Vulnerabilities in Python Software Foundation

73 results
Vexday analysis

Com 63 CVEs catalogadas e nenhuma entrada no catálogo KEV da CISA, a Python Software Foundation apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que indica menor pressão imediata de ameaças em curso. Ainda assim, o volume recente chama atenção: 18 vulnerabilidades surgiram nos últimos 90 dias, sugerindo ritmo elevado de descoberta. O tipo de falha mais comum é CWE-22 (Path Traversal), que pode permitir acesso não autorizado ao sistema de arquivos quando explorado em contextos específicos. A CVE mais perigosa no momento, CVE-2024-7592, apresenta EPSS de 0,023 e, embora ainda não haja PoC amplamente difundida associada a ela, equipes que operam ambientes Python em produção devem acompanhar de perto a evolução das duas CVEs de severidade crítica catalogadas.

CVE-2026-0672MEDIUMHeader injection in http.cookies.MorselEPSS 0.5%CVE-2026-8328MEDIUMFTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host addressEPSS 0.5%CVE-2026-11972HIGHtarfile opened in streaming mode mishandles EOFEPSS 0.4%CVE-2026-87910MEDIUMtarfile hardlink fallback ignores custom extraction filter rejection via NoneEPSS 0.4%CVE-2025-15366MEDIUMIMAP command injection in user-controlled commandsEPSS 0.4%CVE-2026-19672MEDIUMtarfile extraction filter bypass allows creation of directories outside the destinationEPSS 0.4%CVE-2026-15806MEDIUM`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matchingEPSS 0.4%CVE-2026-15310LOWzipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limitsEPSS 0.4%CVE-2026-3298HIGHOut-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytesEPSS 0.4%CVE-2025-8291MEDIUMZIP64 End of Central Directory (EOCD) Locator record offset not checkedEPSS 0.4%CVE-2025-15367MEDIUMPOP3 command injection in user-controlled commandsEPSS 0.4%CVE-2026-6879LOWQuadratic Behavior in xml.etree.ElementPath Index PredicatesEPSS 0.4%CVE-2024-0450MEDIUMQuoted zip-bomb protection for zipfileEPSS 0.3%CVE-2023-6597HIGHAn issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and priEPSS 0.3%CVE-2026-4519HIGHwebbrowser.open() allows leading dashes in URLsEPSS 0.3%CVE-2024-4030HIGHtempfile.mkdtemp() may be readable and writeable by all users on WindowsEPSS 0.3%CVE-2026-4786HIGHIncomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()EPSS 0.3%CVE-2026-4360LOWTarfile.extract() doesn't fully respect filter parameterEPSS 0.3%CVE-2024-3219MEDIUMPure-Python fallback of socket.socketpair() doesn’t authenticate peer connectionEPSS 0.2%CVE-2026-3479NONEpkgutil.get_data() does not enforce documented restrictionsEPSS 0.2%