Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

VulnScan

CPython Security Vulnerabilities | CyStack CVE Database

CVE	Exploitation status	Fix	Published	Severity
`CVE-2026-15310`zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits	Exploitation statusNot known exploited	FixYes	Published08/25/2026	SeverityLow
`CVE-2026-19672`tarfile extraction filter bypass allows creation of directories outside the destination	Exploitation statusNot known exploited	FixYes	Published08/19/2026	SeverityMedium
`CVE-2026-15806``HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching	Exploitation statusPublic exploit	FixYes	Published08/18/2026	SeverityMedium
`CVE-2026-17084`stringprep.map_table_b2() deviates from RFC 3454 Table B.2	Exploitation statusNot known exploited	FixYes	Published08/18/2026	SeverityMedium
`CVE-2026-18503`Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()	Exploitation statusNot known exploited	FixYes	Published08/10/2026	SeverityLow
`CVE-2026-6879`Quadratic Behavior in xml.etree.ElementPath Index Predicates	Exploitation statusNot known exploited	FixYes	Published07/28/2026	SeverityLow
`CVE-2026-15308`Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations	Exploitation statusNot known exploited	FixYes	Published07/09/2026	SeverityHigh
`CVE-2026-4360`Tarfile.extract() doesn't fully respect filter parameter	Exploitation statusNot known exploited	FixYes	Published06/30/2026	SeverityLow
`CVE-2026-11972`tarfile opened in streaming mode mishandles EOF	Exploitation statusNot known exploited	FixYes	Published06/23/2026	SeverityHigh
`CVE-2026-0864`Configuration Injection via Carriage Return (\r) in write() method	Exploitation statusNot known exploited	FixYes	Published06/23/2026	SeverityMedium
`CVE-2026-11940`tarfile extraction filter bypass allows escaping the destination directory	Exploitation statusNot known exploited	FixYes	Published06/23/2026	SeverityHigh
`CVE-2026-12003`CPython >3.11 Insecure Input Validation resulting in privilege escalation	Exploitation statusNot known exploited	FixYes	Published06/16/2026	SeverityMedium
`CVE-2026-9669`bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow	Exploitation statusNot known exploited	FixYes	Published06/08/2026	SeverityHigh
`CVE-2026-7774`tarfile.data_filter path traversal bypass allows writing outside the extraction directory	Exploitation statusNot known exploited	FixYes	Published06/04/2026	SeverityMedium
`CVE-2026-3276`Potential DoS via quadratic complexity in unicodedata.normalize()	Exploitation statusNot known exploited	FixYes	Published06/03/2026	SeverityMedium
`CVE-2026-8328`FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address	Exploitation statusNot known exploited	FixYes	Published05/13/2026	SeverityMedium
`CVE-2026-7210`The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection	Exploitation statusNot known exploited	FixYes	Published05/11/2026	SeverityMedium
`CVE-2026-3087`shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs	Exploitation statusNot known exploited	FixYes	Published04/27/2026	SeverityMedium
`CVE-2026-6019`BaseCookie.js_output() does not neutralize embedded characters	Exploitation statusNot known exploited	FixYes	Published04/22/2026	SeverityLow
`CVE-2026-3298`Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes	Exploitation statusNot known exploited	FixYes	Published04/21/2026	SeverityHigh
`CVE-2026-5713`Out-of-bounds read/write during remote profiling and asyncio process introspection when connecting to malicious target	Exploitation statusNot known exploited	FixYes	Published04/14/2026	SeverityMedium
`CVE-2026-4786`Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()	Exploitation statusNot known exploited	FixYes	Published04/13/2026	SeverityHigh
`CVE-2026-6100`Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure	Exploitation statusNot known exploited	FixYes	Published04/13/2026	SeverityCritical
`CVE-2026-3446`Base64 decoding stops at first padded quad by default	Exploitation statusNot known exploited	FixYes	Published04/10/2026	SeverityMedium
`CVE-2026-1502`HTTP client proxy tunnel headers not validated for CR/LF	Exploitation statusNot known exploited	FixYes	Published04/10/2026	SeverityMedium
`CVE-2026-4519`webbrowser.open() allows leading dashes in URLs	Exploitation statusNot known exploited	FixYes	Published03/20/2026	SeverityHigh
`CVE-2026-3479`pkgutil.get_data() does not enforce documented restrictions	Exploitation statusNot known exploited	FixYes	Published03/18/2026	SeverityInformational
`CVE-2026-4224`Stack overflow parsing XML with deeply nested DTD content models	Exploitation statusNot known exploited	FixYes	Published03/16/2026	SeverityMedium
`CVE-2026-3644`Incomplete control character validation in http.cookies	Exploitation statusNot known exploited	FixYes	Published03/16/2026	SeverityMedium
`CVE-2025-13462`tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling	Exploitation statusNot known exploited	FixYes	Published03/12/2026	SeverityLow
`CVE-2026-2297`SourcelessFileLoader does not use io.open_code()	Exploitation statusNot known exploited	FixYes	Published03/04/2026	SeverityMedium
`CVE-2026-1299`email BytesGenerator header injection due to unquoted newlines	Exploitation statusNot known exploited	FixYes	Published01/23/2026	SeverityMedium
`CVE-2025-12781`base64.b64decode() always accepts "+/" characters, despite setting altchars	Exploitation statusNot known exploited	FixYes	Published01/21/2026	SeverityMedium
`CVE-2026-0672`Header injection in http.cookies.Morsel	Exploitation statusNot known exploited	FixYes	Published01/20/2026	SeverityMedium
`CVE-2025-15367`POP3 command injection in user-controlled commands	Exploitation statusNot known exploited	FixYes	Published01/20/2026	SeverityMedium
`CVE-2025-15366`IMAP command injection in user-controlled commands	Exploitation statusNot known exploited	FixYes	Published01/20/2026	SeverityMedium
`CVE-2025-15282`Header injection via newlines in data URL mediatype	Exploitation statusNot known exploited	FixYes	Published01/20/2026	SeverityMedium
`CVE-2026-0865`wsgiref.headers.Headers allows header newline injection	Exploitation statusNot known exploited	FixYes	Published01/20/2026	SeverityMedium
`CVE-2025-11468`Folding email comments of unfoldable characters doesn't preserve parenthesis	Exploitation statusNot known exploited	FixYes	Published01/20/2026	SeverityMedium
`CVE-2025-12084`Quadratic complexity in node ID cache clearing	Exploitation statusNot known exploited	FixYes	Published12/03/2025	SeverityMedium
`CVE-2025-13837`Out-of-memory when loading Plist	Exploitation statusNot known exploited	FixYes	Published12/01/2025	SeverityLow
`CVE-2025-13836`Excessive read buffering DoS in http.client	Exploitation statusNot known exploited	FixYes	Published12/01/2025	SeverityMedium
`CVE-2025-6075`Quadratic complexity in os.path.expandvars() with user-controlled template	Exploitation statusNot known exploited	FixYes	Published10/31/2025	SeverityLow
`CVE-2025-8291`ZIP64 End of Central Directory (EOCD) Locator record offset not checked	Exploitation statusPublic exploit	FixYes	Published10/07/2025	SeverityMedium
`CVE-2025-8194`Tarfile infinite loop during parsing with negative member offset	Exploitation statusNot known exploited	FixYes	Published07/28/2025	SeverityHigh
`CVE-2025-6069`HTMLParser quadratic complexity when processing malformed inputs	Exploitation statusNot known exploited	FixYes	Published06/17/2025	SeverityMedium
`CVE-2024-12718`Bypass extraction filter to modify file metadata outside extraction directory	Exploitation statusPublic exploit	FixYes	Published06/03/2025	SeverityMedium
`CVE-2025-4435`Tarfile extracts filtered members when errorlevel=0	Exploitation statusNot known exploited	FixYes	Published06/03/2025	SeverityHigh
`CVE-2025-4138`Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory	Exploitation statusNot known exploited	FixYes	Published06/03/2025	SeverityHigh
`CVE-2025-4330`Extraction filter bypass for linking outside extraction directory	Exploitation statusNot known exploited	FixYes	Published06/03/2025	SeverityHigh
`CVE-2025-4517`Arbitrary writes via tarfile realpath overflow	Exploitation statusNot known exploited	FixYes	Published06/03/2025	SeverityCritical
`CVE-2025-4516`Use-after-free in "unicode_escape" decoder with error handler	Exploitation statusNot known exploited	FixYes	Published05/15/2025	SeverityMedium
`CVE-2025-1795`Mishandling of comma during folding and unicode-encoding of email headers	Exploitation statusNot known exploited	FixYes	Published02/28/2025	SeverityLow
`CVE-2024-3220`Default mimetype known files writeable on Windows	Exploitation statusNot known exploited	FixYes	Published02/14/2025	SeverityLow
`CVE-2025-0938`URL parser allowed square brackets in domain names	Exploitation statusNot known exploited	FixYes	Published01/31/2025	SeverityMedium
`CVE-2024-12254`Unbounded memory buffering in SelectorSocketTransport.writelines()	Exploitation statusNot known exploited	FixYes	Published12/06/2024	SeverityHigh
`CVE-2024-11168`Improper validation of IPv6 and IPvFuture addresses	Exploitation statusNot known exploited	FixYes	Published11/12/2024	SeverityMedium
`CVE-2024-9287`Virtual environment (venv) activation scripts don't quote paths	Exploitation statusNot known exploited	FixYes	Published10/22/2024	SeverityMedium
`CVE-2024-6232`Regular-expression DoS when parsing TarFile headers	Exploitation statusNot known exploited	FixYes	Published09/03/2024	SeverityHigh
`CVE-2024-8088`Infinite loop when iterating over zip archive entry names from zipfile.Path	Exploitation statusNot known exploited	FixYes	Published08/22/2024	SeverityHigh
`CVE-2024-7592`Quadratic complexity parsing cookies with backslashes	Exploitation statusPublic exploit	FixYes	Published08/19/2024	SeverityHigh
`CVE-2024-6923`Email header injection due to unquoted newlines	Exploitation statusPublic exploit	FixYes	Published08/01/2024	SeverityMedium
`CVE-2024-3219`Pure-Python fallback of socket.socketpair() doesn’t authenticate peer connection	Exploitation statusNot known exploited	FixYes	Published07/29/2024	SeverityMedium
`CVE-2024-5642`Buffer overread when using an empty list with SSLContext.set_npn_protocols()	Exploitation statusNot known exploited	FixYes	Published06/27/2024	SeverityMedium
`CVE-2024-0397`Memory race condition in ssl.SSLContext certificate store methods	Exploitation statusNot known exploited	FixYes	Published06/17/2024	SeverityHigh
`CVE-2024-4032`Incorrect IPv4 and IPv6 private ranges	Exploitation statusNot known exploited	FixYes	Published06/17/2024	SeverityHigh
`CVE-2024-4030`tempfile.mkdtemp() may be readable and writeable by all users on Windows	Exploitation statusNot known exploited	FixYes	Published05/07/2024	SeverityHigh
`CVE-2023-6597`CVE-2023-6597	Exploitation statusNot known exploited	FixYes	Published03/19/2024	SeverityHigh
`CVE-2024-0450`Quoted zip-bomb protection for zipfile	Exploitation statusPublic exploit	FixYes	Published03/19/2024	SeverityMedium
`CVE-2023-6507`Groups not dropped before running subprocess when using empty 'extra_groups' parameter	Exploitation statusNot known exploited	FixYes	Published12/08/2023	SeverityMedium

70 / 70 Results

All vulnerabilities loaded

Security vulnerabilities in CPython

CPython

Verify to analyze this security profile

How many security vulnerabilities does CPython have?

Does the latest CPython version have known vulnerabilities?

Run an in-depth assessment with complete web risk management