Vulnerabilidades em Python Software Foundation

66 resultados
Análise Vexday

Com 63 CVEs catalogadas e nenhuma entrada no catálogo KEV da CISA, a Python Software Foundation apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que indica menor pressão imediata de ameaças em curso. Ainda assim, o volume recente chama atenção: 18 vulnerabilidades surgiram nos últimos 90 dias, sugerindo ritmo elevado de descoberta. O tipo de falha mais comum é CWE-22 (Path Traversal), que pode permitir acesso não autorizado ao sistema de arquivos quando explorado em contextos específicos. A CVE mais perigosa no momento, CVE-2024-7592, apresenta EPSS de 0,023 e, embora ainda não haja PoC amplamente difundida associada a ela, equipes que operam ambientes Python em produção devem acompanhar de perto a evolução das duas CVEs de severidade crítica catalogadas.

CVE-2026-4224MEDIUMStack overflow parsing XML with deeply nested DTD content modelsEPSS 0.6%CVE-2026-15308HIGHIncremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarationsEPSS 0.6%CVE-2025-8194HIGHTarfile infinite loop during parsing with negative member offsetEPSS 0.6%CVE-2025-1795LOWMishandling of comma during folding and unicode-encoding of email headersEPSS 0.6%CVE-2026-7774MEDIUMtarfile.data_filter path traversal bypass allows writing outside the extraction directoryEPSS 0.6%CVE-2026-6100CRITICALUse-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressureEPSS 0.6%CVE-2026-1502MEDIUMHTTP client proxy tunnel headers not validated for CR/LFEPSS 0.6%CVE-2026-1299MEDIUMemail BytesGenerator header injection due to unquoted newlinesEPSS 0.6%CVE-2025-11468MEDIUMFolding email comments of unfoldable characters doesn't preserve parenthesisEPSS 0.5%CVE-2026-3087MEDIUMshutil.unpack_archive() doesn't check for Windows absolute paths in ZIPsEPSS 0.5%CVE-2025-4435HIGHTarfile extracts filtered members when errorlevel=0EPSS 0.5%CVE-2025-12781MEDIUMbase64.b64decode() always accepts "+/" characters, despite setting altcharsEPSS 0.5%CVE-2024-3220LOWDefault mimetype known files writeable on WindowsEPSS 0.5%CVE-2026-3276MEDIUMPotential DoS via quadratic complexity in unicodedata.normalize()EPSS 0.5%CVE-2025-15282MEDIUMHeader injection via newlines in data URL mediatypeEPSS 0.5%CVE-2026-3644MEDIUMIncomplete control character validation in http.cookiesEPSS 0.5%CVE-2025-6069MEDIUMHTMLParser quadratic complexity when processing malformed inputsEPSS 0.5%CVE-2026-0865MEDIUMwsgiref.headers.Headers allows header newline injectionEPSS 0.5%CVE-2026-8328MEDIUMFTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host addressEPSS 0.5%CVE-2026-11972HIGHtarfile opened in streaming mode mishandles EOFEPSS 0.4%