Petr Viktorin (https://github.com/encukou)

13 credited records · 13 in the last 12 months · 0 in CISA KEV

Names are free text from CNA records; the same person may appear under different spellings. Write to us for corrections.

Credited records

Researchers

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
23Monitor	CVE-2026-12345No exploit	Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directorypython software foundation · cpython · CWE-59 Local privilege escalation Race condition	Medium5.9	—	—	1 day ago
33Monitor	CVE-2026-82049No exploit	tarfile extraction filters allow file modification and content disclosure via hard link to symlinkpython software foundation · cpython · CWE-59	High8.4	—	0.2%	Sep 14, 2026
22Monitor	CVE-2026-87910No exploit	tarfile hardlink fallback ignores custom extraction filter rejection via Nonepython software foundation · cpython · CWE-22 Path traversal	Medium5.7	—	0.5%	Sep 11, 2026
8Monitor	CVE-2026-15310No exploit	zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limitspython software foundation · cpython · CWE-400 Pre-auth Denial of service	Low2.1	—	0.5%	Aug 25, 2026
25Monitor	CVE-2026-19672No exploit	tarfile extraction filter bypass allows creation of directories outside the destinationpython software foundation · cpython · CWE-22 Pre-auth Path traversal	Medium6.3	—	0.5%	Aug 19, 2026
24Monitor	CVE-2026-17084No exploit	stringprep.map_table_b2() deviates from RFC 3454 Table B.2python software foundation · cpython · CWE-436 Pre-auth	Medium6.0	—	0.7%	Aug 18, 2026
8Monitor	CVE-2026-6879No exploit	Quadratic Behavior in xml.etree.ElementPath Index Predicatespython software foundation · cpython · CWE-407	Low2.0	—	0.6%	Jul 28, 2026
8Monitor	CVE-2026-4360No exploit	Tarfile.extract() doesn't fully respect filter parameterpython · python · CWE-281	Low2.0	—	0.5%	Jun 30, 2026
32Monitor	CVE-2026-11972No exploit	tarfile opened in streaming mode mishandles EOFpython software foundation · cpython · CWE-252 Pre-auth	High8.2	—	0.7%	Jun 23, 2026
16Monitor	CVE-2026-0864No exploit	Configuration Injection via Carriage Return (\r) in write() methodpython · python · CWE-74	Medium4.1	—	0.2%	Jun 23, 2026
31Monitor	CVE-2026-11940No exploit	tarfile extraction filter bypass allows escaping the destination directorypython software foundation · cpython · CWE-22 Pre-auth Path traversal	High7.8	—	0.8%	Jun 23, 2026
27Monitor	CVE-2026-7774No exploit	tarfile.data_filter path traversal bypass allows writing outside the extraction directorypython software foundation · cpython · CWE-22 Pre-auth Path traversal	Medium6.9	—	0.8%	Jun 4, 2026
25Monitor	CVE-2026-3276No exploit	Potential DoS via quadratic complexity in unicodedata.normalize()python software foundation · cpython · CWE-407 Pre-auth	Medium6.3	—	0.7%	Jun 3, 2026

CVE-2026-12345
23Monitor
Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory
MediumCVSS 5.9No exploit
- Local privilege escalation
- Race condition
python software foundation · cpython1 day ago
CVE-2026-82049
33Monitor
tarfile extraction filters allow file modification and content disclosure via hard link to symlink
HighCVSS 8.4No exploitEPSS 0%
python software foundation · cpythonSep 14, 2026
CVE-2026-87910
22Monitor
tarfile hardlink fallback ignores custom extraction filter rejection via None
MediumCVSS 5.7No exploitEPSS 1%
- Path traversal
python software foundation · cpythonSep 11, 2026
CVE-2026-15310
8Monitor
zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits
LowCVSS 2.1No exploitEPSS 1%
- Pre-auth
- Denial of service
python software foundation · cpythonAug 25, 2026
CVE-2026-19672
25Monitor
tarfile extraction filter bypass allows creation of directories outside the destination
MediumCVSS 6.3No exploitEPSS 1%
- Pre-auth
- Path traversal
python software foundation · cpythonAug 19, 2026
CVE-2026-17084
24Monitor
stringprep.map_table_b2() deviates from RFC 3454 Table B.2
MediumCVSS 6.0No exploitEPSS 1%
- Pre-auth
python software foundation · cpythonAug 18, 2026
CVE-2026-6879
8Monitor
Quadratic Behavior in xml.etree.ElementPath Index Predicates
LowCVSS 2.0No exploitEPSS 1%
python software foundation · cpythonJul 28, 2026
CVE-2026-4360
8Monitor
Tarfile.extract() doesn't fully respect filter parameter
LowCVSS 2.0No exploitEPSS 0%
python · pythonJun 30, 2026
CVE-2026-11972
32Monitor
tarfile opened in streaming mode mishandles EOF
HighCVSS 8.2No exploitEPSS 1%
- Pre-auth
python software foundation · cpythonJun 23, 2026
CVE-2026-0864
16Monitor
Configuration Injection via Carriage Return (\r) in write() method
MediumCVSS 4.1No exploitEPSS 0%
python · pythonJun 23, 2026
CVE-2026-11940
31Monitor
tarfile extraction filter bypass allows escaping the destination directory
HighCVSS 7.8No exploitEPSS 1%
- Pre-auth
- Path traversal
python software foundation · cpythonJun 23, 2026
CVE-2026-7774
27Monitor
tarfile.data_filter path traversal bypass allows writing outside the extraction directory
MediumCVSS 6.9No exploitEPSS 1%
- Pre-auth
- Path traversal
python software foundation · cpythonJun 4, 2026
CVE-2026-3276
25Monitor
Potential DoS via quadratic complexity in unicodedata.normalize()
MediumCVSS 6.3No exploitEPSS 1%
- Pre-auth
python software foundation · cpythonJun 3, 2026