Исправлено в
Проверьте свою версию
python3 -VCVE, затрагивающие 3.13
| CVE | Название | CVSS | Эксплуатируется | EPSS | Опубликовано |
|---|---|---|---|---|---|
| CVE-2026-15308 | Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations | 8.7 | — | 2026-07-10 | |
| CVE-2024-7592 | Quadratic complexity parsing cookies with backslashes | 7.5 | — | 2024-08-20 | |
| CVE-2024-6232 | Regular-expression DoS when parsing TarFile headers | 7.5 | — | 2024-09-03 | |
| CVE-2026-4519 | webbrowser.open() allows leading dashes in URLs | 7.0 | — | 2026-03-21 | |
| CVE-2025-13836 | Excessive read buffering DoS in http.client | 6.3 | — | 2025-12-02 | |
| CVE-2025-12084 | Quadratic complexity in node ID cache clearing | 6.3 | — | 2025-12-04 | |
| CVE-2025-12781 | base64.b64decode() always accepts "+/" characters, despite setting altchars | 6.3 | — | 2026-01-22 | |
| CVE-2026-7210 | The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection | 6.3 | — | 2026-05-12 | |
| CVE-2023-6507 | Groups not dropped before running subprocess when using empty 'extra_groups' parameter | 6.1 | — | 2023-12-09 | |
| CVE-2026-3644 | Incomplete control character validation in http.cookies | 6.0 | — | 2026-03-17 | |
| CVE-2026-4224 | Stack overflow parsing XML with deeply nested DTD content models | 6.0 | — | 2026-03-17 | |
| CVE-2026-3087 | shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs | 6.0 | — | 2026-04-28 | |
| CVE-2023-38898 | An issue in Python cpython v.3.7 allows an attacker to obtain sensitive information via the _asyncio._swap_cur... | 5.3 | — | 2023-08-15 | |
| CVE-2024-9287 | Virtual environment (venv) activation scripts don't quote paths | 5.3 | — | 2024-10-23 | |
| CVE-2026-0864 | Configuration Injection via Carriage Return (\r) in write() method | 4.1 | — | 2026-06-24 | |
| CVE-2025-13837 | Out-of-memory when loading Plist | 2.1 | — | 2025-12-02 | |
| CVE-2026-6019 | BaseCookie.js_output() does not neutralize embedded characters | 2.1 | — | 2026-04-23 | |
| CVE-2025-13462 | tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling | 2.0 | — | 2026-03-13 | |
| CVE-2025-6075 | Quadratic complexity in os.path.expandvars() with user-controlled template | 1.8 | — | 2025-11-01 |
Отслеживайте эти версии на своих серверах
InfraGuard собирает версии установленного ПО со всех серверов и отмечает версии с известными уязвимостями. Self-hosted — данные не покидают вашу сеть.
Данные: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (об EPSS см. https://www.first.org/epss), endoflife.date. Список ПО: awesome-selfhosted (CC BY-SA 3.0).