PS
Vendor security profile
Python Software Foundation
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs35
Critical3
CISA KEV0
Public exploit2
Patch rate%100
Avg. CVSS6.2
12-month vulnerability rate
0
0
1
0
5
5
2
8
2
5
5
0
CVE KEV
CVE severity distribution
35toplam CVE
Critical3 (9%)
High10 (29%)
Medium17 (49%)
Low5 (14%)
Patch and exploitation view
%100
Verified patch
%0
CISA KEV
%6
Public exploit
35Patch available
0Partial
0Workaround
0Vendor: no patch
0Unknown
Latest vulnerabilities
7.6
CVE-2026-19553
SSLContext.wrap_bio() missing validation of server_hostname parameter
PS
Patch verifiedEPSS %0
9.2
CVE-2026-19445
Use-after-free of a server-side SSLContext when sni_callback switches contexts
PS
Patch verifiedEPSS %0
5.9
CVE-2026-12345
Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory
PS
Patch verifiedEPSS %0
8.4
CVE-2026-82049
tarfile extraction filters allow file modification and content disclosure via hard link to symlink
PS
Patch verifiedEPSS %0
5.7
CVE-2026-87910
tarfile hardlink fallback ignores custom extraction filter rejection via None
PS
Patch verifiedEPSS %1
2.1
CVE-2026-15310
zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits
PS
Patch verifiedEPSS %1
6.3
CVE-2026-19672
tarfile extraction filter bypass allows creation of directories outside the destination
PS
Patch verifiedEPSS %0
6.0
CVE-2026-15806
`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching
PS
Patch verifiedEPSS %1
6.0
CVE-2026-17084
stringprep.map_table_b2() deviates from RFC 3454 Table B.2
PS
Patch verifiedEPSS %1
2.4
CVE-2026-18503
Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()
PS
Patch verifiedEPSS %0