CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 07:23 UTC)

What this means for you

This week: 5,443 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,443; Show in the list
Critical, last 7 days: 355; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product python:python. Show all products

66 CVEs, showing 51 to 66PreviousPage 2 of 2

CVE	Severity	Title	Published
CVE-2019-9947	Medium 5.4	An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. Assigned by mitre	Mar 23, 2019
CVE-2019-9740	Medium 6.5	An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. Assigned by mitre	Mar 13, 2019
CVE-2019-9636	Medium 5.3	Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. Assigned by mitre	Mar 8, 2019
CVE-2018-20406	High 7.5	Modules/_pickle.c in Python before 3.7.1 has an integer overflow via a large LONG_BINPUT value that is mishandled during a "resize to twice the size" attempt. Assigned by mitre	Dec 23, 2018
CVE-2018-14647	High 7.5	Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization.	Sep 25, 2018
CVE-2018-1000802	Critical 9.8	Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_arc… Assigned by mitre	Sep 18, 2018
CVE-2018-1061	Medium 6.5	python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method. Assigned by redhat	Jun 19, 2018
CVE-2018-1060	Medium 4.3	python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. Assigned by redhat	Jun 18, 2018
CVE-2016-9063	Critical 9.8	An integer overflow during the parsing of XML using the Expat library. Assigned by mozilla	Jun 11, 2018
CVE-2018-1000030	Low 3.6	Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Assigned by mitre	Feb 8, 2018
CVE-2017-1000158	Critical 9.8	CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code ex… Assigned by mitre	Nov 17, 2017
CVE-2017-9233	High 7.5	XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an… Assigned by mitre	Jul 25, 2017
CVE-2016-3189	Medium 6.5	Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the… Assigned by mitre	Jun 30, 2016
CVE-2016-4472	High 8.1	The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via… Assigned by redhat	Jun 30, 2016
CVE-2016-0718	Critical 9.8	Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow. Assigned by redhat	May 26, 2016
CVE-2013-0340	Medium 6.8	expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of s… Assigned by redhat	Jan 21, 2014

PreviousPage 2 of 2

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.