Comprueba tu versión
python3 -VRamas de versiones afectadas
- 3.15 14 CVE
- 3.14 15 CVE
- 3.13 19 CVE
- 3.12 18 CVE
- 3.11 25 CVE
- 3.10 34 CVE Fin de vida
- 3.9 46 CVE Fin de vida
- 3.8 56 CVE Fin de vida
- 3.7 69 CVE Fin de vida
- 3.6 69 CVE Fin de vida
- 3.5 68 CVE Fin de vida
- 3.4 70 CVE Fin de vida
- 3.3 69 CVE Fin de vida
- 3.2 68 CVE Fin de vida
- 3.1 67 CVE Fin de vida
- 3.0 62 CVE Fin de vida
- 2.7 83 CVE Fin de vida
- 2.6 63 CVE Fin de vida
- 2.5 75 CVE
- 2.4 72 CVE
- 2.3 70 CVE
- 2.2 72 CVE
- 2.1 70 CVE
- 2.0 70 CVE
- 1.6 64 CVE
- 1.5 64 CVE
- 1.3 63 CVE
- 1.2 63 CVE
- 0.9 63 CVE
Vulnerabilidades conocidas
| CVE | Título | Versiones afectadas | CVSS | Explotada | EPSS | Publicación |
|---|---|---|---|---|---|---|
| CVE-2026-15308 | Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations | < 3.10.21 ≥ 3.11.0 < 3.11.16 ≥ 3.12.0 < 3.12.14 | 8.7 | — | 2026-07-10 | |
| CVE-2026-4360 | Tarfile.extract() doesn't fully respect filter parameter | < 3.1.5 | 2.0 | — | 2026-06-30 | |
| CVE-2026-0864 | Configuration Injection via Carriage Return (\r) in write() method | < 3.10.21 ≥ 3.11.0 < 3.11.16 ≥ 3.12.0 < 3.12.14 | 4.1 | — | 2026-06-24 | |
| CVE-2026-7210 | The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection | < 3.13.14 ≥ 3.14.0 < 3.14.6 = 3.15.0 | 6.3 | — | 2026-05-12 | |
| CVE-2026-3087 | shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs | ≤ 3.14.4 = 3.15.0 | 6.0 | — | 2026-04-28 | |
| CVE-2026-6019 | BaseCookie.js_output() does not neutralize embedded characters | < 3.13.14 ≥ 3.14.0 ≤ 3.14.4 = 3.15.0 | 2.1 | — | 2026-04-23 | |
| CVE-2026-4519 | webbrowser.open() allows leading dashes in URLs | < 3.13.13 ≥ 3.14.0 < 3.14.4 = 3.15.0 | 7.0 | — | 2026-03-21 | |
| CVE-2026-4224 | Stack overflow parsing XML with deeply nested DTD content models | < 3.10.0 ≥ 3.13.0 < 3.13.13 ≥ 3.14.0 < 3.14.4 | 6.0 | — | 2026-03-17 | |
| CVE-2026-3644 | Incomplete control character validation in http.cookies | < 3.13.13 ≥ 3.14.0 < 3.14.4 = 3.15.0 | 6.0 | — | 2026-03-17 | |
| CVE-2025-13462 | tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling | < 3.13.13 ≥ 3.14.0 < 3.14.4 = 3.15.0 | 2.0 | — | 2026-03-13 | |
| CVE-2025-12781 | base64.b64decode() always accepts "+/" characters, despite setting altchars | < 3.13.10 ≥ 3.14.0 < 3.14.1 = 3.15.0 | 6.3 | — | 2026-01-22 | |
| CVE-2025-12084 | Quadratic complexity in node ID cache clearing | < 3.13.11 ≥ 3.14.0 < 3.14.2 = 3.15.0 | 6.3 | — | 2025-12-04 | |
| CVE-2025-13837 | Out-of-memory when loading Plist | < 3.13.10 ≥ 3.14.0 < 3.14.1 = 3.15.0 | 2.1 | — | 2025-12-02 | |
| CVE-2025-13836 | Excessive read buffering DoS in http.client | < 3.10.20 ≥ 3.11.0 < 3.11.15 ≥ 3.12.0 < 3.12.13 | 6.3 | — | 2025-12-02 | |
| CVE-2025-6075 | Quadratic complexity in os.path.expandvars() with user-controlled template | < 3.9.0 ≥ 3.13.1 < 3.13.11 ≥ 3.14.0 < 3.14.1 | 1.8 | — | 2025-11-01 | |
| CVE-2024-9287 | Virtual environment (venv) activation scripts don't quote paths | < 3.9.21 ≥ 3.10.0 < 3.10.16 ≥ 3.11.0 < 3.11.11 | 5.3 | — | 2024-10-23 | |
| CVE-2024-6232 | Regular-expression DoS when parsing TarFile headers | < 3.8.20 ≥ 3.9.0 < 3.9.20 ≥ 3.10.0 < 3.10.15 | 7.5 | — | 2024-09-03 | |
| CVE-2024-7592 | Quadratic complexity parsing cookies with backslashes | < 3.8.20 ≥ 3.9.0 < 3.9.20 ≥ 3.10.0 < 3.10.15 | 7.5 | — | 2024-08-20 | |
| CVE-2023-6507 | Groups not dropped before running subprocess when using empty 'extra_groups' parameter | = 3.12.0 = 3.13.0 | 6.1 | — | 2023-12-09 | |
| CVE-2023-40217 | An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before... | < 3.8.18 ≥ 3.9.0 < 3.9.18 ≥ 3.10.0 < 3.10.13 | 5.3 | — | 2023-08-25 | |
| CVE-2023-41105 | An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.no... | ≥ 3.11.0 ≤ 3.11.4 | 7.5 | — | 2023-08-23 | |
| CVE-2022-48560 | A use-after-free exists in Python through 3.9 via heappushpop in heapq. | < 3.6.11 ≥ 3.7.0 < 3.7.7 ≥ 3.8.0 < 3.8.2 | 7.5 | — | 2023-08-22 | |
| CVE-2022-48564 | read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhau... | < 3.6.13 ≥ 3.7.0 < 3.7.10 ≥ 3.8.0 < 3.8.7 | 6.5 | — | 2023-08-22 | |
| CVE-2022-48565 | An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accep... | < 3.6.13 ≥ 3.7.0 < 3.7.10 ≥ 3.8.0 < 3.8.7 | 9.8 | — | 2023-08-22 | |
| CVE-2022-48566 | An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating opti... | < 3.6.13 ≥ 3.7.0 < 3.7.10 ≥ 3.8.0 < 3.8.7 | 5.9 | — | 2023-08-22 | |
| CVE-2023-38898 | An issue in Python cpython v.3.7 allows an attacker to obtain sensitive information via the _asyncio._swap_cur... | = 3.13.0 | 5.3 | — | 2023-08-15 | |
| CVE-2023-36632 | The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError... | ≤ 3.11.4 | 7.5 | — | 2023-06-25 | |
| CVE-2023-33595 | CPython v3.12.0 alpha 7 was discovered to contain a heap use-after-free via the function ascii_decode at /Obje... | = 3.12.0 | 5.5 | — | 2023-06-07 | |
| CVE-2023-27043 | The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character... | ≤ 2.7.18 ≥ 3.0 < 3.8.20 ≥ 3.9.0 < 3.9.20 | 5.3 | — | 2023-04-18 | |
| CVE-2023-24329 | An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods... | < 3.7.17 ≥ 3.8.0 < 3.8.17 ≥ 3.9.0 < 3.9.17 | 7.5 | — | 2023-02-17 | |
| CVE-2022-45061 | An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when pr... | ≤ 3.7.15 ≥ 3.8.0 ≤ 3.8.15 ≥ 3.9.0 ≤ 3.9.15 | 7.5 | — | 2022-11-09 | |
| CVE-2022-42919 | Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-defaul... | ≥ 3.7.3 ≤ 3.7.15 ≥ 3.8.3 ≤ 3.8.15 ≥ 3.9.0 < 3.9.16 | 7.8 | — | 2022-11-06 | |
| CVE-2022-37454 | The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer ove... | ≥ 3.6.0 < 3.7.16 ≥ 3.8.0 < 3.8.16 ≥ 3.9.0 < 3.9.16 | 9.8 | — | 2022-10-21 | |
| CVE-2020-10735 | A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using in... | ≥ 3.7.0 < 3.7.14 ≥ 3.8.0 < 3.8.14 ≥ 3.9.0 < 3.9.14 | 6.2 | — | 2022-09-09 | |
| CVE-2021-4189 | A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive)... | ≥ 3.6.0 < 3.6.14 ≥ 3.7.0 < 3.7.11 ≥ 3.8.0 < 3.8.9 | 5.3 | — | 2022-08-24 | |
| CVE-2021-28861 | Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection again... | ≥ 3.0.0 < 3.7.14 ≥ 3.8.0 < 3.8.14 ≥ 3.9.0 < 3.9.14 | 6.5 | — | 2022-08-23 | |
| CVE-2017-20052 | Python pgAdmin4 uncontrolled search path | = 2.7.13 | 5.0 | — | 2022-06-16 | |
| CVE-2015-20107 | In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discover... | ≥ 3.7.0 ≤ 3.7.15 ≥ 3.8.0 ≤ 3.8.15 ≥ 3.9.0 ≤ 3.9.15 | 7.8 | — | 2022-04-13 | |
| CVE-2018-25032 | zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many dist... | ≥ 3.7.0 < 3.7.14 ≥ 3.8.0 < 3.8.14 ≥ 3.9.0 < 3.9.13 | 7.5 | — | 2022-03-25 | |
| CVE-2022-26488 | In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately se... | ≤ 3.7.12 ≥ 3.8.0 ≤ 3.8.12 ≥ 3.9.0 ≤ 3.9.10 | 7.0 | — | 2022-03-08 | |
| CVE-2021-3733 | There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server th... | < 3.6.14 ≥ 3.7.0 < 3.7.11 ≥ 3.8.0 < 3.8.10 | 6.5 | — | 2022-03-07 | |
| CVE-2021-3737 | A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a... | ≥ 3.6.0 < 3.6.14 ≥ 3.7.0 < 3.7.11 ≥ 3.8.0 < 3.8.11 | 7.5 | — | 2022-03-04 | |
| CVE-2022-0391 | A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resou... | < 3.6.14 ≥ 3.7.0 < 3.7.11 ≥ 3.8.0 < 3.8.11 | 7.5 | — | 2022-02-09 | |
| CVE-2021-3426 | There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another... | < 2.7.18 ≥ 3.6.0 < 3.6.13 ≥ 3.7.0 < 3.7.10 | 5.7 | — | 2021-05-20 | |
| CVE-2021-29921 | In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP addres... | ≥ 3.8.0 < 3.8.12 ≥ 3.9.0 < 3.9.5 | 9.8 | — | 2021-05-06 | |
| CVE-2021-23336 | Web Cache Poisoning | < 3.6.13 ≥ 3.7.0 < 3.7.10 ≥ 3.8.0 < 3.8.8 | 5.9 | — | 2021-02-15 | |
| CVE-2021-3177 | Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote... | ≥ 3.6.0 ≤ 3.6.12 ≥ 3.7.0 ≤ 3.7.9 ≥ 3.8.0 ≤ 3.8.7 | 9.8 | — | 2021-01-19 | |
| CVE-2020-27619 | In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retri... | ≥ 3.0.0 < 3.6.13 ≥ 3.7.0 < 3.7.10 ≥ 3.8.0 < 3.8.7 | 9.8 | — | 2020-10-22 | |
| CVE-2020-26116 | http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allow... | ≥ 3.0.0 < 3.5.10 ≥ 3.6.0 < 3.6.12 ≥ 3.7.0 < 3.7.9 | 7.2 | — | 2020-09-27 | |
| CVE-2020-15801 | In Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be load... | ≥ 3.7.0 < 3.7.9 ≥ 3.8.0 < 3.8.5 | 9.8 | — | 2020-07-17 | |
| CVE-2019-20907 | In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite l... | ≥ 3.5.0 < 3.5.10 ≥ 3.6.0 < 3.6.12 ≥ 3.7.0 < 3.7.9 | 5.5 | — | 2020-07-13 | |
| CVE-2020-15523 | In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a T... | ≥ 3.5.0 < 3.5.10 ≥ 3.6.0 < 3.6.12 ≥ 3.7.0 < 3.7.9 | 7.8 | — | 2020-07-05 | |
| CVE-2020-14422 | Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interfac... | ≥ 3.0.0 < 3.5.10 ≥ 3.6.0 < 3.6.12 ≥ 3.7.0 < 3.7.9 | 5.9 | — | 2020-06-18 | |
| CVE-2013-1753 | The gzip_decode function in the xmlrpc client library in Python 3.4 and earlier allows remote attackers to cau... | ≥ 2.7.0 < 2.7.9 ≥ 3.2.0 < 3.2.6 ≥ 3.3.0 < 3.3.6 | 7.5 | — | 2020-03-12 | |
| CVE-2014-4650 | The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used... | ≥ 2.7.0 < 2.7.8 ≥ 3.2.0 < 3.2.6 ≥ 3.3.0 < 3.3.6 | 9.8 | — | 2020-02-21 | |
| CVE-2019-9674 | Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumpt... | ≥ 3.2 ≤ 3.8 | 7.5 | — | 2020-02-04 | |
| CVE-2020-8492 | Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 all... | ≥ 2.7.0 ≤ 2.7.17 ≥ 3.5.0 ≤ 3.5.9 ≥ 3.6.0 ≤ 3.6.10 | 6.5 | — | 2020-01-30 | |
| CVE-2020-8315 | In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load... | ≥ 3.6.0 ≤ 3.6.10 ≥ 3.7.0 ≤ 3.7.6 ≥ 3.8.0 ≤ 3.8.1 | 5.5 | — | 2020-01-29 | |
| CVE-2016-1000110 | The CGIHandler class in Python before 2.7.12 does not protect against the HTTP_PROXY variable name clash in a... | ≥ 2.7.0 < 2.7.13 ≥ 3.3.0 < 3.3.7 ≥ 3.4.0 < 3.4.6 | 6.1 | — | 2019-11-28 | |
| CVE-2019-5010 | An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.... | ≥ 2.7.0 < 2.7.16 ≥ 3.4.0 < 3.4.10 ≥ 3.5.0 < 3.5.7 | 5.9 | — | 2019-11-01 |
Controla estas versiones en tus propios servidores
InfraGuard recopila las versiones de software instaladas en cada servidor y señala las que tienen vulnerabilidades conocidas. Autoalojado: nada sale de tu red.
Datos: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (consulta EPSS en https://www.first.org/epss), endoflife.date. Lista de software: awesome-selfhosted (CC BY-SA 3.0).