Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

VulnScan

Python Security Vulnerabilities | CyStack CVE Database

CVE	Exploitation status	Fix	Affected product	Published	Severity
`CVE-2026-54058`Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)	Exploitation statusPublic exploit	FixYes	Affected productPillow	Published07/14/2026	SeverityHigh
`CVE-2026-59197`Pillow: Heap out-of-bounds write in Pillow `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`	Exploitation statusPublic exploit	FixYes	Affected productPillow	Published07/14/2026	SeverityHigh
`CVE-2026-59200`Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()	Exploitation statusPublic exploit	FixYes	Affected productPillow	Published07/14/2026	SeverityHigh
`CVE-2026-59198`Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images	Exploitation statusPublic exploit	FixYes	Affected productPillow	Published07/14/2026	SeverityMedium
`CVE-2026-59205`Pillow: Controlled heap out-of-bounds write in `ImageCmsTransform.apply()` via output mode mismatch	Exploitation statusPublic exploit	FixYes	Affected productPillow	Published07/14/2026	SeverityHigh
`CVE-2026-59203`Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service	Exploitation statusPublic exploit	FixYes	Affected productPillow	Published07/14/2026	SeverityMedium
`CVE-2026-59199`Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow	Exploitation statusPublic exploit	FixYes	Affected productPillow	Published07/14/2026	SeverityHigh
`CVE-2026-59204`Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service	Exploitation statusPublic exploit	FixYes	Affected productPillow	Published07/14/2026	SeverityHigh
`CVE-2026-15308`Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations	Exploitation statusNot known exploited	FixYes	Affected productCPython	Published07/09/2026	SeverityHigh
`CVE-2026-59890`setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+	Exploitation statusPublic exploit	FixYes	Affected productsetuptools	Published07/08/2026	SeverityMedium
`CVE-2026-55379`Pillow BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading	Exploitation statusPublic exploit	FixYes	Affected productPillow	Published07/06/2026	SeverityHigh
`CVE-2026-55380`Pillow GdImageFile decompression bomb protection bypass	Exploitation statusPublic exploit	FixYes	Affected productPillow	Published07/06/2026	SeverityHigh
`CVE-2026-54060`Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`	Exploitation statusPublic exploit	FixYes	Affected productPillow	Published07/06/2026	SeverityHigh
`CVE-2026-54059`Pillow: PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading	Exploitation statusPublic exploit	FixYes	Affected productPillow	Published07/06/2026	SeverityHigh
`CVE-2026-55798`Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path	Exploitation statusPublic exploit	FixYes	Affected productPillow	Published07/06/2026	SeverityMedium
`CVE-2026-4360`Tarfile.extract() doesn't fully respect filter parameter	Exploitation statusNot known exploited	FixYes	Affected productCPython	Published06/30/2026	SeverityLow
`CVE-2026-0864`Configuration Injection via Carriage Return (\r) in write() method	Exploitation statusNot known exploited	FixYes	Affected productCPython	Published06/23/2026	SeverityMedium
`CVE-2026-44431`urllib3: Sensitive headers forwarded across origins in proxied low-level redirects	Exploitation statusNot known exploited	FixYes	Affected producturllib3	Published05/13/2026	SeverityHigh
`CVE-2026-44432`urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API	Exploitation statusNot known exploited	FixYes	Affected producturllib3	Published05/13/2026	SeverityHigh
`CVE-2026-7210`The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection	Exploitation statusNot known exploited	FixYes	Affected productCPython	Published05/11/2026	SeverityMedium
`CVE-2026-42311`Pillow: OOB Write with Invalid PSD Tile Extents (Integer Overflow)	Exploitation statusNot known exploited	FixYes	Affected productPillow	Published05/09/2026	SeverityHigh
`CVE-2026-42310`Pillow: PDF Parsing Trailer Infinite Loop (DoS)	Exploitation statusNot known exploited	FixYes	Affected productPillow	Published05/09/2026	SeverityMedium
`CVE-2026-42308`Pillow: Integer overflow when processing fonts	Exploitation statusNot known exploited	FixYes	Affected productPillow	Published05/09/2026	SeverityMedium
`CVE-2026-42309`Pillow: Heap buffer overflow with nested list coordinates	Exploitation statusNot known exploited	FixYes	Affected productPillow	Published05/09/2026	SeverityMedium
`CVE-2026-3087`shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs	Exploitation statusNot known exploited	FixYes	Affected productCPython	Published04/27/2026	SeverityMedium
`CVE-2026-6019`BaseCookie.js_output() does not neutralize embedded characters	Exploitation statusNot known exploited	FixYes	Affected productCPython	Published04/22/2026	SeverityLow
`CVE-2026-40192`Pillow is vulnerable to a FITS GZIP decompression bomb	Exploitation statusNot known exploited	FixNot confirmed	Affected productPillow	Published04/15/2026	SeverityHigh
`CVE-2026-5271`Possible to hijack modules in current working directory	Exploitation statusPublic exploit	FixYes	Affected productpymanager	Published04/01/2026	SeverityMedium
`CVE-2026-25645`Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function	Exploitation statusNot known exploited	FixNot confirmed	Affected productrequests	Published03/25/2026	SeverityMedium
`CVE-2026-4519`webbrowser.open() allows leading dashes in URLs	Exploitation statusNot known exploited	FixYes	Affected productCPython	Published03/20/2026	SeverityHigh
`CVE-2026-4224`Stack overflow parsing XML with deeply nested DTD content models	Exploitation statusNot known exploited	FixYes	Affected productCPython	Published03/16/2026	SeverityMedium
`CVE-2026-3644`Incomplete control character validation in http.cookies	Exploitation statusNot known exploited	FixYes	Affected productCPython	Published03/16/2026	SeverityMedium
`CVE-2026-32274`Black: Arbitrary file writes from unsanitized user input in cache file name	Exploitation statusNot known exploited	FixYes	Affected productblack	Published03/12/2026	SeverityHigh
`CVE-2025-13462`tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling	Exploitation statusNot known exploited	FixYes	Affected productCPython	Published03/12/2026	SeverityLow
`CVE-2026-31900`Black's vulnerable version parsing leads to RCE in GitHub Action	Exploitation statusNot known exploited	FixNot confirmed	Affected productblack	Published03/11/2026	SeverityHigh
`CVE-2026-25990`Pillow has an out-of-bounds write when loading PSD images	Exploitation statusNot known exploited	FixYes	Affected productPillow	Published02/11/2026	SeverityHigh
`CVE-2026-0994`Denial of Service in Python Protobuf	Exploitation statusNot known exploited	FixNot confirmed	Affected productProtobuf	Published01/23/2026	SeverityHigh
`CVE-2025-12781`base64.b64decode() always accepts "+/" characters, despite setting altchars	Exploitation statusNot known exploited	FixYes	Affected productCPython	Published01/21/2026	SeverityMedium
`CVE-2026-21441`urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)	Exploitation statusNot known exploited	FixNot confirmed	Affected producturllib3	Published01/07/2026	SeverityHigh
`CVE-2025-66471`urllib3 Streaming API improperly handles highly compressed data	Exploitation statusNot known exploited	FixNot confirmed	Affected producturllib3	Published12/05/2025	SeverityHigh
`CVE-2025-66418`urllib3 allows an unbounded number of links in the decompression chain	Exploitation statusNot known exploited	FixYes	Affected producturllib3	Published12/05/2025	SeverityHigh
`CVE-2025-12084`Quadratic complexity in node ID cache clearing	Exploitation statusNot known exploited	FixYes	Affected productCPython	Published12/03/2025	SeverityMedium
`CVE-2025-13837`Out-of-memory when loading Plist	Exploitation statusNot known exploited	FixYes	Affected productCPython	Published12/01/2025	SeverityLow
`CVE-2025-13836`Excessive read buffering DoS in http.client	Exploitation statusNot known exploited	FixYes	Affected productCPython	Published12/01/2025	SeverityMedium
`CVE-2025-6075`Quadratic complexity in os.path.expandvars() with user-controlled template	Exploitation statusNot known exploited	FixYes	Affected productCPython	Published10/31/2025	SeverityLow
`CVE-2025-48379`Pillow Vulnerable to Write Buffer Overflow on BCn encoding	Exploitation statusNot known exploited	FixYes	Affected productPillow	Published07/01/2025	SeverityHigh
`CVE-2025-50182`urllib3 does not control redirects in browsers and Node.js	Exploitation statusNot known exploited	FixYes	Affected producturllib3	Published06/19/2025	SeverityMedium
`CVE-2025-50181`urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation	Exploitation statusNot known exploited	FixYes	Affected producturllib3	Published06/19/2025	SeverityMedium
`CVE-2025-47273`setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write	Exploitation statusPublic exploit	FixNot confirmed	Affected productsetuptools	Published05/17/2025	SeverityHigh
`CVE-2024-9287`Virtual environment (venv) activation scripts don't quote paths	Exploitation statusNot known exploited	FixYes	Affected productCPython	Published10/22/2024	SeverityMedium
`CVE-2024-6232`Regular-expression DoS when parsing TarFile headers	Exploitation statusNot known exploited	FixYes	Affected productCPython	Published09/03/2024	SeverityHigh
`CVE-2024-7592`Quadratic complexity parsing cookies with backslashes	Exploitation statusPublic exploit	FixYes	Affected productCPython	Published08/19/2024	SeverityHigh
`CVE-2024-37891`Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3	Exploitation statusNot known exploited	FixNot confirmed	Affected producturllib3	Published06/17/2024	SeverityMedium
`CVE-2024-28219`CVE-2024-28219	Exploitation statusNot known exploited	FixNot confirmed	Affected productNot confirmed	Published04/03/2024	SeverityMedium
`CVE-2023-50447`CVE-2023-50447	Exploitation statusNot known exploited	FixNot confirmed	Affected productNot confirmed	Published01/19/2024	SeverityHigh
`CVE-2023-6507`Groups not dropped before running subprocess when using empty 'extra_groups' parameter	Exploitation statusNot known exploited	FixYes	Affected productCPython	Published12/08/2023	SeverityMedium
`CVE-2023-44271`CVE-2023-44271	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published11/03/2023	SeverityUnknown
`CVE-2023-45803`Request body not stripped after redirect in urllib3	Exploitation statusNot known exploited	FixNot confirmed	Affected producturllib3	Published10/17/2023	SeverityMedium
`CVE-2018-25091`CVE-2018-25091	Exploitation statusNot known exploited	FixNot confirmed	Affected productNot confirmed	Published10/15/2023	SeverityUnknown
`CVE-2023-43804``Cookie` HTTP header isn't stripped on cross-origin redirects	Exploitation statusNot confirmed	FixYes	Affected producturllib3	Published10/04/2023	SeverityMedium
`CVE-2023-40217`CVE-2023-40217	Exploitation statusNot known exploited	FixNot confirmed	Affected productNot confirmed	Published08/25/2023	SeverityUnknown
`CVE-2023-41105`CVE-2023-41105	Exploitation statusNot known exploited	FixNot confirmed	Affected productNot confirmed	Published08/23/2023	SeverityUnknown
`CVE-2022-48560`CVE-2022-48560	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published08/22/2023	SeverityUnknown
`CVE-2022-48564`CVE-2022-48564	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published08/22/2023	SeverityUnknown
`CVE-2022-48566`CVE-2022-48566	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published08/22/2023	SeverityUnknown
`CVE-2022-48565`CVE-2022-48565	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published08/22/2023	SeverityUnknown
`CVE-2023-38898`CVE-2023-38898	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published08/15/2023	SeverityUnknown
`CVE-2023-36632`CVE-2023-36632	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published06/25/2023	SeverityUnknown
`CVE-2023-33595`CVE-2023-33595	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published06/07/2023	SeverityUnknown
`CVE-2023-32681`Unintended leak of Proxy-Authorization header in requests	Exploitation statusNot known exploited	FixYes	Affected productrequests	Published05/26/2023	SeverityMedium
`CVE-2023-27043`CVE-2023-27043	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published04/18/2023	SeverityMedium
`CVE-2023-24329`CVE-2023-24329	Exploitation statusNot known exploited	FixNot confirmed	Affected productNot confirmed	Published02/17/2023	SeverityHigh
`CVE-2022-40897`CVE-2022-40897	Exploitation statusNot known exploited	FixNot confirmed	Affected productNot confirmed	Published12/22/2022	SeverityMedium
`CVE-2022-45199`CVE-2022-45199	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published11/14/2022	SeverityUnknown
`CVE-2022-45198`CVE-2022-45198	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published11/14/2022	SeverityUnknown
`CVE-2022-45061`CVE-2022-45061	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published11/09/2022	SeverityHigh
`CVE-2022-42919`CVE-2022-42919	Exploitation statusNot known exploited	FixNot confirmed	Affected productNot confirmed	Published11/06/2022	SeverityHigh
`CVE-2022-37454`CVE-2022-37454	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published10/21/2022	SeverityCritical
`CVE-2020-10735`CVE-2020-10735	Exploitation statusNot confirmed	FixNot confirmed	Affected productPython	Published09/09/2022	SeverityUnknown
`CVE-2021-4189`CVE-2021-4189	Exploitation statusNot known exploited	FixNot confirmed	Affected productPython	Published08/24/2022	SeverityMedium
`CVE-2021-28861`CVE-2021-28861	Exploitation statusNot known exploited	FixNot confirmed	Affected productNot confirmed	Published08/23/2022	SeverityMedium
`CVE-2017-20052`Python pgAdmin4 uncontrolled search path	Exploitation statusPublic exploit	FixNot confirmed	Affected productPython	Published06/16/2022	SeverityMedium
`CVE-2022-30595`CVE-2022-30595	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published05/25/2022	SeverityUnknown
`CVE-2022-28470`CVE-2022-28470	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published05/08/2022	SeverityUnknown
`CVE-2022-24902`Memory issue in playing videos	Exploitation statusNot known exploited	FixNot confirmed	Affected producttkVideoPlayer	Published05/05/2022	SeverityLow
`CVE-2015-20107`CVE-2015-20107	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published04/13/2022	SeverityUnknown
`CVE-2022-24303`CVE-2022-24303	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published03/28/2022	SeverityUnknown
`CVE-2018-25032`CVE-2018-25032	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published03/25/2022	SeverityHigh
`CVE-2022-26488`CVE-2022-26488	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published03/07/2022	SeverityUnknown
`CVE-2021-3733`CVE-2021-3733	Exploitation statusNot confirmed	FixNot confirmed	Affected productPython	Published03/07/2022	SeverityUnknown
`CVE-2021-3737`CVE-2021-3737	Exploitation statusNot known exploited	FixNot confirmed	Affected productPython	Published03/04/2022	SeverityHigh
`CVE-2022-0391`CVE-2022-0391	Exploitation statusNot known exploited	FixNot confirmed	Affected productPython	Published02/09/2022	SeverityHigh
`CVE-2022-22815`CVE-2022-22815	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published01/07/2022	SeverityUnknown
`CVE-2022-22817`CVE-2022-22817	Exploitation statusNot known exploited	FixNot confirmed	Affected productNot confirmed	Published01/07/2022	SeverityCritical
`CVE-2022-22816`CVE-2022-22816	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published01/07/2022	SeverityUnknown
`CVE-2021-42576`CVE-2021-42576	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published10/18/2021	SeverityUnknown
`CVE-2021-23437`Regular Expression Denial of Service (ReDoS)	Exploitation statusNot confirmed	FixYes	Affected productPillow	Published09/03/2021	SeverityHigh
`CVE-2021-34552`CVE-2021-34552	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published07/13/2021	SeverityUnknown
`CVE-2021-33503`CVE-2021-33503	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published06/29/2021	SeverityUnknown
`CVE-2021-28677`CVE-2021-28677	Exploitation statusNot confirmed	FixNot confirmed	Affected productNot confirmed	Published06/02/2021	SeverityUnknown

100 / 272 Results

Security vulnerabilities from Python

Python

Verify to analyze this security profile

Run an in-depth assessment with complete web risk management

Popular Python products

Protobuf

python