.8	In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP. Assigned by mitre	Oct 22, 2020
CVE-2021-3177	Critical 9.8	Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untru… Assigned by mitre	Jan 19, 2021
CVE-2021-23336	Medium 5.9	Web Cache Poisoning Assigned by snyk	Feb 15, 2021
CVE-2021-29921	Critical 9.8	In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. Assigned by mitre	May 6, 2021
CVE-2021-3426	Medium 5.7	There's a flaw in Python 3's pydoc. Assigned by redhat	May 20, 2021
CVE-2022-0391	High 7.5	A flaw was found in Python, specifically within the urllib.parse module. Assigned by redhat	Feb 9, 2022
CVE-2021-3737	High 7.5	A flaw was found in python. Assigned by redhat	Mar 4, 2022
CVE-2021-3733	Medium 6.5	There's a flaw in urllib's AbstractBasicAuthHandler class. Assigned by redhat	Mar 7, 2022
CVE-2022-26488	High 7.0	In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. Assigned by mitre	Mar 7, 2022
CVE-2018-25032	High 7.5	zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches. Assigned by mitre	Mar 25, 2022
CVE-2015-20107	High 7.8	In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. Assigned by mitre	Apr 13, 2022
CVE-2021-28861	Medium 6.5	Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. Assigned by mitre	Aug 23, 2022
CVE-2021-4189	Medium 5.3	A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. Assigned by redhat	Aug 24, 2022
CVE-2020-10735	Medium 6.2	A flaw was found in python. Assigned by redhat	Sep 9, 2022
CVE-2022-37454	Critical 9.8	The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic… Assigned by mitre	Oct 21, 2022
CVE-2022-45061	High 7.5	An issue was discovered in Python before 3.11.1. Assigned by mitre	Nov 9, 2022
CVE-2023-24329	High 7.5	An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters. Assigned by mitre	Feb 17, 2023

Page 1 of 2Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.