Vulnerabilidades em Python Software Foundation

81 resultados
Análise Vexday

Com 63 CVEs catalogadas e nenhuma entrada no catálogo KEV da CISA, a Python Software Foundation apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que indica menor pressão imediata de ameaças em curso. Ainda assim, o volume recente chama atenção: 18 vulnerabilidades surgiram nos últimos 90 dias, sugerindo ritmo elevado de descoberta. O tipo de falha mais comum é CWE-22 (Path Traversal), que pode permitir acesso não autorizado ao sistema de arquivos quando explorado em contextos específicos. A CVE mais perigosa no momento, CVE-2024-7592, apresenta EPSS de 0,023 e, embora ainda não haja PoC amplamente difundida associada a ela, equipes que operam ambientes Python em produção devem acompanhar de perto a evolução das duas CVEs de severidade crítica catalogadas.

CVE-2023-6597HIGHAn issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and priEPSS 0.3%CVE-2024-4030HIGHtempfile.mkdtemp() may be readable and writeable by all users on WindowsEPSS 0.3%CVE-2026-4786HIGHIncomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()EPSS 0.3%CVE-2026-114583MEDIUMtar filter allows writing outside destination via empty-named symlinkEPSS 0.3%CVE-2026-116566MEDIUMsocket.getaddrinfo() accepts embedded null bytes in host and portEPSS 0.3%CVE-2026-3479NONEpkgutil.get_data() does not enforce documented restrictionsEPSS 0.3%CVE-2024-3219MEDIUMPure-Python fallback of socket.socketpair() doesn’t authenticate peer connectionEPSS 0.2%CVE-2025-13837LOWOut-of-memory when loading PlistEPSS 0.2%CVE-2025-4516MEDIUMUse-after-free in "unicode_escape" decoder with error handlerEPSS 0.2%CVE-2026-2297MEDIUMSourcelessFileLoader does not use io.open_code()EPSS 0.2%CVE-2026-6019LOWBaseCookie.js_output() does not neutralize embedded charactersEPSS 0.2%CVE-2026-3446MEDIUMBase64 decoding stops at first padded quad by defaultEPSS 0.2%CVE-2026-82049HIGHtarfile extraction filters allow file modification and content disclosure via hard link to symlinkEPSS 0.2%CVE-2026-5271MEDIUMPossible to hijack modules in current working directoryEPSS 0.2%CVE-2025-13462LOWtarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handlingEPSS 0.2%CVE-2025-6075LOWQuadratic complexity in os.path.expandvars() with user-controlled templateEPSS 0.1%CVE-2026-12003MEDIUMCPython >3.11 Insecure Input Validation resulting in privilege escalationEPSS 0.1%CVE-2026-5713MEDIUMOut-of-bounds read/write during remote profiling and asyncio process introspection when connecting to malicious targetEPSS 0.1%CVE-2026-0864MEDIUMConfiguration Injection via Carriage Return (\r) in write() methodEPSS 0.1%CVE-2026-18503LOWSuper-linear CPU usage for unbounded input to csv.Sniffer.sniff()EPSS 0.1%