# Python Software Foundation CPython. Every CVE that names Python Software Foundation CPython among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first (an older page) - [Use-after-free in "unicode_escape" decoder with error handler](https://agentprime.io/advisories/CVE-2025-4516.md) `CVE-2025-4516` · CVE record: Python Software Foundation CPython · CVSS 5.9 Medium · Not analysed yet · Published 15 May 2025 · Tags: Memory corruption - [Mishandling of comma during folding and unicode-encoding of email headers](https://agentprime.io/advisories/CVE-2025-1795.md) `CVE-2025-1795` · CVE record: Python Software Foundation CPython · CVSS 2.3 Low · Not analysed yet · Published 28 Feb 2025 · Tags: CWE-116 - [Default mimetype known files writeable on Windows](https://agentprime.io/advisories/CVE-2024-3220.md) `CVE-2024-3220` · CVE record: Python Software Foundation CPython · CVSS 2.3 Low · Not analysed yet · Published 14 Feb 2025 · Tags: CWE-426 - [URL parser allowed square brackets in domain names](https://agentprime.io/advisories/CVE-2025-0938.md) `CVE-2025-0938` · CVE record: Python Software Foundation CPython · CVSS 6.3 Medium · Not analysed yet · Published 31 Jan 2025 · Tags: CWE-20 - [Unbounded memory buffering in SelectorSocketTransport.writelines()](https://agentprime.io/advisories/CVE-2024-12254.md) `CVE-2024-12254` · CVE record: Python Software Foundation CPython · CVSS 8.7 High · Not analysed yet · Published 6 Dec 2024 · Tags: Denial of service - [Improper validation of IPv6 and IPvFuture addresses](https://agentprime.io/advisories/CVE-2024-11168.md) `CVE-2024-11168` · CVE record: Python Software Foundation CPython · CVSS 6.3 Medium · Not analysed yet · Published 12 Nov 2024 · Tags: Server-side request forgery (SSRF) - [Virtual environment (venv) activation scripts don't quote paths](https://agentprime.io/advisories/CVE-2024-9287.md) `CVE-2024-9287` · CVE record: Python Software Foundation CPython · CVSS 5.3 Medium · Not analysed yet · Published 22 Oct 2024 · Tags: CWE-428 - [Regular-expression DoS when parsing TarFile headers](https://agentprime.io/advisories/CVE-2024-6232.md) `CVE-2024-6232` · CVE record: Python Software Foundation CPython · CVSS 7.5 High · Not analysed yet · Published 3 Sept 2024 · Tags: Denial of service - [Infinite loop when iterating over zip archive entry names from zipfile.Path](https://agentprime.io/advisories/CVE-2024-8088.md) `CVE-2024-8088` · CVE record: Python Software Foundation CPython · CVSS 8.7 High · Not analysed yet · Published 22 Aug 2024 · Tags: Denial of service - [Quadratic complexity parsing cookies with backslashes](https://agentprime.io/advisories/CVE-2024-7592.md) `CVE-2024-7592` · CVE record: Python Software Foundation CPython · CVSS 7.5 High · Not analysed yet · Published 19 Aug 2024 · Tags: Denial of service - [Email header injection due to unquoted newlines](https://agentprime.io/advisories/CVE-2024-6923.md) `CVE-2024-6923` · CVE record: Python Software Foundation CPython · CVSS 5.5 Medium · Not analysed yet · Published 1 Aug 2024 · Tags: Code injection - [Pure-Python fallback of socket.socketpair() doesn’t authenticate peer connection](https://agentprime.io/advisories/CVE-2024-3219.md) `CVE-2024-3219` · CVE record: Python Software Foundation CPython · CVSS 5.1 Medium · Not analysed yet · Published 29 Jul 2024 · Tags: Authentication bypass - [Buffer overread when using an empty list with SSLContext.set_npn_protocols()](https://agentprime.io/advisories/CVE-2024-5642.md) `CVE-2024-5642` · CVE record: Python Software Foundation CPython · CVSS 6.5 Medium · Not analysed yet · Published 27 Jun 2024 - [Memory race condition in ssl.SSLContext certificate store methods](https://agentprime.io/advisories/CVE-2024-0397.md) `CVE-2024-0397` · CVE record: Python Software Foundation CPython · CVSS 7.4 High · Not analysed yet · Published 17 Jun 2024 · Tags: Race condition - [Incorrect IPv4 and IPv6 private ranges](https://agentprime.io/advisories/CVE-2024-4032.md) `CVE-2024-4032` · CVE record: Python Software Foundation CPython · CVSS 7.5 High · Not analysed yet · Published 17 Jun 2024 · Tags: CWE-697 - [tempfile.mkdtemp() may be readable and writeable by all users on Windows](https://agentprime.io/advisories/CVE-2024-4030.md) `CVE-2024-4030` · CVE record: Python Software Foundation CPython · CVSS 7.1 High · Not analysed yet · Published 7 May 2024 · Tags: Broken access control - [Python Software Foundation CPython: An issue was found in the CPython \`tempfile.TemporaryDirectory\` class affecting versions…](https://agentprime.io/advisories/CVE-2023-6597.md) `CVE-2023-6597` · CVE record: Python Software Foundation CPython · CVSS 7.8 High · Not analysed yet · Published 19 Mar 2024 - [Quoted zip-bomb protection for zipfile](https://agentprime.io/advisories/CVE-2024-0450.md) `CVE-2024-0450` · CVE record: Python Software Foundation CPython · CVSS 6.2 Medium · Not analysed yet · Published 19 Mar 2024 · Tags: CWE-405 - [Groups not dropped before running subprocess when using empty 'extra_groups' parameter](https://agentprime.io/advisories/CVE-2023-6507.md) `CVE-2023-6507` · CVE record: Python Software Foundation CPython · CVSS 6.1 Medium · Not analysed yet · Published 8 Dec 2023 · Tags: Privilege escalation Newest: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .