Vulnerabilidades en Python Software Foundation
81 resultadosCVE-2026-115557CRITICALDistrust compromised intermediate certificates in ssl moduleEPSS 0.5%CVE-2026-15806MEDIUM`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matchingEPSS 0.5%CVE-2026-15310LOWzipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limitsEPSS 0.5%CVE-2026-19445CRITICALUse-after-free of a server-side SSLContext when sni_callback switches contextsEPSS 0.5%CVE-2026-3644MEDIUMIncomplete control character validation in http.cookiesEPSS 0.5%CVE-2026-3276MEDIUMPotential DoS via quadratic complexity in unicodedata.normalize()EPSS 0.5%CVE-2026-4360LOWTarfile.extract() doesn't fully respect filter parameterEPSS 0.5%CVE-2026-0672MEDIUMHeader injection in http.cookies.MorselEPSS 0.5%CVE-2026-19672MEDIUMtarfile extraction filter bypass allows creation of directories outside the destinationEPSS 0.5%CVE-2025-8291MEDIUMZIP64 End of Central Directory (EOCD) Locator record offset not checkedEPSS 0.5%CVE-2026-8328MEDIUMFTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host addressEPSS 0.5%CVE-2025-15366MEDIUMIMAP command injection in user-controlled commandsEPSS 0.4%CVE-2026-9669HIGHbz2.BZ2Decompressor reuse after error can cause a stack buffer overflowEPSS 0.4%CVE-2026-3298HIGHOut-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytesEPSS 0.4%CVE-2025-15367MEDIUMPOP3 command injection in user-controlled commandsEPSS 0.4%CVE-2026-103995LOWLenient parsing of integers for response body and chunk framingEPSS 0.4%CVE-2026-6879LOWQuadratic Behavior in xml.etree.ElementPath Index PredicatesEPSS 0.4%CVE-2026-12345MEDIUMRace condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directoryEPSS 0.3%CVE-2024-0450MEDIUMQuoted zip-bomb protection for zipfileEPSS 0.3%CVE-2026-4519HIGHwebbrowser.open() allows leading dashes in URLsEPSS 0.3%