Skip to content
Noroxi

Python records

323 published records for vendor Python. 0 of them have been exploited in the wild (listed in CISA KEV) and 1 have a ready-made attack tool.

Filter by product ↓

Researcher profile

Entered KEV
0 · 0%
Weaponized
1 · 0.3%
Pre-auth RCE
25
With a fix record
95.7%
Median publish → KEV
No record has entered KEV

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 25
  10. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

323 records
  • CVE-2014-0224
    60This week

    OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, whi

    HighCVSS 7.4WeaponizedEPSS 95%

    openssl · opensslJun 5, 2014

  • CVE-2016-2183
    58Plan

    The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of appr

    HighCVSS 7.5Proof of conceptEPSS 94%

    redhat · jboss enterprise application platformAug 31, 2016

  • CVE-2007-4559
    47Plan

    Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remot

    CriticalCVSS 9.8Proof of conceptEPSS 27%

    python · pythonAug 27, 2007

  • CVE-2016-5636
    47Plan

    Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 all

    CriticalCVSS 9.8Proof of conceptEPSS 25%

    python · pythonSep 2, 2016

  • CVE-2018-25032
    46Plan

    zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.

    HighCVSS 7.5Proof of conceptEPSS 51%

    zlib · zlibMar 25, 2022

  • CVE-2021-3177
    46Plan

    Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Pyth

    CriticalCVSS 9.8No exploitEPSS 24%

    python · pythonJan 19, 2021

  • CVE-2014-4650
    46Plan

    The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which al

    CriticalCVSS 9.8Proof of conceptEPSS 23%

    python · pythonFeb 20, 2020

  • CVE-2018-1000802
    45Plan

    Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('C

    CriticalCVSS 9.8Proof of conceptEPSS 20%

    python · pythonSep 18, 2018

  • CVE-2016-0718
    43Plan

    Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input docum

    CriticalCVSS 9.8No exploitEPSS 13%

    mozilla · firefoxMay 26, 2016

  • CVE-2014-3007
    43Plan

    Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharact

    CriticalCVSS 10.0No exploitEPSS 10%

    python · pillowApr 27, 2014

  • CVE-2020-27619
    42Plan

    In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP.

    CriticalCVSS 9.8No exploitEPSS 8%

    python · pythonOct 22, 2020

  • CVE-2019-12900
    41Plan

    BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.

    CriticalCVSS 9.8No exploitEPSS 7%

    bzip · bzip2Jun 19, 2019

  • CVE-2017-1000158
    41Plan

    CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in

    CriticalCVSS 9.8No exploitEPSS 7%

    python · pythonNov 17, 2017

  • CVE-2016-4009
    41Plan

    Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote attackers to have u

    CriticalCVSS 9.8No exploitEPSS 7%

    python · pillowApr 13, 2016

  • CVE-2019-9636
    41Plan

    Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NF

    CriticalCVSS 9.8No exploitEPSS 7%

    python · pythonMar 8, 2019

  • CVE-2022-37454
    41Plan

    The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to

    CriticalCVSS 9.8No exploitEPSS 7%

    extended keccak code package project · extended keccak code packageOct 21, 2022

  • CVE-2021-29921
    41Plan

    In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string.

    CriticalCVSS 9.8No exploitEPSS 6%

    python · pythonMay 6, 2021

  • CVE-2016-9063
    41Plan

    An integer overflow during the parsing of XML using the Expat library.

    CriticalCVSS 9.8No exploitEPSS 5%

    mozilla · firefoxJun 11, 2018

  • CVE-2022-48565
    41Plan

    An XML External Entity (XXE) issue was discovered in Python through 3.9.1.

    CriticalCVSS 9.8Proof of conceptEPSS 5%

    python · pythonAug 22, 2023

  • CVE-2019-10160
    41Plan

    A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7

    CriticalCVSS 9.8No exploitEPSS 5%

    python · pythonJun 7, 2019

  • CVE-2008-5031
    41Plan

    Multiple integer overflows in Python 2.2.3 through 2.5.1, and 2.6, allow context-dependent attackers to have an unknown impact via a large i

    CriticalCVSS 10.0No exploitEPSS 2%

    python · pythonNov 10, 2008

  • CVE-2019-9948
    40Plan

    urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechani

    CriticalCVSS 9.1No exploitEPSS 11%

    python · pythonMar 23, 2019

  • CVE-2017-2810
    40Plan

    An exploitable vulnerability exists in the Databook loading functionality of Tablib 0.11.4.

    CriticalCVSS 9.8No exploitEPSS 4%

    python · tablibJun 14, 2017

  • CVE-2020-13388
    40Plan

    An exploitable vulnerability exists in the configuration-loading functionality of the jw.util package before 2.3 for Python.

    CriticalCVSS 9.8No exploitEPSS 4%

    python · jw.utilMay 22, 2020

  • CVE-2018-20060
    40Plan

    urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that diff

    CriticalCVSS 9.8No exploitEPSS 4%

    python · urllib3Dec 11, 2018