PSF

Latest CVEs · RSS

• CVE-2026-19553 2026-09-30 · CVSS 7.6
  ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter check
• CVE-2026-19445 2026-09-30 · CVSS 9.2
  A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.contex
• CVE-2026-12345 2026-09-29 · CVSS 5.9
  The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a
• CVE-2026-82049 2026-09-14 · CVSS 8.4
  In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link.
• CVE-2026-87910 2026-09-11 · CVSS 5.7
  When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is
• CVE-2026-15310 2026-08-25 · CVSS 2.1
  When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possib
• CVE-2026-19672 2026-08-19 · CVSS 6.3
  The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to
• CVE-2026-15806 2026-08-18 · CVSS 6.0
  The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take
• CVE-2026-17084 2026-08-18 · CVSS 6.0
  The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the
• CVE-2026-18503 2026-08-10 · CVSS 2.4
  Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass un
• CVE-2026-13346 2026-07-29 · CVSS 5.6
  pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing whe
• CVE-2026-6879 2026-07-28 · CVSS 2.0
  `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()
• CVE-2026-15308 2026-07-09 · CVSS 8.7
  The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontro
• CVE-2026-4360 2026-06-30 · CVSS 2.0
  In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untruste
• CVE-2026-11972 2026-06-23 · CVSS 8.2
  When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take e
• CVE-2026-0864 2026-06-23 · CVSS 4.1
  When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters (\r) the resulting file coul
• CVE-2026-11940 2026-06-23 · CVSS 7.8
  tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than
• CVE-2026-12003 2026-06-16 · CVSS 5.3
  To allow builds of Python to be run from an in-tree layout (rather than an installed file layout), the VPATH variable is defined at build time and used to locat
• CVE-2026-9669 2026-06-08 · CVSS 8.2
  bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor,
• CVE-2026-7774 2026-06-04 · CVSS 6.9
  tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outsi
• CVE-2026-3276 2026-06-03 · CVSS 6.3
  unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternatin
• CVE-2026-8643 2026-06-01 · CVSS 4.1
  pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, lead
• CVE-2026-8328 2026-05-13 · CVSS 5.9
  The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresse
• CVE-2026-7210 2026-05-11 · CVSS 6.3
  `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash
• CVE-2026-3087 2026-04-27 · CVSS 6.0
  If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the