agentprime: python-software-foundation-cpython

agentprime: python-software-foundation-cpythonEvery new CVE for python-software-foundation-cpython.https://agentprime.io/CVE-2026-116566: socket.getaddrinfo() accepts embedded null bytes in host and porthttps://agentprime.io/advisories/CVE-2026-116566/https://agentprime.io/advisories/CVE-2026-116566/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 17:45:47 GMTCVECVE-2026-103995: Lenient parsing of integers for response body and chunk framinghttps://agentprime.io/advisories/CVE-2026-103995/https://agentprime.io/advisories/CVE-2026-103995/CVSS 2.0 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 27 Oct 2026 19:58:52 GMTCVECVE-2026-115557: Distrust compromised intermediate certificates in ssl modulehttps://agentprime.io/advisories/CVE-2026-115557/https://agentprime.io/advisories/CVE-2026-115557/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Sat, 24 Oct 2026 14:15:14 GMTCVEcriticalCVE-2026-114583: tar filter allows writing outside destination via empty-named symlinkhttps://agentprime.io/advisories/CVE-2026-114583/https://agentprime.io/advisories/CVE-2026-114583/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 22 Oct 2026 20:57:36 GMTCVECVE-2026-19553: SSLContext.wrap_bio() missing validation of server_hostname parameterhttps://agentprime.io/advisories/CVE-2026-19553/https://agentprime.io/advisories/CVE-2026-19553/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 30 Sep 2026 16:17:39 GMTCVECVE-2026-19445: Use-after-free of a server-side SSLContext when sni_callback switches contextshttps://agentprime.io/advisories/CVE-2026-19445/https://agentprime.io/advisories/CVE-2026-19445/CVSS 9.2 (Critical). Critical: CVSS score 9.2: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 30 Sep 2026 16:16:04 GMTCVEcriticalCVE-2026-12345: Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directoryhttps://agentprime.io/advisories/CVE-2026-12345/https://agentprime.io/advisories/CVE-2026-12345/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 29 Sep 2026 17:46:01 GMTCVECVE-2026-82049: tarfile extraction filters allow file modification and content disclosure via hard link to symlinkhttps://agentprime.io/advisories/CVE-2026-82049/https://agentprime.io/advisories/CVE-2026-82049/CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 19:14:03 GMTCVECVE-2026-87910: tarfile hardlink fallback ignores custom extraction filter rejection via Nonehttps://agentprime.io/advisories/CVE-2026-87910/https://agentprime.io/advisories/CVE-2026-87910/CVSS 5.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 11 Sep 2026 17:27:04 GMTCVECVE-2026-15310: zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limitshttps://agentprime.io/advisories/CVE-2026-15310/https://agentprime.io/advisories/CVE-2026-15310/CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 25 Aug 2026 15:07:58 GMTCVECVE-2026-19672: tarfile extraction filter bypass allows creation of directories outside the destinationhttps://agentprime.io/advisories/CVE-2026-19672/https://agentprime.io/advisories/CVE-2026-19672/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 19 Aug 2026 15:24:08 GMTCVECVE-2026-15806: `HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matchinghttps://agentprime.io/advisories/CVE-2026-15806/https://agentprime.io/advisories/CVE-2026-15806/CVSS 6.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Aug 2026 15:50:57 GMTCVECVE-2026-17084: stringprep.map_table_b2() deviates from RFC 3454 Table B.2https://agentprime.io/advisories/CVE-2026-17084/https://agentprime.io/advisories/CVE-2026-17084/CVSS 6.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Aug 2026 13:57:31 GMTCVECVE-2026-18503: Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()https://agentprime.io/advisories/CVE-2026-18503/https://agentprime.io/advisories/CVE-2026-18503/CVSS 2.4 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 13:45:31 GMTCVECVE-2026-6879: Quadratic Behavior in xml.etree.ElementPath Index Predicateshttps://agentprime.io/advisories/CVE-2026-6879/https://agentprime.io/advisories/CVE-2026-6879/CVSS 2.0 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 28 Jul 2026 13:46:30 GMTCVECVE-2026-15308: Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarationshttps://agentprime.io/advisories/CVE-2026-15308/https://agentprime.io/advisories/CVE-2026-15308/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 09 Jul 2026 17:10:57 GMTCVECVE-2026-4360: Tarfile.extract() doesn't fully respect filter parameterhttps://agentprime.io/advisories/CVE-2026-4360/https://agentprime.io/advisories/CVE-2026-4360/CVSS 2.0 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 30 Jun 2026 14:45:35 GMTCVECVE-2026-11972: tarfile opened in streaming mode mishandles EOFhttps://agentprime.io/advisories/CVE-2026-11972/https://agentprime.io/advisories/CVE-2026-11972/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 23 Jun 2026 22:02:45 GMTCVECVE-2026-0864: Configuration Injection via Carriage Return (\r) in write() methodhttps://agentprime.io/advisories/CVE-2026-0864/https://agentprime.io/advisories/CVE-2026-0864/CVSS 4.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 23 Jun 2026 17:42:01 GMTCVECVE-2026-11940: tarfile extraction filter bypass allows escaping the destination directoryhttps://agentprime.io/advisories/CVE-2026-11940/https://agentprime.io/advisories/CVE-2026-11940/CVSS 7.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 23 Jun 2026 16:04:17 GMTCVECVE-2026-12003: CPython >3.11 Insecure Input Validation resulting in privilege escalationhttps://agentprime.io/advisories/CVE-2026-12003/https://agentprime.io/advisories/CVE-2026-12003/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 16 Jun 2026 15:18:42 GMTCVECVE-2026-9669: bz2.BZ2Decompressor reuse after error can cause a stack buffer overflowhttps://agentprime.io/advisories/CVE-2026-9669/https://agentprime.io/advisories/CVE-2026-9669/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 08 Jun 2026 22:01:15 GMTCVECVE-2026-7774: tarfile.data_filter path traversal bypass allows writing outside the extraction directoryhttps://agentprime.io/advisories/CVE-2026-7774/https://agentprime.io/advisories/CVE-2026-7774/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 04 Jun 2026 14:21:23 GMTCVECVE-2026-3276: Potential DoS via quadratic complexity in unicodedata.normalize()https://agentprime.io/advisories/CVE-2026-3276/https://agentprime.io/advisories/CVE-2026-3276/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 03 Jun 2026 14:29:39 GMTCVECVE-2026-8328: FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host addresshttps://agentprime.io/advisories/CVE-2026-8328/https://agentprime.io/advisories/CVE-2026-8328/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 13 May 2026 20:14:33 GMTCVECVE-2026-7210: The expat and elementtree parsers use insufficient entropy for XML hash-flooding protectionhttps://agentprime.io/advisories/CVE-2026-7210/https://agentprime.io/advisories/CVE-2026-7210/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 11 May 2026 17:19:09 GMTCVECVE-2026-3087: shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPshttps://agentprime.io/advisories/CVE-2026-3087/https://agentprime.io/advisories/CVE-2026-3087/CVSS 6.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 27 Apr 2026 20:46:43 GMTCVECVE-2026-6019: BaseCookie.js_output() does not neutralize embedded charactershttps://agentprime.io/advisories/CVE-2026-6019/https://agentprime.io/advisories/CVE-2026-6019/CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Wed, 22 Apr 2026 19:28:08 GMTCVECVE-2026-3298: Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbyteshttps://agentprime.io/advisories/CVE-2026-3298/https://agentprime.io/advisories/CVE-2026-3298/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 21 Apr 2026 14:45:01 GMTCVECVE-2026-5713: Out-of-bounds read/write during remote profiling and asyncio process introspection when connecting to malicious targethttps://agentprime.io/advisories/CVE-2026-5713/https://agentprime.io/advisories/CVE-2026-5713/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 14 Apr 2026 15:11:51 GMTCVECVE-2026-4786: Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()https://agentprime.io/advisories/CVE-2026-4786/https://agentprime.io/advisories/CVE-2026-4786/CVSS 7.0 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 13 Apr 2026 21:52:19 GMTCVECVE-2026-6100: Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressurehttps://agentprime.io/advisories/CVE-2026-6100/https://agentprime.io/advisories/CVE-2026-6100/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 13 Apr 2026 17:15:47 GMTCVEcriticalCVE-2026-3446: Base64 decoding stops at first padded quad by defaulthttps://agentprime.io/advisories/CVE-2026-3446/https://agentprime.io/advisories/CVE-2026-3446/CVSS 6.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Apr 2026 18:17:35 GMTCVECVE-2026-1502: HTTP client proxy tunnel headers not validated for CR/LFhttps://agentprime.io/advisories/CVE-2026-1502/https://agentprime.io/advisories/CVE-2026-1502/CVSS 5.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Apr 2026 17:54:44 GMTCVECVE-2026-4519: webbrowser.open() allows leading dashes in URLshttps://agentprime.io/advisories/CVE-2026-4519/https://agentprime.io/advisories/CVE-2026-4519/CVSS 7.0 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 20 Mar 2026 15:08:32 GMTCVECVE-2026-3479: pkgutil.get_data() does not enforce documented restrictionshttps://agentprime.io/advisories/CVE-2026-3479/https://agentprime.io/advisories/CVE-2026-3479/CVSS 0.0 (None). Published by the CVE Program. Not analysed by agentprime yet.Wed, 18 Mar 2026 18:13:42 GMTCVECVE-2026-4224: Stack overflow parsing XML with deeply nested DTD content modelshttps://agentprime.io/advisories/CVE-2026-4224/https://agentprime.io/advisories/CVE-2026-4224/CVSS 6.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 16 Mar 2026 17:52:26 GMTCVECVE-2026-3644: Incomplete control character validation in http.cookieshttps://agentprime.io/advisories/CVE-2026-3644/https://agentprime.io/advisories/CVE-2026-3644/CVSS 6.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 16 Mar 2026 17:37:31 GMTCVECVE-2025-13462: tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handlinghttps://agentprime.io/advisories/CVE-2025-13462/https://agentprime.io/advisories/CVE-2025-13462/CVSS 2.0 (Low). Published by the CVE Program. Not analysed by agentprime yet.Thu, 12 Mar 2026 17:59:26 GMTCVECVE-2026-2297: SourcelessFileLoader does not use io.open_code()https://agentprime.io/advisories/CVE-2026-2297/https://agentprime.io/advisories/CVE-2026-2297/CVSS 5.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Mar 2026 22:10:43 GMTCVECVE-2026-1299: email BytesGenerator header injection due to unquoted newlineshttps://agentprime.io/advisories/CVE-2026-1299/https://agentprime.io/advisories/CVE-2026-1299/CVSS 6.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Jan 2026 16:27:13 GMTCVECVE-2025-12781: base64.b64decode() always accepts "+/" characters, despite setting altcharshttps://agentprime.io/advisories/CVE-2025-12781/https://agentprime.io/advisories/CVE-2025-12781/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Jan 2026 19:34:47 GMTCVECVE-2026-0672: Header injection in http.cookies.Morselhttps://agentprime.io/advisories/CVE-2026-0672/https://agentprime.io/advisories/CVE-2026-0672/CVSS 6.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 20 Jan 2026 21:52:33 GMTCVECVE-2025-15367: POP3 command injection in user-controlled commandshttps://agentprime.io/advisories/CVE-2025-15367/https://agentprime.io/advisories/CVE-2025-15367/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 20 Jan 2026 21:47:09 GMTCVECVE-2025-15366: IMAP command injection in user-controlled commandshttps://agentprime.io/advisories/CVE-2025-15366/https://agentprime.io/advisories/CVE-2025-15366/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 20 Jan 2026 21:40:24 GMTCVECVE-2025-15282: Header injection via newlines in data URL mediatypehttps://agentprime.io/advisories/CVE-2025-15282/https://agentprime.io/advisories/CVE-2025-15282/CVSS 6.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 20 Jan 2026 21:35:13 GMTCVECVE-2026-0865: wsgiref.headers.Headers allows header newline injectionhttps://agentprime.io/advisories/CVE-2026-0865/https://agentprime.io/advisories/CVE-2026-0865/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 20 Jan 2026 21:26:15 GMTCVECVE-2025-11468: Folding email comments of unfoldable characters doesn't preserve parenthesishttps://agentprime.io/advisories/CVE-2025-11468/https://agentprime.io/advisories/CVE-2025-11468/CVSS 5.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 20 Jan 2026 21:09:11 GMTCVECVE-2025-12084: Quadratic complexity in node ID cache clearinghttps://agentprime.io/advisories/CVE-2025-12084/https://agentprime.io/advisories/CVE-2025-12084/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 03 Dec 2025 18:55:32 GMTCVECVE-2025-13837: Out-of-memory when loading Plisthttps://agentprime.io/advisories/CVE-2025-13837/https://agentprime.io/advisories/CVE-2025-13837/CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 01 Dec 2025 18:13:32 GMTCVE