Latest vulnerabilities for vendor "python"

Where

Sort:

Software

python python

100

python 2.7

python pillow

python imaging library (pillow)

python cpython

python urllib3

python software foundation python

python

python http.cookies.morsel

pythonware python imaging library

python imaging library (pil)

python imaplib

python keyring

python package installer

python pip

python pymanager

python software foundation cpython

python tarfile

python typed ast

python urllib.request.datahandler

python asyncio.proactoreventloop

python html.parser.htmlparser

python pkgutil.get_data

python poplib

python poplib module

python priority library

python pybluemonday

python python (bz2.bz2decompressor)

python python (gzip.gzipfile)

python python (lzma.lzmadecompressor)

python python (shutil.unpack_archive)

python python email (email.bytesgenerator)

python python html.parser.htmlparser

python python webbrowser module

python python-gnupg

python pyxdg

Pillow PillowPillow: Heap out-of-bounds write in Pillow `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`

Risk 54

Severity

8.2

First published (updated )

CVE-2026-59197

Pillow PillowPillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()

Risk 43

Severity

7.5

First published (updated )

CVE-2026-59200

PillowPillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images

Risk 43

Severity

7.5

First published (updated )

CVE-2026-59198

Pillow PillowPillow: Controlled heap out-of-bounds write in `ImageCmsTransform.apply()` via output mode mismatch

Risk 43

Severity

7.5

First published (updated )

CVE-2026-59205

Pillow PillowPillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service

Risk 43

Severity

7.5

First published (updated )

CVE-2026-59203

Pillow PillowPillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow

Risk 43

Severity

7.5

First published (updated )

CVE-2026-59199

pypi/PillowPillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service

Risk 47

Severity

8.7

First published (updated )

CVE-2026-59204

oss-sec[oss-security][CVE-2026-15308] Incmental HTMLParser allows CPU-exhaustion DoS via peated unterminated markup declarations

First published (updated )

https://seclists.org/oss-sec/2026/q3/110

Python html.parser.HTMLParserIncremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations

Risk 50

Severity

8.7

Trending

Month

First published (updated )

CVE-2026-15308

pypi/setuptoolssetuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+

Risk 41

Severity

6.1

First published (updated )

CVE-2026-59890

Pillow PillowPillow BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading

Risk 43

Severity

7.5

First published (updated )

CVE-2026-55379

Pillow PillowPillow GdImageFile decompression bomb protection bypass

Risk 43

Severity

7.5

First published (updated )

CVE-2026-55380

Pillow PillowPillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`

Risk 43

Severity

7.5

First published (updated )

CVE-2026-54060

Pillow PillowPillow: PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading

Risk 43

Severity

7.5

First published (updated )

CVE-2026-54059

Pillow PillowPillow: WindowsViewer.get_command() OS command injection via unescaped shell path

Risk 34

Severity

4.5

First published (updated )

CVE-2026-55798

python/tarfileTarfile.extract() doesn't fully respect filter parameter

Risk 27

Severity

First published (updated )

CVE-2026-4360

Python tarfile moduletarfile opened in streaming mode mishandles EOF

Risk 43

Severity

8.2

First published (updated )

CVE-2026-11972

Python configparserConfiguration Injection via Carriage Return (\r) in write() method

Risk 24

Severity

4.1

First published (updated )

CVE-2026-0864

oss-sec[oss-security][CVE-2026-11940] Cpython: tarfile extraction filter bypass allows escaping the destination dictory

First published (updated )

https://seclists.org/oss-sec/2026/q2/1006

Python CPythontarfile extraction filter bypass allows escaping the destination directory

Risk 68

Severity

7.8

First published (updated )

CVE-2026-11940

Python CPythonCPython >3.11 Insecure Input Validation resulting in privilege escalation

Risk 47

Severity

5.3

First published (updated )

CVE-2026-12003

oss-sec[oss-security][CVE-2026-9669] CPython: bz2.BZ2Decompssor use after error can cause a stack buffer overflow

First published (updated )

https://seclists.org/oss-sec/2026/q2/846

oss-sec[oss-security][CVE-2026-7774] Cpython: tarfile.data_filter path traversal bypass allows writing outside the extraction dictory

First published (updated )

https://seclists.org/oss-sec/2026/q2/813

Python CPythontarfile.data_filter path traversal bypass allows writing outside the extraction directory

Risk 44

Severity

6.9

First published (updated )

CVE-2026-7774

Python jsonpicklepython jsonpickle 2.0.0 contains a remote code execution vulnerability that allows attackers to exec…

Risk 89

First published (updated )

REDHAT-BUG-2478170

oss-sec[oss-security][CVE-2026-8328] CPython: FTP PASV SSRF, ftpcp() does not use actual peer addss, trusts server-supplied PASV host addss

First published (updated )

https://seclists.org/oss-sec/2026/q2/521

Microsoft azl3 python3 3.12.9-11FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address

Risk 27

Severity

5.9

EPSS

0.07%

First published (updated )

CVE-2026-8328

oss-sec[oss-security][CVE-2026-7210] Cpython: The expat and elementte parsers use insufficient entropy for XML hash-flooding protection

First published (updated )

https://seclists.org/oss-sec/2026/q2/483

Python Software Foundation CPythonThe expat and elementtree parsers use insufficient entropy for XML hash-flooding protection

Risk 32

Severity

6.3

EPSS

0.06%

First published (updated )

CVE-2026-7210

IBM Engineering AI Huburllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

Risk 46

Severity

8.9

First published (updated )

CVE-2026-44432

Trending

Vendor Risk Score

Software

Pillow PillowPillow: Heap out-of-bounds write in Pillow `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`

Pillow PillowPillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()

PillowPillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images

Pillow PillowPillow: Controlled heap out-of-bounds write in `ImageCmsTransform.apply()` via output mode mismatch

Pillow PillowPillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service

Don't miss critical vulnerabilities

Pillow PillowPillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow

pypi/PillowPillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service

oss-sec[oss-security][CVE-2026-15308] Incmental HTMLParser allows CPU-exhaustion DoS via peated unterminated markup declarations

Python html.parser.HTMLParserIncremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations

pypi/setuptoolssetuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+

Don't miss critical vulnerabilities

Pillow PillowPillow BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading

Pillow PillowPillow GdImageFile decompression bomb protection bypass

Pillow PillowPillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`

Pillow PillowPillow: PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading

Pillow PillowPillow: WindowsViewer.get_command() OS command injection via unescaped shell path

Don't miss critical vulnerabilities

python/tarfileTarfile.extract() doesn't fully respect filter parameter

Python tarfile moduletarfile opened in streaming mode mishandles EOF

Python configparserConfiguration Injection via Carriage Return (\r) in write() method

oss-sec[oss-security][CVE-2026-11940] Cpython: tarfile extraction filter bypass allows escaping the destination dictory

Python CPythontarfile extraction filter bypass allows escaping the destination directory

Don't miss critical vulnerabilities

Python CPythonCPython >3.11 Insecure Input Validation resulting in privilege escalation

oss-sec[oss-security][CVE-2026-9669] CPython: bz2.BZ2Decompssor use after error can cause a stack buffer overflow

oss-sec[oss-security][CVE-2026-7774] Cpython: tarfile.data_filter path traversal bypass allows writing outside the extraction dictory

Python CPythontarfile.data_filter path traversal bypass allows writing outside the extraction directory

Python jsonpicklepython jsonpickle 2.0.0 contains a remote code execution vulnerability that allows attackers to exec…

Don't miss critical vulnerabilities

oss-sec[oss-security][CVE-2026-8328] CPython: FTP PASV SSRF, ftpcp() does not use actual peer addss, trusts server-supplied PASV host addss

Microsoft azl3 python3 3.12.9-11FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address

oss-sec[oss-security][CVE-2026-7210] Cpython: The expat and elementte parsers use insufficient entropy for XML hash-flooding protection

Python Software Foundation CPythonThe expat and elementtree parsers use insufficient entropy for XML hash-flooding protection

IBM Engineering AI Huburllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

Don't miss critical vulnerabilities

Company

Resources

Contact