CPython
- Software type
- Software runtime
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 10/23/2026, CPython recorded 12 security vulnerabilities in the last 90 days, of which 3 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of CPython and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-114583tar filter allows writing outside destination via empty-named symlinkCVE-2026-19553SSLContext.wrap_bio() missing validation of server_hostname parameterCVE-2026-19445Use-after-free of a server-side SSLContext when sni_callback switches contextsCVE-2026-12345Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directoryCVE-2026-82049tarfile extraction filters allow file modification and content disclosure via hard link to symlink| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-114583tar filter allows writing outside destination via empty-named symlink | Exploitation statusNot confirmed | FixYes |
| SeverityMedium |
CVE-2026-19553SSLContext.wrap_bio() missing validation of server_hostname parameter | Exploitation statusNot exploited | FixYes | Published09/30/2026 | SeverityHigh |
|---|
CVE-2026-19445Use-after-free of a server-side SSLContext when sni_callback switches contexts | Exploitation statusNot confirmed | FixYes | Published09/30/2026 | SeverityCritical |
|---|
CVE-2026-12345Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory | Exploitation statusNot exploited | FixYes | Published09/29/2026 | SeverityMedium |
|---|
CVE-2026-82049tarfile extraction filters allow file modification and content disclosure via hard link to symlink | Exploitation statusNot exploited | FixYes | Published09/14/2026 | SeverityHigh |
|---|
CVE-2026-87910tarfile hardlink fallback ignores custom extraction filter rejection via None | Exploitation statusNot exploited | FixYes | Published09/11/2026 | SeverityMedium |
|---|
CVE-2026-15310zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits | Exploitation statusNot exploited | FixYes | Published08/25/2026 | SeverityLow |
|---|
CVE-2026-19672tarfile extraction filter bypass allows creation of directories outside the destination | Exploitation statusNot exploited | FixYes | Published08/19/2026 | SeverityMedium |
|---|
CVE-2026-15806`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching | Exploitation statusActively exploited | FixYes | Published08/18/2026 | SeverityMedium |
|---|
CVE-2026-17084stringprep.map_table_b2() deviates from RFC 3454 Table B.2 | Exploitation statusNot exploited | FixYes | Published08/18/2026 | SeverityMedium |
|---|
76 Results | Page 1 of 8