| Bug | bookworm | Description |
|---|
| CVE-2026-9669 | vulnerable (no DSA) | bz2.BZ2Decompressor objects could be reused after a decompression erro ... |
| CVE-2026-8328 | vulnerable (no DSA) | The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4 ... |
| CVE-2026-7774 | vulnerable (no DSA) | tarfile.data_filter could be bypassed using crafted link entries, incl ... |
| CVE-2026-7210 | vulnerable (no DSA) | `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entro ... |
| CVE-2026-6100 | vulnerable (no DSA) | Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2 ... |
| CVE-2026-6019 | vulnerable (no DSA) | http.cookies.Morsel.js_output() returns an inline <script> snippet and ... |
| CVE-2026-4519 | vulnerable (no DSA) | The webbrowser.open() API would accept leading dashes in the URL which ... |
| CVE-2026-4224 | vulnerable (no DSA) | When an Expat parser with a registered ElementDeclHandler parses an in ... |
| CVE-2026-3644 | vulnerable (no DSA) | The fix for CVE-2026-0672, which rejected control characters in http.c ... |
| CVE-2026-3446 | vulnerable (no DSA, ignored) | When calling base64.b64decode() or related functions the decoding proc ... |
| CVE-2026-3276 | vulnerable (no DSA) | unicodedata.normalize() can take excessive CPU time when processing sp ... |
| CVE-2026-2297 | vulnerable (no DSA) | The import hook in CPython that handles legacy *.pyc files (Sourceless ... |
| CVE-2026-1502 | vulnerable (no DSA) | CR/LF bytes were not rejected by HTTP client proxy tunnel headers or h ... |
| CVE-2025-69534 | vulnerable (no DSA) | Python-Markdown version 3.8 contain a vulnerability where malformed HT ... |
| CVE-2025-15367 | vulnerable (no DSA, ignored) | The poplib module, when passed a user-controlled command, can have add ... |
| CVE-2025-15366 | vulnerable (no DSA, ignored) | The imaplib module, when passed a user-controlled command, can have ad ... |
| CVE-2025-13462 | vulnerable (no DSA) | The "tarfile" module would still apply normalization of AREGTYPE (\x00 ... |
| CVE-2025-12781 | vulnerable (no DSA, ignored) | When passing data to the b64decode(), standard_b64decode(), and urlsaf ... |
| Bug | Description |
|---|
| CVE-2026-4786 | Mitgation ofCVE-2026-4519 was incomplete. If the URL contained "%actio ... |
| CVE-2026-3298 | The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Wind ... |
| CVE-2026-3087 | If `shutil.unpack_archive()` is given a ZIP archive with an absolute W ... |
| CVE-2026-1299 | The email module, specifically the "BytesGenerator" class, didn\u2019 ... |
| CVE-2026-0865 | User-controlled header names and values containing newlines can allow ... |
| CVE-2026-0672 | When using http.cookies.Morsel, user-controlled cookie values and para ... |
| CVE-2025-15282 | User-controlled data URLs parsed by urllib.request.DataHandler allow i ... |
| CVE-2025-13837 | When loading a plist file, the plistlib module reads data in size spec ... |
| CVE-2025-13836 | When reading an HTTP response from a server, if no read amount is spec ... |
| CVE-2025-12084 | When building nested elements using xml.dom.minidom methods such as ap ... |
| CVE-2025-11468 | When folding a long comment in an email header containing exclusively ... |
| CVE-2025-8291 | The 'zipfile' module would not check the validity of the ZIP64 End of ... |
| CVE-2025-8194 | There is a defect in the CPython \u201ctarfile\u201d module affecting ... |
| CVE-2025-6075 | If the value passed to os.path.expandvars() is user-controlled a perf ... |
| CVE-2025-6069 | The html.parser.HTMLParser class had worse-case quadratic complexity w ... |
| CVE-2025-4517 | Allows arbitrary filesystem writes outside the extraction directory du ... |
| CVE-2025-4516 | There is an issue in CPython when using `bytes.decode("unicode_escape" ... |
| CVE-2025-4435 | When using a TarFile.errorlevel = 0and extracting with a filter the do ... |
| CVE-2025-4330 | Allows the extraction filter to be ignored, allowing symlink targets t ... |
| CVE-2025-4138 | Allows the extraction filter to be ignored, allowing symlink targets t ... |
| CVE-2025-1795 | During an address list folding when a separating comma ends up on a fo ... |
| CVE-2025-0938 | The Python standard library functions `urllib.parse.urlsplit` and `url ... |
| CVE-2024-12718 | Allows modifying some file metadata (e.g. last modified) with filter=" ... |
| CVE-2024-12254 | Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writel ... |
| CVE-2024-11168 | The urllib.parse.urlsplit() and urlparse() functions improperly valida ... |
| CVE-2024-9287 | A vulnerability has been found in the CPython `venv` module and CLI wh ... |
| CVE-2024-8088 | There is a HIGH severity vulnerability affecting the CPython "zipfile" ... |
| CVE-2024-7592 | There is a LOW severity vulnerability affecting CPython, specifically ... |
| CVE-2024-6923 | There is a MEDIUM severity vulnerability affecting CPython. The emai ... |
| CVE-2024-6232 | There is a MEDIUM severity vulnerability affecting CPython. Regul ... |
| CVE-2024-5642 | CPython 3.9 and earlier doesn't disallow configuring an empty list ("[ ... |
| CVE-2024-4032 | The \u201cipaddress\u201d module contained incorrect information about ... |
| CVE-2024-4030 | On Windows a directory returned by tempfile.mkdtemp() would not always ... |
| CVE-2024-3220 | There is a defect in the CPython standard library module \u201cmimetyp ... |
| CVE-2024-3219 | The \u201csocket\u201d module provides a pure-Python fallback to the ... |
| CVE-2024-0450 | An issue was found in the CPython `zipfile` module affecting versions ... |
| CVE-2024-0397 | A defect was discovered in the Python \u201cssl\u201d module where the ... |
| CVE-2023-41105 | An issue was discovered in Python 3.11 through 3.11.4. If a path conta ... |
| CVE-2023-40217 | An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, ... |
| CVE-2023-38898 | An issue in Python cpython v.3.7 allows an attacker to obtain sensitiv ... |
| CVE-2023-33595 | CPython v3.12.0 alpha 7 was discovered to contain a heap use-after-fre ... |
| CVE-2023-27043 | The email module of Python through 3.11.3 incorrectly parses e-mail ad ... |
| CVE-2023-24329 | An issue in the urllib.parse component of Python before 3.11.4 allows ... |
| CVE-2023-6597 | An issue was found in the CPython `tempfile.TemporaryDirectory` class ... |
| CVE-2023-6507 | An issue was found in CPython 3.12.0 `subprocess` module on POSIX plat ... |
| CVE-2022-45061 | An issue was discovered in Python before 3.11.1. An unnecessary quadra ... |
| CVE-2022-42919 | Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows lo ... |
| CVE-2021-28861 | Python 3.x through 3.10 has an open redirection vulnerability in lib/h ... |
| CVE-2020-10735 | A flaw was found in python. In algorithms with quadratic time complexi ... |