Python 3.x — End of Life
Active Critical risk EOL: Oct 31, 2031in 1834d16 releases in this series49 CVEs
Python 3.x is partially supported: only 3.15, 3.14, 3.13, 3.12, 3.11 still receive security fixes, the longest-lived (3.15) until Oct 31, 2031, in 1834 days. The most recent release in this series is 3.15.1. 49 CVEs are tracked for this series, including 10 critical. 29 of them were published after the end of life of the affected cycle and will not get an official patch.
Python 3.x — All releases
| Version | Released | Active support | EOL date | Latest patch | Status | Alert me |
|---|---|---|---|---|---|---|
| 3.15 | Oct 9, 2026 | Oct 9, 2028 | Oct 31, 2031 | 3.15.1 | Active | |
| 3.14 | Oct 7, 2025 | Oct 1, 2027 | Oct 31, 2030 | 3.14.9 | Active | |
| 3.13 | Oct 7, 2024 | Oct 1, 2026 | Oct 31, 2029 | 3.13.17 | Active | |
| 3.12 | Oct 2, 2023 | Apr 2, 2025 | Oct 31, 2028 | 3.12.15 | Active | |
| 3.11 | Oct 24, 2022 | Apr 1, 2024 | Oct 31, 2027 | 3.11.17 | Active | |
| 3.10 | Oct 4, 2021 | Apr 5, 2023 | Oct 1, 2026 | 3.10.22 | EOL | |
| 3.9 | Oct 5, 2020 | May 17, 2022 | Oct 31, 2025 | 3.9.25 | EOL | |
| 3.8 | Oct 14, 2019 | May 3, 2021 | Oct 7, 2024 | 3.8.20 | EOL | |
| 3.7 | Jun 27, 2018 | Jun 27, 2020 | Jun 27, 2023 | 3.7.17 | EOL | |
| 3.6 | Dec 23, 2016 | Dec 24, 2018 | Dec 23, 2021 | 3.6.15 | EOL | |
| 3.5 | Sep 13, 2015 | — | Sep 30, 2020 | 3.5.10 | EOL | |
| 3.4 | Mar 16, 2014 | — | Mar 18, 2019 | 3.4.10 | EOL | |
| 3.3 | Sep 29, 2012 | — | Sep 29, 2017 | 3.3.7 | EOL | |
| 3.2 | Feb 20, 2011 | — | Feb 20, 2016 | 3.2.6 | EOL | |
| 3.1 | Jun 27, 2009 | — | Apr 9, 2012 | 3.1.5 | EOL | |
| 3.0 | Dec 3, 2008 | — | Jun 27, 2009 | 3.0.1 | EOL |
CVEs affecting Python 3.x (384)
| CVE | Severity | CVSS | EPSS | KEV | Cycle | Description | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-15308 | HIGH | 7.5 | 0.63% | — | 3.13 | The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated mark… | Jul 9, 2026 |
| CVE-2026-15308 | HIGH | 7.5 | 0.63% | — | 3.2 | The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated mark… | Jul 9, 2026 |
| CVE-2026-15308 | HIGH | 7.5 | 0.63% | — | 3.1 | The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated mark… | Jul 9, 2026 |
| CVE-2026-15308 | HIGH | 7.5 | 0.63% | — | 3.10 | The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated mark… | Jul 9, 2026 |
| CVE-2026-15308 | HIGH | 7.5 | 0.63% | — | 3.3 | The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated mark… | Jul 9, 2026 |
| CVE-2026-15308 | HIGH | 7.5 | 0.63% | — | 3.0 | The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated mark… | Jul 9, 2026 |
| CVE-2026-15308 | HIGH | 7.5 | 0.63% | — | 3.6 | The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated mark… | Jul 9, 2026 |
| CVE-2026-15308 | HIGH | 7.5 | 0.63% | — | 3.5 | The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated mark… | Jul 9, 2026 |
| CVE-2026-15308 | HIGH | 7.5 | 0.63% | — | 3.14 | The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated mark… | Jul 9, 2026 |
| CVE-2026-15308 | HIGH | 7.5 | 0.63% | — | 3.7 | The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated mark… | Jul 9, 2026 |
| CVE-2026-15308 | HIGH | 7.5 | 0.63% | — | 3.12 | The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated mark… | Jul 9, 2026 |
| CVE-2026-15308 | HIGH | 7.5 | 0.63% | — | 3.9 | The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated mark… | Jul 9, 2026 |
| CVE-2026-15308 | HIGH | 7.5 | 0.63% | — | 3.8 | The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated mark… | Jul 9, 2026 |
| CVE-2026-15308 | HIGH | 7.5 | 0.63% | — | 3.11 | The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated mark… | Jul 9, 2026 |
| CVE-2026-15308 | HIGH | 7.5 | 0.63% | — | 3.4 | The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated mark… | Jul 9, 2026 |
| CVE-2026-4360 | MEDIUM | 5.3 | 0.48% | — | 3.1 | In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected sy… | Jun 30, 2026 |
| CVE-2026-4360 | MEDIUM | 5.3 | 0.48% | — | 3.0 | In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected sy… | Jun 30, 2026 |
| CVE-2026-0864 | MEDIUM | 5.5 | 0.12% | — | 3.4 | When using the "configparser" module to write configuration files containing multi-line text values with carriage return… | Jun 23, 2026 |
| CVE-2026-0864 | MEDIUM | 5.5 | 0.12% | — | 3.0 | When using the "configparser" module to write configuration files containing multi-line text values with carriage return… | Jun 23, 2026 |
| CVE-2026-0864 | MEDIUM | 5.5 | 0.12% | — | 3.11 | When using the "configparser" module to write configuration files containing multi-line text values with carriage return… | Jun 23, 2026 |
| CVE-2026-0864 | MEDIUM | 5.5 | 0.12% | — | 3.2 | When using the "configparser" module to write configuration files containing multi-line text values with carriage return… | Jun 23, 2026 |
| CVE-2026-0864 | MEDIUM | 5.5 | 0.12% | — | 3.8 | When using the "configparser" module to write configuration files containing multi-line text values with carriage return… | Jun 23, 2026 |
| CVE-2026-0864 | MEDIUM | 5.5 | 0.12% | — | 3.13 | When using the "configparser" module to write configuration files containing multi-line text values with carriage return… | Jun 23, 2026 |
| CVE-2026-0864 | MEDIUM | 5.5 | 0.12% | — | 3.9 | When using the "configparser" module to write configuration files containing multi-line text values with carriage return… | Jun 23, 2026 |
| CVE-2026-0864 | MEDIUM | 5.5 | 0.12% | — | 3.10 | When using the "configparser" module to write configuration files containing multi-line text values with carriage return… | Jun 23, 2026 |
| CVE-2026-0864 | MEDIUM | 5.5 | 0.12% | — | 3.3 | When using the "configparser" module to write configuration files containing multi-line text values with carriage return… | Jun 23, 2026 |
| CVE-2026-0864 | MEDIUM | 5.5 | 0.12% | — | 3.14 | When using the "configparser" module to write configuration files containing multi-line text values with carriage return… | Jun 23, 2026 |
| CVE-2026-0864 | MEDIUM | 5.5 | 0.12% | — | 3.1 | When using the "configparser" module to write configuration files containing multi-line text values with carriage return… | Jun 23, 2026 |
| CVE-2026-0864 | MEDIUM | 5.5 | 0.12% | — | 3.6 | When using the "configparser" module to write configuration files containing multi-line text values with carriage return… | Jun 23, 2026 |
| CVE-2026-0864 | MEDIUM | 5.5 | 0.12% | — | 3.7 | When using the "configparser" module to write configuration files containing multi-line text values with carriage return… | Jun 23, 2026 |
| CVE-2026-0864 | MEDIUM | 5.5 | 0.12% | — | 3.12 | When using the "configparser" module to write configuration files containing multi-line text values with carriage return… | Jun 23, 2026 |
| CVE-2026-0864 | MEDIUM | 5.5 | 0.12% | — | 3.5 | When using the "configparser" module to write configuration files containing multi-line text values with carriage return… | Jun 23, 2026 |
| CVE-2026-7210 | CRITICAL | 9.8 | 0.67% | — | 3.11 | `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allow… | May 11, 2026 |
| CVE-2026-7210 | CRITICAL | 9.8 | 0.67% | — | 3.2 | `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allow… | May 11, 2026 |
| CVE-2026-7210 | CRITICAL | 9.8 | 0.67% | — | 3.6 | `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allow… | May 11, 2026 |
| CVE-2026-7210 | CRITICAL | 9.8 | 0.67% | — | 3.14 | `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allow… | May 11, 2026 |
| CVE-2026-7210 | CRITICAL | 9.8 | 0.67% | — | 3.1 | `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allow… | May 11, 2026 |
| CVE-2026-7210 | CRITICAL | 9.8 | 0.67% | — | 3.7 | `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allow… | May 11, 2026 |
| CVE-2026-7210 | CRITICAL | 9.8 | 0.67% | — | 3.12 | `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allow… | May 11, 2026 |
| CVE-2026-7210 | CRITICAL | 9.8 | 0.67% | — | 3.4 | `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allow… | May 11, 2026 |
| CVE-2026-7210 | CRITICAL | 9.8 | 0.67% | — | 3.9 | `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allow… | May 11, 2026 |
| CVE-2026-7210 | CRITICAL | 9.8 | 0.67% | — | 3.13 | `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allow… | May 11, 2026 |
| CVE-2026-7210 | CRITICAL | 9.8 | 0.67% | — | 3.8 | `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allow… | May 11, 2026 |
| CVE-2026-7210 | CRITICAL | 9.8 | 0.67% | — | 3.0 | `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allow… | May 11, 2026 |
| CVE-2026-7210 | CRITICAL | 9.8 | 0.67% | — | 3.5 | `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allow… | May 11, 2026 |
| CVE-2026-7210 | CRITICAL | 9.8 | 0.67% | — | 3.10 | `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allow… | May 11, 2026 |
| CVE-2026-7210 | CRITICAL | 9.8 | 0.67% | — | 3.3 | `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allow… | May 11, 2026 |
| CVE-2026-3087 | HIGH | 7.5 | 0.73% | — | 3.3 | If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then th… | Apr 27, 2026 |
| CVE-2026-3087 | HIGH | 7.5 | 0.73% | — | 3.4 | If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then th… | Apr 27, 2026 |
| CVE-2026-3087 | HIGH | 7.5 | 0.73% | — | 3.12 | If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then th… | Apr 27, 2026 |
| CVE-2026-3087 | HIGH | 7.5 | 0.73% | — | 3.7 | If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then th… | Apr 27, 2026 |
| CVE-2026-3087 | HIGH | 7.5 | 0.73% | — | 3.9 | If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then th… | Apr 27, 2026 |
| CVE-2026-3087 | HIGH | 7.5 | 0.73% | — | 3.1 | If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then th… | Apr 27, 2026 |
| CVE-2026-3087 | HIGH | 7.5 | 0.73% | — | 3.14 | If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then th… | Apr 27, 2026 |
| CVE-2026-3087 | HIGH | 7.5 | 0.73% | — | 3.0 | If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then th… | Apr 27, 2026 |
| CVE-2026-3087 | HIGH | 7.5 | 0.73% | — | 3.10 | If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then th… | Apr 27, 2026 |
| CVE-2026-3087 | HIGH | 7.5 | 0.73% | — | 3.2 | If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then th… | Apr 27, 2026 |
| CVE-2026-3087 | HIGH | 7.5 | 0.73% | — | 3.13 | If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then th… | Apr 27, 2026 |
| CVE-2026-3087 | HIGH | 7.5 | 0.73% | — | 3.11 | If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then th… | Apr 27, 2026 |
| CVE-2026-3087 | HIGH | 7.5 | 0.73% | — | 3.6 | If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then th… | Apr 27, 2026 |
| CVE-2026-3087 | HIGH | 7.5 | 0.73% | — | 3.8 | If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then th… | Apr 27, 2026 |
| CVE-2026-3087 | HIGH | 7.5 | 0.73% | — | 3.5 | If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then th… | Apr 27, 2026 |
| CVE-2026-6019 | MEDIUM | 6.1 | 0.21% | — | 3.12 | http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It … | Apr 22, 2026 |
| CVE-2026-6019 | MEDIUM | 6.1 | 0.21% | — | 3.9 | http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It … | Apr 22, 2026 |
| CVE-2026-6019 | MEDIUM | 6.1 | 0.21% | — | 3.14 | http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It … | Apr 22, 2026 |
| CVE-2026-6019 | MEDIUM | 6.1 | 0.21% | — | 3.7 | http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It … | Apr 22, 2026 |
| CVE-2026-6019 | MEDIUM | 6.1 | 0.21% | — | 3.11 | http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It … | Apr 22, 2026 |
| CVE-2026-6019 | MEDIUM | 6.1 | 0.21% | — | 3.13 | http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It … | Apr 22, 2026 |
| CVE-2026-6019 | MEDIUM | 6.1 | 0.21% | — | 3.10 | http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It … | Apr 22, 2026 |
| CVE-2026-6019 | MEDIUM | 6.1 | 0.21% | — | 3.6 | http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It … | Apr 22, 2026 |
| CVE-2026-6019 | MEDIUM | 6.1 | 0.21% | — | 3.5 | http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It … | Apr 22, 2026 |
| CVE-2026-6019 | MEDIUM | 6.1 | 0.21% | — | 3.0 | http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It … | Apr 22, 2026 |
| CVE-2026-6019 | MEDIUM | 6.1 | 0.21% | — | 3.3 | http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It … | Apr 22, 2026 |
| CVE-2026-6019 | MEDIUM | 6.1 | 0.21% | — | 3.8 | http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It … | Apr 22, 2026 |
| CVE-2026-6019 | MEDIUM | 6.1 | 0.21% | — | 3.4 | http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It … | Apr 22, 2026 |
| CVE-2026-6019 | MEDIUM | 6.1 | 0.21% | — | 3.1 | http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It … | Apr 22, 2026 |
| CVE-2026-6019 | MEDIUM | 6.1 | 0.21% | — | 3.2 | http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It … | Apr 22, 2026 |
| CVE-2026-4519 | LOW | 3.3 | 0.39% | — | 3.11 | The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for cer… | Mar 20, 2026 |
| CVE-2026-4519 | LOW | 3.3 | 0.39% | — | 3.7 | The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for cer… | Mar 20, 2026 |
| CVE-2026-4519 | LOW | 3.3 | 0.39% | — | 3.3 | The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for cer… | Mar 20, 2026 |
| CVE-2026-4519 | LOW | 3.3 | 0.39% | — | 3.4 | The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for cer… | Mar 20, 2026 |
| CVE-2026-4519 | LOW | 3.3 | 0.39% | — | 3.10 | The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for cer… | Mar 20, 2026 |
| CVE-2026-4519 | LOW | 3.3 | 0.39% | — | 3.1 | The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for cer… | Mar 20, 2026 |
| CVE-2026-4519 | LOW | 3.3 | 0.39% | — | 3.12 | The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for cer… | Mar 20, 2026 |
| CVE-2026-4519 | LOW | 3.3 | 0.39% | — | 3.6 | The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for cer… | Mar 20, 2026 |
| CVE-2026-4519 | LOW | 3.3 | 0.39% | — | 3.9 | The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for cer… | Mar 20, 2026 |
| CVE-2026-4519 | LOW | 3.3 | 0.39% | — | 3.0 | The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for cer… | Mar 20, 2026 |
| CVE-2026-4519 | LOW | 3.3 | 0.39% | — | 3.8 | The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for cer… | Mar 20, 2026 |
| CVE-2026-4519 | LOW | 3.3 | 0.39% | — | 3.2 | The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for cer… | Mar 20, 2026 |
| CVE-2026-4519 | LOW | 3.3 | 0.39% | — | 3.14 | The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for cer… | Mar 20, 2026 |
| CVE-2026-4519 | LOW | 3.3 | 0.39% | — | 3.5 | The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for cer… | Mar 20, 2026 |
| CVE-2026-4519 | LOW | 3.3 | 0.39% | — | 3.13 | The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for cer… | Mar 20, 2026 |
| CVE-2026-4224 | HIGH | 7.5 | 0.70% | — | 3.14 | When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply … | Mar 16, 2026 |
| CVE-2026-4224 | HIGH | 7.5 | 0.70% | — | 3.3 | When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply … | Mar 16, 2026 |
| CVE-2026-4224 | HIGH | 7.5 | 0.70% | — | 3.10 | When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply … | Mar 16, 2026 |
| CVE-2026-4224 | HIGH | 7.5 | 0.70% | — | 3.8 | When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply … | Mar 16, 2026 |
| CVE-2026-4224 | HIGH | 7.5 | 0.70% | — | 3.13 | When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply … | Mar 16, 2026 |
| CVE-2026-4224 | HIGH | 7.5 | 0.70% | — | 3.4 | When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply … | Mar 16, 2026 |
| CVE-2026-4224 | HIGH | 7.5 | 0.70% | — | 3.2 | When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply … | Mar 16, 2026 |
| CVE-2026-4224 | HIGH | 7.5 | 0.70% | — | 3.9 | When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply … | Mar 16, 2026 |
| CVE-2026-4224 | HIGH | 7.5 | 0.70% | — | 3.1 | When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply … | Mar 16, 2026 |
| CVE-2026-4224 | HIGH | 7.5 | 0.70% | — | 3.7 | When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply … | Mar 16, 2026 |
| CVE-2026-4224 | HIGH | 7.5 | 0.70% | — | 3.6 | When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply … | Mar 16, 2026 |
| CVE-2026-4224 | HIGH | 7.5 | 0.70% | — | 3.0 | When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply … | Mar 16, 2026 |
| CVE-2026-4224 | HIGH | 7.5 | 0.70% | — | 3.5 | When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply … | Mar 16, 2026 |
| CVE-2026-3644 | HIGH | 7.5 | 0.49% | — | 3.4 | The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update()… | Mar 16, 2026 |
| CVE-2026-3644 | HIGH | 7.5 | 0.49% | — | 3.5 | The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update()… | Mar 16, 2026 |
| CVE-2026-3644 | HIGH | 7.5 | 0.49% | — | 3.7 | The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update()… | Mar 16, 2026 |
| CVE-2026-3644 | HIGH | 7.5 | 0.49% | — | 3.13 | The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update()… | Mar 16, 2026 |
| CVE-2026-3644 | HIGH | 7.5 | 0.49% | — | 3.8 | The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update()… | Mar 16, 2026 |
| CVE-2026-3644 | HIGH | 7.5 | 0.49% | — | 3.9 | The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update()… | Mar 16, 2026 |
| CVE-2026-3644 | HIGH | 7.5 | 0.49% | — | 3.14 | The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update()… | Mar 16, 2026 |
| CVE-2026-3644 | HIGH | 7.5 | 0.49% | — | 3.0 | The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update()… | Mar 16, 2026 |
| CVE-2026-3644 | HIGH | 7.5 | 0.49% | — | 3.3 | The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update()… | Mar 16, 2026 |
| CVE-2026-3644 | HIGH | 7.5 | 0.49% | — | 3.12 | The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update()… | Mar 16, 2026 |
| CVE-2026-3644 | HIGH | 7.5 | 0.49% | — | 3.6 | The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update()… | Mar 16, 2026 |
| CVE-2026-3644 | HIGH | 7.5 | 0.49% | — | 3.1 | The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update()… | Mar 16, 2026 |
| CVE-2026-3644 | HIGH | 7.5 | 0.49% | — | 3.10 | The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update()… | Mar 16, 2026 |
| CVE-2026-3644 | HIGH | 7.5 | 0.49% | — | 3.11 | The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update()… | Mar 16, 2026 |
| CVE-2026-3644 | HIGH | 7.5 | 0.49% | — | 3.2 | The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update()… | Mar 16, 2026 |
| CVE-2025-13462 | CRITICAL | 9.8 | 0.16% | — | 3.6 | The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi… | Mar 12, 2026 |
| CVE-2025-13462 | CRITICAL | 9.8 | 0.16% | — | 3.0 | The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi… | Mar 12, 2026 |
| CVE-2025-13462 | CRITICAL | 9.8 | 0.16% | — | 3.12 | The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi… | Mar 12, 2026 |
| CVE-2025-13462 | CRITICAL | 9.8 | 0.16% | — | 3.13 | The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi… | Mar 12, 2026 |
| CVE-2025-13462 | CRITICAL | 9.8 | 0.16% | — | 3.10 | The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi… | Mar 12, 2026 |
| CVE-2025-13462 | CRITICAL | 9.8 | 0.16% | — | 3.5 | The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi… | Mar 12, 2026 |
| CVE-2025-13462 | CRITICAL | 9.8 | 0.16% | — | 3.2 | The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi… | Mar 12, 2026 |
| CVE-2025-13462 | CRITICAL | 9.8 | 0.16% | — | 3.9 | The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi… | Mar 12, 2026 |
| CVE-2025-13462 | CRITICAL | 9.8 | 0.16% | — | 3.1 | The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi… | Mar 12, 2026 |
| CVE-2025-13462 | CRITICAL | 9.8 | 0.16% | — | 3.4 | The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi… | Mar 12, 2026 |
| CVE-2025-13462 | CRITICAL | 9.8 | 0.16% | — | 3.8 | The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi… | Mar 12, 2026 |
| CVE-2025-13462 | CRITICAL | 9.8 | 0.16% | — | 3.3 | The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi… | Mar 12, 2026 |
| CVE-2025-13462 | CRITICAL | 9.8 | 0.16% | — | 3.11 | The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi… | Mar 12, 2026 |
| CVE-2025-13462 | CRITICAL | 9.8 | 0.16% | — | 3.7 | The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi… | Mar 12, 2026 |
| CVE-2025-13462 | CRITICAL | 9.8 | 0.16% | — | 3.14 | The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi… | Mar 12, 2026 |
| CVE-2025-12781 | MEDIUM | 5.3 | 0.56% | — | 3.7 | When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the… | Jan 21, 2026 |
| CVE-2025-12781 | MEDIUM | 5.3 | 0.56% | — | 3.8 | When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the… | Jan 21, 2026 |
| CVE-2025-12781 | MEDIUM | 5.3 | 0.56% | — | 3.1 | When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the… | Jan 21, 2026 |
| CVE-2025-12781 | MEDIUM | 5.3 | 0.56% | — | 3.10 | When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the… | Jan 21, 2026 |
| CVE-2025-12781 | MEDIUM | 5.3 | 0.56% | — | 3.2 | When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the… | Jan 21, 2026 |
| CVE-2025-12781 | MEDIUM | 5.3 | 0.56% | — | 3.9 | When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the… | Jan 21, 2026 |
| CVE-2025-12781 | MEDIUM | 5.3 | 0.56% | — | 3.4 | When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the… | Jan 21, 2026 |
| CVE-2025-12781 | MEDIUM | 5.3 | 0.56% | — | 3.0 | When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the… | Jan 21, 2026 |
| CVE-2025-12781 | MEDIUM | 5.3 | 0.56% | — | 3.13 | When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the… | Jan 21, 2026 |
| CVE-2025-12781 | MEDIUM | 5.3 | 0.56% | — | 3.6 | When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the… | Jan 21, 2026 |
| CVE-2025-12781 | MEDIUM | 5.3 | 0.56% | — | 3.5 | When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the… | Jan 21, 2026 |
| CVE-2025-12781 | MEDIUM | 5.3 | 0.56% | — | 3.14 | When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the… | Jan 21, 2026 |
| CVE-2025-12781 | MEDIUM | 5.3 | 0.56% | — | 3.3 | When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the… | Jan 21, 2026 |
| CVE-2025-12781 | MEDIUM | 5.3 | 0.56% | — | 3.12 | When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the… | Jan 21, 2026 |
| CVE-2025-12781 | MEDIUM | 5.3 | 0.56% | — | 3.11 | When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the… | Jan 21, 2026 |
| CVE-2025-13837 | MEDIUM | 5.5 | 0.22% | — | 3.5 | When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file… | Dec 1, 2025 |
| CVE-2025-13837 | MEDIUM | 5.5 | 0.22% | — | 3.3 | When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file… | Dec 1, 2025 |
| CVE-2025-13837 | MEDIUM | 5.5 | 0.22% | — | 3.8 | When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file… | Dec 1, 2025 |
| CVE-2025-13837 | MEDIUM | 5.5 | 0.22% | — | 3.0 | When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file… | Dec 1, 2025 |
| CVE-2025-13837 | MEDIUM | 5.5 | 0.22% | — | 3.12 | When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file… | Dec 1, 2025 |
| CVE-2025-13837 | MEDIUM | 5.5 | 0.22% | — | 3.1 | When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file… | Dec 1, 2025 |
| CVE-2025-13837 | MEDIUM | 5.5 | 0.22% | — | 3.2 | When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file… | Dec 1, 2025 |
| CVE-2025-13837 | MEDIUM | 5.5 | 0.22% | — | 3.13 | When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file… | Dec 1, 2025 |
| CVE-2025-13837 | MEDIUM | 5.5 | 0.22% | — | 3.10 | When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file… | Dec 1, 2025 |
| CVE-2025-13837 | MEDIUM | 5.5 | 0.22% | — | 3.4 | When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file… | Dec 1, 2025 |
| CVE-2025-13837 | MEDIUM | 5.5 | 0.22% | — | 3.11 | When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file… | Dec 1, 2025 |
| CVE-2025-13837 | MEDIUM | 5.5 | 0.22% | — | 3.14 | When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file… | Dec 1, 2025 |
| CVE-2025-13837 | MEDIUM | 5.5 | 0.22% | — | 3.9 | When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file… | Dec 1, 2025 |
| CVE-2025-13837 | MEDIUM | 5.5 | 0.22% | — | 3.6 | When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file… | Dec 1, 2025 |
| CVE-2025-13837 | MEDIUM | 5.5 | 0.22% | — | 3.7 | When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file… | Dec 1, 2025 |
| CVE-2025-13836 | HIGH | 7.5 | 1.63% | — | 3.10 | When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content… | Dec 1, 2025 |
| CVE-2025-13836 | HIGH | 7.5 | 1.63% | — | 3.6 | When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content… | Dec 1, 2025 |
| CVE-2025-13836 | HIGH | 7.5 | 1.63% | — | 3.0 | When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content… | Dec 1, 2025 |
| CVE-2025-13836 | HIGH | 7.5 | 1.63% | — | 3.9 | When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content… | Dec 1, 2025 |
| CVE-2025-13836 | HIGH | 7.5 | 1.63% | — | 3.5 | When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content… | Dec 1, 2025 |
| CVE-2025-13836 | HIGH | 7.5 | 1.63% | — | 3.3 | When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content… | Dec 1, 2025 |
| CVE-2025-13836 | HIGH | 7.5 | 1.63% | — | 3.1 | When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content… | Dec 1, 2025 |
| CVE-2025-13836 | HIGH | 7.5 | 1.63% | — | 3.8 | When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content… | Dec 1, 2025 |
| CVE-2025-13836 | HIGH | 7.5 | 1.63% | — | 3.7 | When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content… | Dec 1, 2025 |
| CVE-2025-13836 | HIGH | 7.5 | 1.63% | — | 3.14 | When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content… | Dec 1, 2025 |
| CVE-2025-13836 | HIGH | 7.5 | 1.63% | — | 3.2 | When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content… | Dec 1, 2025 |
| CVE-2025-13836 | HIGH | 7.5 | 1.63% | — | 3.11 | When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content… | Dec 1, 2025 |
| CVE-2025-13836 | HIGH | 7.5 | 1.63% | — | 3.12 | When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content… | Dec 1, 2025 |
| CVE-2025-13836 | HIGH | 7.5 | 1.63% | — | 3.4 | When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content… | Dec 1, 2025 |
| CVE-2025-13836 | HIGH | 7.5 | 1.63% | — | 3.13 | When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content… | Dec 1, 2025 |
| CVE-2025-6075 | MEDIUM | 5.5 | 0.14% | — | 3.5 | If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding env… | Oct 31, 2025 |
| CVE-2025-6075 | MEDIUM | 5.5 | 0.14% | — | 3.0 | If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding env… | Oct 31, 2025 |
| CVE-2025-6075 | MEDIUM | 5.5 | 0.14% | — | 3.3 | If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding env… | Oct 31, 2025 |
| CVE-2025-6075 | MEDIUM | 5.5 | 0.14% | — | 3.4 | If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding env… | Oct 31, 2025 |
| CVE-2025-6075 | MEDIUM | 5.5 | 0.14% | — | 3.6 | If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding env… | Oct 31, 2025 |
| CVE-2025-6075 | MEDIUM | 5.5 | 0.14% | — | 3.8 | If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding env… | Oct 31, 2025 |
| CVE-2025-6075 | MEDIUM | 5.5 | 0.14% | — | 3.13 | If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding env… | Oct 31, 2025 |
| CVE-2025-6075 | MEDIUM | 5.5 | 0.14% | — | 3.7 | If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding env… | Oct 31, 2025 |
| CVE-2025-6075 | MEDIUM | 5.5 | 0.14% | — | 3.14 | If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding env… | Oct 31, 2025 |
| CVE-2025-6075 | MEDIUM | 5.5 | 0.14% | — | 3.2 | If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding env… | Oct 31, 2025 |
| CVE-2025-6075 | MEDIUM | 5.5 | 0.14% | — | 3.1 | If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding env… | Oct 31, 2025 |
| CVE-2025-6075 | MEDIUM | 5.5 | 0.14% | — | 3.9 | If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding env… | Oct 31, 2025 |
| CVE-2023-6507 | MEDIUM | 6.1 | 1.33% | — | 3.13 | An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in CPython 3.12.1 and d… | Dec 8, 2023 |
| CVE-2023-6507 | MEDIUM | 6.1 | 1.33% | — | 3.12 | An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in CPython 3.12.1 and d… | Dec 8, 2023 |
| CVE-2020-10735 | HIGH | 7.5 | 4.48% | — | 3.9 | A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"),… | Sep 9, 2022 |
| CVE-2020-10735 | HIGH | 7.5 | 4.48% | — | 3.11 | A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"),… | Sep 9, 2022 |
| CVE-2020-10735 | HIGH | 7.5 | 4.48% | — | 3.8 | A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"),… | Sep 9, 2022 |
| CVE-2020-10735 | HIGH | 7.5 | 4.48% | — | 3.10 | A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"),… | Sep 9, 2022 |
| CVE-2020-10735 | HIGH | 7.5 | 4.48% | — | 3.7 | A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"),… | Sep 9, 2022 |
| CVE-2015-20107 | HIGH | 7.6 | 2.78% | — | 3.9 | In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the … | Apr 13, 2022 |
| CVE-2015-20107 | HIGH | 7.6 | 2.78% | — | 3.7 | In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the … | Apr 13, 2022 |
| CVE-2015-20107 | HIGH | 7.6 | 2.78% | — | 3.8 | In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the … | Apr 13, 2022 |
| CVE-2015-20107 | HIGH | 7.6 | 2.78% | — | 3.10 | In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the … | Apr 13, 2022 |
| CVE-2018-25032 | HIGH | 7.5 | 51.73% | — | 3.10 | zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matche… | Mar 25, 2022 |
| CVE-2018-25032 | HIGH | 7.5 | 51.73% | — | 3.9 | zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matche… | Mar 25, 2022 |
| CVE-2018-25032 | HIGH | 7.5 | 51.73% | — | 3.8 | zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matche… | Mar 25, 2022 |
| CVE-2018-25032 | HIGH | 7.5 | 51.73% | — | 3.7 | zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matche… | Mar 25, 2022 |
| CVE-2022-26488 | HIGH | 7.0 | 1.49% | — | 3.5 | In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. The… | Mar 10, 2022 |
| CVE-2022-26488 | HIGH | 7.0 | 1.49% | — | 3.2 | In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. The… | Mar 10, 2022 |
| CVE-2022-26488 | HIGH | 7.0 | 1.49% | — | 3.9 | In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. The… | Mar 10, 2022 |
| CVE-2022-26488 | HIGH | 7.0 | 1.49% | — | 3.0 | In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. The… | Mar 10, 2022 |
| CVE-2022-26488 | HIGH | 7.0 | 1.49% | — | 3.7 | In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. The… | Mar 10, 2022 |
| CVE-2022-26488 | HIGH | 7.0 | 1.49% | — | 3.1 | In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. The… | Mar 10, 2022 |
| CVE-2022-26488 | HIGH | 7.0 | 1.49% | — | 3.11 | In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. The… | Mar 10, 2022 |
| CVE-2022-26488 | HIGH | 7.0 | 1.49% | — | 3.4 | In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. The… | Mar 10, 2022 |
| CVE-2022-26488 | HIGH | 7.0 | 1.49% | — | 3.6 | In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. The… | Mar 10, 2022 |
| CVE-2022-26488 | HIGH | 7.0 | 1.49% | — | 3.10 | In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. The… | Mar 10, 2022 |
| CVE-2022-26488 | HIGH | 7.0 | 1.49% | — | 3.3 | In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. The… | Mar 10, 2022 |
| CVE-2022-26488 | HIGH | 7.0 | 1.49% | — | 3.8 | In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. The… | Mar 10, 2022 |
| CVE-2021-3733 | MEDIUM | 6.5 | 4.79% | — | 3.7 | There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP… | Mar 10, 2022 |
| CVE-2021-3733 | MEDIUM | 6.5 | 4.79% | — | 3.9 | There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP… | Mar 10, 2022 |
| CVE-2021-3733 | MEDIUM | 6.5 | 4.79% | — | 3.6 | There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP… | Mar 10, 2022 |
| CVE-2021-3733 | MEDIUM | 6.5 | 4.79% | — | 3.0 | There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP… | Mar 10, 2022 |
| CVE-2021-3733 | MEDIUM | 6.5 | 4.79% | — | 3.5 | There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP… | Mar 10, 2022 |
| CVE-2021-3733 | MEDIUM | 6.5 | 4.79% | — | 3.8 | There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP… | Mar 10, 2022 |
| CVE-2021-3733 | MEDIUM | 6.5 | 4.79% | — | 3.10 | There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP… | Mar 10, 2022 |
| CVE-2021-3733 | MEDIUM | 6.5 | 4.79% | — | 3.1 | There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP… | Mar 10, 2022 |
| CVE-2021-3733 | MEDIUM | 6.5 | 4.79% | — | 3.2 | There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP… | Mar 10, 2022 |
| CVE-2021-3733 | MEDIUM | 6.5 | 4.79% | — | 3.4 | There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP… | Mar 10, 2022 |
| CVE-2021-3733 | MEDIUM | 6.5 | 4.79% | — | 3.3 | There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP… | Mar 10, 2022 |
| CVE-2021-29921 | CRITICAL | 9.8 | 6.88% | — | 3.8 | In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. … | May 6, 2021 |
| CVE-2021-29921 | CRITICAL | 9.8 | 6.88% | — | 3.9 | In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. … | May 6, 2021 |
| CVE-2020-27619 | CRITICAL | 9.8 | 8.33% | — | 3.2 | In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via H… | Oct 22, 2020 |
| CVE-2020-27619 | CRITICAL | 9.8 | 8.33% | — | 3.9 | In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via H… | Oct 22, 2020 |
| CVE-2020-27619 | CRITICAL | 9.8 | 8.33% | — | 3.6 | In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via H… | Oct 22, 2020 |
| CVE-2020-27619 | CRITICAL | 9.8 | 8.33% | — | 3.3 | In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via H… | Oct 22, 2020 |
| CVE-2020-27619 | CRITICAL | 9.8 | 8.33% | — | 3.1 | In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via H… | Oct 22, 2020 |
| CVE-2020-27619 | CRITICAL | 9.8 | 8.33% | — | 3.7 | In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via H… | Oct 22, 2020 |
| CVE-2020-27619 | CRITICAL | 9.8 | 8.33% | — | 3.5 | In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via H… | Oct 22, 2020 |
| CVE-2020-27619 | CRITICAL | 9.8 | 8.33% | — | 3.4 | In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via H… | Oct 22, 2020 |
| CVE-2020-27619 | CRITICAL | 9.8 | 8.33% | — | 3.8 | In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via H… | Oct 22, 2020 |
| CVE-2020-27619 | CRITICAL | 9.8 | 8.33% | — | 3.0 | In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via H… | Oct 22, 2020 |
| CVE-2020-26116 | HIGH | 7.2 | 6.35% | — | 3.6 | http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF inj… | Sep 27, 2020 |
| CVE-2020-26116 | HIGH | 7.2 | 6.35% | — | 3.3 | http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF inj… | Sep 27, 2020 |
| CVE-2020-26116 | HIGH | 7.2 | 6.35% | — | 3.2 | http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF inj… | Sep 27, 2020 |
| CVE-2020-26116 | HIGH | 7.2 | 6.35% | — | 3.5 | http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF inj… | Sep 27, 2020 |
| CVE-2020-26116 | HIGH | 7.2 | 6.35% | — | 3.1 | http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF inj… | Sep 27, 2020 |
| CVE-2020-26116 | HIGH | 7.2 | 6.35% | — | 3.7 | http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF inj… | Sep 27, 2020 |
| CVE-2020-26116 | HIGH | 7.2 | 6.35% | — | 3.0 | http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF inj… | Sep 27, 2020 |
| CVE-2020-26116 | HIGH | 7.2 | 6.35% | — | 3.8 | http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF inj… | Sep 27, 2020 |
| CVE-2020-26116 | HIGH | 7.2 | 6.35% | — | 3.4 | http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF inj… | Sep 27, 2020 |
| CVE-2019-20907 | HIGH | 7.5 | 2.98% | — | 3.7 | In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when o… | Jul 13, 2020 |
| CVE-2019-20907 | HIGH | 7.5 | 2.98% | — | 3.5 | In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when o… | Jul 13, 2020 |
| CVE-2019-20907 | HIGH | 7.5 | 2.98% | — | 3.8 | In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when o… | Jul 13, 2020 |
| CVE-2019-20907 | HIGH | 7.5 | 2.98% | — | 3.6 | In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when o… | Jul 13, 2020 |
| CVE-2020-15523 | HIGH | 7.8 | 0.94% | — | 3.8 | In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan hors… | Jul 4, 2020 |
| CVE-2020-15523 | HIGH | 7.8 | 0.94% | — | 3.5 | In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan hors… | Jul 4, 2020 |
| CVE-2020-15523 | HIGH | 7.8 | 0.94% | — | 3.9 | In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan hors… | Jul 4, 2020 |
| CVE-2020-15523 | HIGH | 7.8 | 0.94% | — | 3.6 | In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan hors… | Jul 4, 2020 |
| CVE-2020-15523 | HIGH | 7.8 | 0.94% | — | 3.7 | In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan hors… | Jul 4, 2020 |
| CVE-2020-14422 | MEDIUM | 5.9 | 12.70% | — | 3.8 | Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes,… | Jun 18, 2020 |
| CVE-2020-14422 | MEDIUM | 5.9 | 12.70% | — | 3.7 | Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes,… | Jun 18, 2020 |
| CVE-2020-14422 | MEDIUM | 5.9 | 12.70% | — | 3.5 | Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes,… | Jun 18, 2020 |
| CVE-2020-14422 | MEDIUM | 5.9 | 12.70% | — | 3.3 | Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes,… | Jun 18, 2020 |
| CVE-2020-14422 | MEDIUM | 5.9 | 12.70% | — | 3.0 | Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes,… | Jun 18, 2020 |
| CVE-2020-14422 | MEDIUM | 5.9 | 12.70% | — | 3.4 | Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes,… | Jun 18, 2020 |
| CVE-2020-14422 | MEDIUM | 5.9 | 12.70% | — | 3.6 | Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes,… | Jun 18, 2020 |
| CVE-2020-14422 | MEDIUM | 5.9 | 12.70% | — | 3.2 | Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes,… | Jun 18, 2020 |
| CVE-2020-14422 | MEDIUM | 5.9 | 12.70% | — | 3.1 | Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes,… | Jun 18, 2020 |
| CVE-2019-9674 | HIGH | 7.5 | 5.63% | — | 3.4 | Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a… | Feb 4, 2020 |
| CVE-2019-9674 | HIGH | 7.5 | 5.63% | — | 3.6 | Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a… | Feb 4, 2020 |
| CVE-2019-9674 | HIGH | 7.5 | 5.63% | — | 3.2 | Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a… | Feb 4, 2020 |
| CVE-2019-9674 | HIGH | 7.5 | 5.63% | — | 3.5 | Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a… | Feb 4, 2020 |
| CVE-2019-9674 | HIGH | 7.5 | 5.63% | — | 3.7 | Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a… | Feb 4, 2020 |
| CVE-2019-9674 | HIGH | 7.5 | 5.63% | — | 3.3 | Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a… | Feb 4, 2020 |
| CVE-2019-9674 | HIGH | 7.5 | 5.63% | — | 3.8 | Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a… | Feb 4, 2020 |
| CVE-2020-8492 | MEDIUM | 6.5 | 6.61% | — | 3.8 | Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTT… | Jan 30, 2020 |
| CVE-2020-8492 | MEDIUM | 6.5 | 6.61% | — | 3.7 | Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTT… | Jan 30, 2020 |
| CVE-2020-8492 | MEDIUM | 6.5 | 6.61% | — | 3.6 | Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTT… | Jan 30, 2020 |
| CVE-2020-8492 | MEDIUM | 6.5 | 6.61% | — | 3.5 | Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTT… | Jan 30, 2020 |
| CVE-2019-5010 | HIGH | 7.5 | 20.74% | — | 3.4 | An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6… | Oct 31, 2019 |
| CVE-2019-5010 | HIGH | 7.5 | 20.74% | — | 3.7 | An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6… | Oct 31, 2019 |
| CVE-2019-5010 | HIGH | 7.5 | 20.74% | — | 3.5 | An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6… | Oct 31, 2019 |
| CVE-2019-5010 | HIGH | 7.5 | 20.74% | — | 3.6 | An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6… | Oct 31, 2019 |
| CVE-2019-18348 | MEDIUM | 6.1 | 3.51% | — | 3.6 | An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection i… | Oct 23, 2019 |
| CVE-2019-18348 | MEDIUM | 6.1 | 3.51% | — | 3.3 | An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection i… | Oct 23, 2019 |
| CVE-2019-18348 | MEDIUM | 6.1 | 3.51% | — | 3.2 | An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection i… | Oct 23, 2019 |
| CVE-2019-18348 | MEDIUM | 6.1 | 3.51% | — | 3.5 | An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection i… | Oct 23, 2019 |
| CVE-2019-18348 | MEDIUM | 6.1 | 3.51% | — | 3.7 | An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection i… | Oct 23, 2019 |
| CVE-2019-18348 | MEDIUM | 6.1 | 3.51% | — | 3.1 | An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection i… | Oct 23, 2019 |
| CVE-2019-18348 | MEDIUM | 6.1 | 3.51% | — | 3.4 | An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection i… | Oct 23, 2019 |
| CVE-2019-18348 | MEDIUM | 6.1 | 3.51% | — | 3.8 | An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection i… | Oct 23, 2019 |
| CVE-2019-18348 | MEDIUM | 6.1 | 3.51% | — | 3.0 | An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection i… | Oct 23, 2019 |
| CVE-2019-16935 | MEDIUM | 6.1 | 4.65% | — | 3.5 | The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the se… | Sep 28, 2019 |
| CVE-2019-16935 | MEDIUM | 6.1 | 4.65% | — | 3.1 | The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the se… | Sep 28, 2019 |
| CVE-2019-16935 | MEDIUM | 6.1 | 4.65% | — | 3.6 | The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the se… | Sep 28, 2019 |
| CVE-2019-16935 | MEDIUM | 6.1 | 4.65% | — | 3.7 | The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the se… | Sep 28, 2019 |
| CVE-2019-16935 | MEDIUM | 6.1 | 4.65% | — | 3.3 | The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the se… | Sep 28, 2019 |
| CVE-2019-16935 | MEDIUM | 6.1 | 4.65% | — | 3.2 | The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the se… | Sep 28, 2019 |
| CVE-2019-16935 | MEDIUM | 6.1 | 4.65% | — | 3.4 | The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the se… | Sep 28, 2019 |
| CVE-2019-16935 | MEDIUM | 6.1 | 4.65% | — | 3.0 | The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the se… | Sep 28, 2019 |
| CVE-2019-16056 | HIGH | 7.5 | 5.12% | — | 3.4 | An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The e… | Sep 6, 2019 |
| CVE-2019-16056 | HIGH | 7.5 | 5.12% | — | 3.7 | An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The e… | Sep 6, 2019 |
| CVE-2019-16056 | HIGH | 7.5 | 5.12% | — | 3.2 | An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The e… | Sep 6, 2019 |
| CVE-2019-16056 | HIGH | 7.5 | 5.12% | — | 3.3 | An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The e… | Sep 6, 2019 |
| CVE-2019-16056 | HIGH | 7.5 | 5.12% | — | 3.6 | An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The e… | Sep 6, 2019 |
| CVE-2019-16056 | HIGH | 7.5 | 5.12% | — | 3.5 | An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The e… | Sep 6, 2019 |
| CVE-2019-16056 | HIGH | 7.5 | 5.12% | — | 3.1 | An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The e… | Sep 6, 2019 |
| CVE-2019-16056 | HIGH | 7.5 | 5.12% | — | 3.0 | An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The e… | Sep 6, 2019 |
| CVE-2018-20852 | MEDIUM | 4.3 | 3.66% | — | 3.6 | http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validat… | Jul 13, 2019 |
| CVE-2018-20852 | MEDIUM | 4.3 | 3.66% | — | 3.3 | http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validat… | Jul 13, 2019 |
| CVE-2018-20852 | MEDIUM | 4.3 | 3.66% | — | 3.2 | http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validat… | Jul 13, 2019 |
| CVE-2018-20852 | MEDIUM | 4.3 | 3.66% | — | 3.5 | http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validat… | Jul 13, 2019 |
| CVE-2018-20852 | MEDIUM | 4.3 | 3.66% | — | 3.7 | http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validat… | Jul 13, 2019 |
| CVE-2018-20852 | MEDIUM | 4.3 | 3.66% | — | 3.0 | http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validat… | Jul 13, 2019 |
| CVE-2018-20852 | MEDIUM | 4.3 | 3.66% | — | 3.4 | http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validat… | Jul 13, 2019 |
| CVE-2018-20852 | MEDIUM | 4.3 | 3.66% | — | 3.1 | http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validat… | Jul 13, 2019 |
| CVE-2019-10160 | CRITICAL | 9.8 | 5.22% | — | 3.8 | A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 af… | Jun 7, 2019 |
| CVE-2019-10160 | CRITICAL | 9.8 | 5.22% | — | 3.6 | A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 af… | Jun 7, 2019 |
| CVE-2019-10160 | CRITICAL | 9.8 | 5.22% | — | 3.5 | A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 af… | Jun 7, 2019 |
| CVE-2019-10160 | CRITICAL | 9.8 | 5.22% | — | 3.7 | A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 af… | Jun 7, 2019 |
| CVE-2019-9948 | CRITICAL | 9.1 | 11.84% | — | 3.6 | urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypas… | Mar 23, 2019 |
| CVE-2019-9948 | CRITICAL | 9.1 | 11.84% | — | 3.5 | urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypas… | Mar 23, 2019 |
| CVE-2019-9948 | CRITICAL | 9.1 | 11.84% | — | 3.7 | urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypas… | Mar 23, 2019 |
| CVE-2019-9947 | MEDIUM | 6.1 | 5.25% | — | 3.6 | An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection i… | Mar 23, 2019 |
| CVE-2019-9947 | MEDIUM | 6.1 | 5.25% | — | 3.5 | An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection i… | Mar 23, 2019 |
| CVE-2019-9947 | MEDIUM | 6.1 | 5.25% | — | 3.7 | An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection i… | Mar 23, 2019 |
| CVE-2019-9740 | MEDIUM | 6.1 | 5.40% | — | 3.5 | An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection i… | Mar 13, 2019 |
| CVE-2019-9740 | MEDIUM | 6.1 | 5.40% | — | 3.7 | An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection i… | Mar 13, 2019 |
| CVE-2019-9740 | MEDIUM | 6.1 | 5.40% | — | 3.6 | An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection i… | Mar 13, 2019 |
| CVE-2019-9636 | CRITICAL | 9.8 | 7.67% | — | 3.7 | Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorre… | Mar 8, 2019 |
| CVE-2019-9636 | CRITICAL | 9.8 | 7.67% | — | 3.4 | Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorre… | Mar 8, 2019 |
| CVE-2019-9636 | CRITICAL | 9.8 | 7.67% | — | 3.5 | Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorre… | Mar 8, 2019 |
| CVE-2019-9636 | CRITICAL | 9.8 | 7.67% | — | 3.6 | Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorre… | Mar 8, 2019 |
| CVE-2019-9636 | CRITICAL | 9.8 | 7.67% | — | 3.2 | Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorre… | Mar 8, 2019 |
| CVE-2019-9636 | CRITICAL | 9.8 | 7.67% | — | 3.1 | Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorre… | Mar 8, 2019 |
| CVE-2019-9636 | CRITICAL | 9.8 | 7.67% | — | 3.3 | Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorre… | Mar 8, 2019 |
| CVE-2019-9636 | CRITICAL | 9.8 | 7.67% | — | 3.0 | Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorre… | Mar 8, 2019 |
| CVE-2018-20406 | HIGH | 7.5 | 5.78% | — | 3.5 | Modules/_pickle.c in Python before 3.7.1 has an integer overflow via a large LONG_BINPUT value that is mishandled during… | Dec 23, 2018 |
| CVE-2018-20406 | HIGH | 7.5 | 5.78% | — | 3.7 | Modules/_pickle.c in Python before 3.7.1 has an integer overflow via a large LONG_BINPUT value that is mishandled during… | Dec 23, 2018 |
| CVE-2018-20406 | HIGH | 7.5 | 5.78% | — | 3.6 | Modules/_pickle.c in Python before 3.7.1 has an integer overflow via a large LONG_BINPUT value that is mishandled during… | Dec 23, 2018 |
| CVE-2018-20406 | HIGH | 7.5 | 5.78% | — | 3.4 | Modules/_pickle.c in Python before 3.7.1 has an integer overflow via a large LONG_BINPUT value that is mishandled during… | Dec 23, 2018 |
| CVE-2018-14647 | HIGH | 7.5 | 10.91% | — | 3.7 | Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy… | Sep 25, 2018 |
| CVE-2018-14647 | HIGH | 7.5 | 10.91% | — | 3.4 | Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy… | Sep 25, 2018 |
| CVE-2018-14647 | HIGH | 7.5 | 10.91% | — | 3.5 | Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy… | Sep 25, 2018 |
| CVE-2018-14647 | HIGH | 7.5 | 10.91% | — | 3.6 | Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy… | Sep 25, 2018 |
| CVE-2018-1061 | MEDIUM | 6.5 | 4.91% | — | 3.6 | python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the dif… | Jun 19, 2018 |
| CVE-2018-1061 | MEDIUM | 6.5 | 4.91% | — | 3.1 | python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the dif… | Jun 19, 2018 |
| CVE-2018-1061 | MEDIUM | 6.5 | 4.91% | — | 3.0 | python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the dif… | Jun 19, 2018 |
| CVE-2018-1061 | MEDIUM | 6.5 | 4.91% | — | 3.5 | python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the dif… | Jun 19, 2018 |
| CVE-2018-1061 | MEDIUM | 6.5 | 4.91% | — | 3.2 | python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the dif… | Jun 19, 2018 |
| CVE-2018-1061 | MEDIUM | 6.5 | 4.91% | — | 3.4 | python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the dif… | Jun 19, 2018 |
| CVE-2018-1061 | MEDIUM | 6.5 | 4.91% | — | 3.7 | python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the dif… | Jun 19, 2018 |
| CVE-2018-1061 | MEDIUM | 6.5 | 4.91% | — | 3.3 | python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the dif… | Jun 19, 2018 |
| CVE-2018-1060 | HIGH | 7.5 | 5.03% | — | 3.2 | python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib… | Jun 18, 2018 |
| CVE-2018-1060 | HIGH | 7.5 | 5.03% | — | 3.4 | python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib… | Jun 18, 2018 |
| CVE-2018-1060 | HIGH | 7.5 | 5.03% | — | 3.5 | python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib… | Jun 18, 2018 |
| CVE-2018-1060 | HIGH | 7.5 | 5.03% | — | 3.0 | python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib… | Jun 18, 2018 |
| CVE-2018-1060 | HIGH | 7.5 | 5.03% | — | 3.1 | python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib… | Jun 18, 2018 |
| CVE-2018-1060 | HIGH | 7.5 | 5.03% | — | 3.3 | python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib… | Jun 18, 2018 |
| CVE-2016-9063 | CRITICAL | 9.8 | 5.47% | — | 3.3 | An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50. | Jun 11, 2018 |
| CVE-2016-9063 | CRITICAL | 9.8 | 5.47% | — | 3.6 | An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50. | Jun 11, 2018 |
| CVE-2016-9063 | CRITICAL | 9.8 | 5.47% | — | 3.5 | An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50. | Jun 11, 2018 |
| CVE-2016-9063 | CRITICAL | 9.8 | 5.47% | — | 3.4 | An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50. | Jun 11, 2018 |
| CVE-2017-1000158 | CRITICAL | 9.8 | 7.94% | — | 3.4 | CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringob… | Nov 17, 2017 |
| CVE-2017-1000158 | CRITICAL | 9.8 | 7.94% | — | 3.5 | CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringob… | Nov 17, 2017 |
| CVE-2017-9233 | HIGH | 7.5 | 8.73% | — | 3.4 | XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the p… | Jul 25, 2017 |
| CVE-2017-9233 | HIGH | 7.5 | 8.73% | — | 3.3 | XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the p… | Jul 25, 2017 |
| CVE-2017-9233 | HIGH | 7.5 | 8.73% | — | 3.6 | XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the p… | Jul 25, 2017 |
| CVE-2017-9233 | HIGH | 7.5 | 8.73% | — | 3.5 | XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the p… | Jul 25, 2017 |
| CVE-2016-2183 | HIGH | 7.5 | 94.69% | — | 3.4 | The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a bi… | Sep 1, 2016 |
| CVE-2016-2183 | HIGH | 7.5 | 94.69% | — | 3.5 | The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a bi… | Sep 1, 2016 |
| CVE-2016-4472 | HIGH | 8.1 | 11.94% | — | 3.3 | The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attacke… | Jun 30, 2016 |
| CVE-2016-4472 | HIGH | 8.1 | 11.94% | — | 3.6 | The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attacke… | Jun 30, 2016 |
| CVE-2016-4472 | HIGH | 8.1 | 11.94% | — | 3.5 | The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attacke… | Jun 30, 2016 |
| CVE-2016-4472 | HIGH | 8.1 | 11.94% | — | 3.4 | The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attacke… | Jun 30, 2016 |
| CVE-2016-0718 | CRITICAL | 9.8 | 13.33% | — | 3.6 | Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a m… | May 26, 2016 |
| CVE-2016-0718 | CRITICAL | 9.8 | 13.33% | — | 3.4 | Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a m… | May 26, 2016 |
| CVE-2016-0718 | CRITICAL | 9.8 | 13.33% | — | 3.3 | Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a m… | May 26, 2016 |
| CVE-2016-0718 | CRITICAL | 9.8 | 13.33% | — | 3.5 | Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a m… | May 26, 2016 |
| CVE-2013-0340 | MEDIUM | 6.8 | 19.43% | — | 3.9 | expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetE… | Jan 21, 2014 |
| CVE-2013-0340 | MEDIUM | 6.8 | 19.43% | — | 3.7 | expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetE… | Jan 21, 2014 |
| CVE-2013-0340 | MEDIUM | 6.8 | 19.43% | — | 3.6 | expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetE… | Jan 21, 2014 |
| CVE-2013-0340 | MEDIUM | 6.8 | 19.43% | — | 3.8 | expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetE… | Jan 21, 2014 |
Add a Python 3 EOL badge to your README
Show your users which Python version your project runs and whether it is still supported. The badge updates automatically. More formats and options →
[](https://eolcanary.com/explore/python/3)Frequently asked questions
Is Python 3 end of life?
Partially. 11 of the 16 Python 3.x releases have reached end of life. Still supported: 3.15, 3.14, 3.13, 3.12, 3.11 (until October 31, 2031 at the latest).
What CVEs affect Python 3?
There are 49 CVEs tracked for Python 3.x, including 10 critical severity issues. See the full list above with CVSS and EPSS scores.
What is the latest Python 3 version?
The latest Python 3.x patch release is 3.15.1, released on October 21, 2026. Always run the latest patch to benefit from all security fixes.
When was Python 3 first released?
Python 3.0 was released on December 3, 2008. See the full version timeline in the table above.
Is it safe to run Python 3 in production?
Only on a supported release (3.15, 3.14, 3.13, 3.12, 3.11). Support for Python 3.15 ends on October 31, 2031. Make sure you run the latest patch (3.15.1) to have all security fixes applied.
Data sourced from endoflife.date · CVE data from NVD · EPSS from FIRST.org · KEV from CISA