수정 버전
설치된 버전 확인
python3 -V2.7 에 영향을 주는 CVE
| CVE | 제목 | CVSS | 악용 | EPSS | 공개일 |
|---|---|---|---|---|---|
| CVE-2016-0718 | Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary co... | 9.8 | — | 2016-05-27 | |
| CVE-2016-5636 | Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4... | 9.8 | — | 2016-09-02 | |
| CVE-2017-1000158 | CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function i... | 9.8 | — | 2017-11-17 | |
| CVE-2016-9063 | An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50... | 9.8 | — | 2018-06-12 | |
| CVE-2018-1000802 | Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special... | 9.8 | — | 2018-09-18 | |
| CVE-2019-10160 | A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f01... | 9.8 | — | 2019-06-08 | |
| CVE-2014-4650 | The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used... | 9.8 | — | 2020-02-21 | |
| CVE-2022-48565 | An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accep... | 9.8 | — | 2023-08-22 | |
| CVE-2007-4559 | Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Pyt... | 9.8 | — | 2007-08-28 | |
| CVE-2019-9948 | urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attacker... | 9.1 | — | 2019-03-24 | |
| CVE-2017-17522 | Lib/webbrowser.py in Python through 3.6.3 does not validate strings before launching the program specified by... | 8.8 | — | 2017-12-15 | |
| CVE-2026-15308 | Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations | 8.7 | — | 2026-07-10 | |
| CVE-2016-4472 | The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remo... | 8.1 | — | 2016-07-01 | |
| CVE-2019-13404 | The MSI installer for Python through 2.7.16 on Windows defaults to the C:\Python27 directory, which makes it e... | 7.8 | — | 2019-07-08 | |
| CVE-2014-1912 | Buffer overflow in the socket.recvfrom_into function in Modules/socketmodule.c in Python 2.5 before 2.7.7, 3.x... | 7.5 | — | 2014-03-01 | |
| CVE-2016-2183 | The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products,... | 7.5 | — | 2016-09-01 | |
| CVE-2017-9233 | XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to... | 7.5 | — | 2017-07-26 | |
| CVE-2013-1753 | The gzip_decode function in the xmlrpc client library in Python 3.4 and earlier allows remote attackers to cau... | 7.5 | — | 2020-03-12 | |
| CVE-2022-0391 | A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resou... | 7.5 | — | 2022-02-09 | |
| CVE-2022-45061 | An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when pr... | 7.5 | — | 2022-11-09 | |
| CVE-2023-24329 | An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods... | 7.5 | — | 2023-02-17 | |
| CVE-2023-36632 | The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError... | 7.5 | — | 2023-06-25 | |
| CVE-2022-48560 | A use-after-free exists in Python through 3.9 via heappushpop in heapq. | 7.5 | — | 2023-08-22 | |
| CVE-2024-7592 | Quadratic complexity parsing cookies with backslashes | 7.5 | — | 2024-08-20 | |
| CVE-2024-6232 | Regular-expression DoS when parsing TarFile headers | 7.5 | — | 2024-09-03 | |
| CVE-2014-0224 | OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of... | 7.4 | — | 2014-06-05 | |
| CVE-2015-5652 | Untrusted search path vulnerability in python.exe in Python through 3.5.0 on Windows allows local users to gai... | 7.2 | — | 2015-10-05 | |
| CVE-2022-26488 | In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately se... | 7.0 | — | 2022-03-08 | |
| CVE-2026-4519 | webbrowser.open() allows leading dashes in URLs | 7.0 | — | 2026-03-21 | |
| CVE-2015-1283 | Multiple integer overflows in the XML_GetBuffer function in Expat through 2.1.0, as used in Google Chrome befo... | 6.8 | — | 2015-07-23 | |
| CVE-2016-0772 | The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not r... | 6.5 | — | 2016-09-02 | |
| CVE-2017-18207 | The Wave_read._read_fmt_chunk function in Lib/wave.py in Python through 3.6.4 does not ensure a nonzero channe... | 6.5 | — | 2018-03-01 | |
| CVE-2018-1061 | python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking... | 6.5 | — | 2018-06-19 | |
| CVE-2019-9740 | An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF i... | 6.5 | — | 2019-03-13 | |
| CVE-2019-15903 | In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document p... | 6.5 | — | 2019-09-04 | |
| CVE-2020-8492 | Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 all... | 6.5 | — | 2020-01-30 | |
| CVE-2021-3733 | There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server th... | 6.5 | — | 2022-03-07 | |
| CVE-2022-48564 | read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhau... | 6.5 | — | 2023-08-22 | |
| CVE-2011-1521 | The urllib and urllib2 modules in Python 2.x before 2.7.2 and 3.x before 3.2.1 process Location headers that s... | 6.4 | — | 2011-05-25 | |
| CVE-2012-2135 | The utf-16 decoder in Python 3.1 through 3.3 does not update the aligned_end variable after calling the unicod... | 6.4 | — | 2012-08-15 | |
| CVE-2014-7185 | Integer overflow in bufferobject.c in Python before 2.7.8 allows context-dependent attackers to obtain sensiti... | 6.4 | — | 2014-10-09 | |
| CVE-2025-13836 | Excessive read buffering DoS in http.client | 6.3 | — | 2025-12-02 | |
| CVE-2025-12084 | Quadratic complexity in node ID cache clearing | 6.3 | — | 2025-12-04 | |
| CVE-2025-12781 | base64.b64decode() always accepts "+/" characters, despite setting altchars | 6.3 | — | 2026-01-22 | |
| CVE-2026-7210 | The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection | 6.3 | — | 2026-05-12 | |
| CVE-2016-5699 | CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Py... | 6.1 | — | 2016-09-02 | |
| CVE-2019-16935 | The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS... | 6.1 | — | 2019-09-28 | |
| CVE-2016-1000110 | The CGIHandler class in Python before 2.7.12 does not protect against the HTTP_PROXY variable name clash in a... | 6.1 | — | 2019-11-28 | |
| CVE-2026-3644 | Incomplete control character validation in http.cookies | 6.0 | — | 2026-03-17 | |
| CVE-2026-4224 | Stack overflow parsing XML with deeply nested DTD content models | 6.0 | — | 2026-03-17 | |
| CVE-2026-3087 | shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs | 6.0 | — | 2026-04-28 | |
| CVE-2013-7440 | The ssl.match_hostname function in CPython (aka Python) before 2.7.9 and 3.x before 3.3.3 does not properly ha... | 5.9 | — | 2016-06-08 | |
| CVE-2014-4616 | Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson befo... | 5.9 | — | 2017-08-25 | |
| CVE-2019-5010 | An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.... | 5.9 | — | 2019-11-01 | |
| CVE-2021-23336 | Web Cache Poisoning | 5.9 | — | 2021-02-15 | |
| CVE-2022-48566 | An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating opti... | 5.9 | — | 2023-08-22 | |
| CVE-2014-9365 | The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Pyth... | 5.8 | — | 2014-12-12 | |
| CVE-2021-3426 | There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another... | 5.7 | — | 2021-05-20 | |
| CVE-2019-9947 | An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF i... | 5.4 | — | 2019-03-24 | |
| CVE-2019-18348 | An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF i... | 5.4 | — | 2019-10-24 | |
| CVE-2018-14647 | Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could ma... | 5.3 | — | 2018-09-25 | |
| CVE-2019-9636 | Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with... | 5.3 | — | 2019-03-09 | |
| CVE-2019-16056 | An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.... | 5.3 | — | 2019-09-07 | |
| CVE-2023-27043 | The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character... | 5.3 | — | 2023-04-18 | |
| CVE-2023-40217 | An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before... | 5.3 | — | 2023-08-25 | |
| CVE-2024-9287 | Virtual environment (venv) activation scripts don't quote paths | 5.3 | — | 2024-10-23 | |
| CVE-2012-0845 | SimpleXMLRPCServer.py in SimpleXMLRPCServer in Python before 2.6.8, 2.7.x before 2.7.3, 3.x before 3.1.5, and... | 5.0 | — | 2012-10-06 | |
| CVE-2012-1150 | Python before 2.6.8, 2.7.x before 2.7.3, 3.x before 3.1.5, and 3.2.x before 3.2.3 computes hash values without... | 5.0 | — | 2012-10-06 | |
| CVE-2017-20052 | Python pgAdmin4 uncontrolled search path | 5.0 | — | 2022-06-16 | |
| CVE-2012-0876 | The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trig... | 4.3 | — | 2012-07-04 | |
| CVE-2013-4238 | The ssl.match_hostname function in the SSL module in Python 2.6 through 3.4 does not properly handle a '\0' ch... | 4.3 | — | 2013-08-18 | |
| CVE-2013-7040 | Python 2.7 before 3.4 only uses the last eight bits of the prefix to randomize hash values, which causes it to... | 4.3 | — | 2014-05-19 | |
| CVE-2018-1060 | python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking... | 4.3 | — | 2018-06-18 | |
| CVE-2018-20852 | http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correct... | 4.3 | — | 2019-07-14 | |
| CVE-2026-0864 | Configuration Injection via Carriage Return (\r) in write() method | 4.1 | — | 2026-06-24 | |
| CVE-2018-1000030 | Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions prior... | 3.6 | — | 2018-02-09 | |
| CVE-2011-4940 | The list_directory function in Lib/SimpleHTTPServer.py in SimpleHTTPServer in Python before 2.5.6c1, 2.6.x bef... | 2.6 | — | 2012-06-27 | |
| CVE-2025-13837 | Out-of-memory when loading Plist | 2.1 | — | 2025-12-02 | |
| CVE-2026-6019 | BaseCookie.js_output() does not neutralize embedded characters | 2.1 | — | 2026-04-23 | |
| CVE-2025-13462 | tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling | 2.0 | — | 2026-03-13 | |
| CVE-2026-4360 | Tarfile.extract() doesn't fully respect filter parameter | 2.0 | — | 2026-06-30 | |
| CVE-2011-4944 | Python 2.6 through 3.2 creates ~/.pypirc with world-readable permissions before changing them after data has b... | 1.9 | — | 2012-08-28 | |
| CVE-2025-6075 | Quadratic complexity in os.path.expandvars() with user-controlled template | 1.8 | — | 2025-11-01 |
내 서버의 버전을 직접 추적하세요
InfraGuard 는 모든 서버에 설치된 소프트웨어 버전을 수집하고, 알려진 취약점이 있는 버전을 알려 줍니다. 자체 호스팅이라 데이터가 내 네트워크를 벗어나지 않습니다.
데이터: CVE List(CVE® Program), NVD, CISA KEV, FIRST EPSS(EPSS 는 https://www.first.org/epss 참고), endoflife.date. 소프트웨어 목록: awesome-selfhosted(CC BY-SA 3.0).