Browse CVEs

HIGH 7.5 CVE-2026-32274 Black is the uncompromising Python code formatter. Starting in version 24.3.0 and prior to version 26.3.1, Black writes a cache file, the name of whi… Black 26.3.1+ Fix from $1,9502026-03-12 CRITICAL 9.8 CVE-2026-31900 Black is the uncompromising Python code formatter. Black provides a GitHub action for formatting code. This action supports an option, use_pyproject:… Black 26.3.0+ Fix from $2,3002026-03-11 HIGH 7.5 CVE-2026-25990 Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image.… Pillow 12.1.1+ Fix from $1,9502026-02-11 MEDIUM 5.3 CVE-2025-12781 When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always … Python 3.13.10 / 3.14.1+ Fix from $1,6002026-01-21 HIGH 7.5 CVE-2026-21441 urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the c… Urllib3 2.6.3+ Fix from $1,9502026-01-07 HIGH 7.5 CVE-2025-66471 urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly co… Urllib3 2.6.0+ Fix from $1,9502025-12-05 HIGH 7.5 CVE-2025-66418 urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chai… Urllib3 2.6.0+ Fix from $1,9502025-12-05 MEDIUM 5.3 CVE-2025-12084 When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadra… Python 3.13.11 / 3.14.2+ Fix from $1,6002025-12-03 HIGH 7.5 CVE-2025-13836 When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malici… Python 3.10.20 / 3.11.15+ Fix from $1,9502025-12-01 MEDIUM 5.5 CVE-2025-13837 When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues Python 3.13.10 / 3.14.1+ Fix from $1,6002025-12-01 MEDIUM 5.5 CVE-2025-6075 If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables. Python 3.9.0 / 3.13.11+ Fix from $1,6002025-10-31 MEDIUM 5.5 CVE-2025-48379 Pillow is a Python imaging library. In versions 11.2.0 to before 11.3.0, there is a heap buffer overflow when writing a sufficiently large (>64k enco… Pillow Patch available Fix from $1,6002025-07-01 MEDIUM 6.1 CVE-2025-50182 urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browse… Urllib3 2.5.0+ Fix from $1,6002025-06-19 MEDIUM 6.1 CVE-2025-50181 urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a Po… Urllib3 2.5.0+ Fix from $1,6002025-06-19 HIGH 8.8 CVE-2025-47273 setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `Pac… Setuptools 78.1.1+ Fix from $1,9502025-05-17 HIGH 7.8 CVE-2024-9287 A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted pro… Python 3.9.21 / 3.10.16+ Fix from $1,9502024-10-22 HIGH 7.5 CVE-2024-6232 There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile heade… Python 3.8.20 / 3.9.20+ Fix from $1,9502024-09-03 HIGH 7.5 CVE-2024-7592 There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contain… Python 3.8.20 / 3.9.20+ Fix from $1,9502024-08-19 MEDIUM 6.5 CVE-2024-37891 urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header i… Urllib3 1.26.19 / 2.2.2+ Fix from $1,6002024-06-17 MEDIUM 5.9 CVE-2024-28219 In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy. Pillow 10.3.0+ Fix from $1,6002024-04-03 HIGH 8.1 CVE-2023-50447 Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817… Pillow after 10.1.0 Fix from $1,9502024-01-19 HIGH 7.5 CVE-2023-44271 An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially … Pillow 10.0.0+ Fix from $1,9502023-11-03 MEDIUM 6.1 CVE-2018-25091 urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, po… Urllib3 1.24.2+ Fix from $1,6002023-10-15 HIGH 8.1 CVE-2023-43804 urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing… Urllib3 1.26.17 / 2.0.6+ Fix from $1,9502023-10-04 MEDIUM 5.3 CVE-2023-40217 An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (… Python 3.8.18 / 3.9.18+ Fix from $1,6002023-08-25 HIGH 7.5 CVE-2023-41105 An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath(), the path will be truncated un… Python after 3.11.4 Fix from $1,9502023-08-23 CRITICAL 9.8 CVE-2022-48565 An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist fil… Python 3.6.13 / 3.7.10+ Fix from $2,3002023-08-22 MEDIUM 5.9 CVE-2022-48566 An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumula… Python 3.6.13 / 3.7.10+ Fix from $1,6002023-08-22 HIGH 7.5 CVE-2022-48560 A use-after-free exists in Python through 3.9 via heappushpop in heapq. Python 3.6.11 / 3.7.7+ Fix from $1,9502023-08-22 MEDIUM 6.5 CVE-2022-48564 read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple P… Python 3.6.13 / 3.7.10+ Fix from $1,6002023-08-22