CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| CVE-2020-5312 |
| CRITICAL9.8 |
libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow. |
| 03/01/2020 |
| CVE-2020-5311 | CRITICAL9.8 | libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow. | 03/01/2020 |
| CVE-2020-5310 | HIGH8.8 | libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc. | 03/01/2020 |
| CVE-2016-1000110 | MEDIUM6.1 | The CGIHandler class in Python before 2.7.12 does not protect against the HTTP_PROXY variable name clash in a CGI script, which could allow a remote attacker to redirect HTTP requests. | 27/11/2019 |
| CVE-2019-19275 | HIGH7.5 | typed_ast 1.3.0 and 1.3.1 has an ast_for_arguments out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source (but not necessarily execute it) may be able to crash the interpreter process. This could be a concern, for example, in a web-based service that parses (but does not e | 26/11/2019 |
| CVE-2019-19274 | HIGH7.5 | typed_ast 1.3.0 and 1.3.1 has a handle_keywordonly_args out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source (but not necessarily execute it) may be able to crash the interpreter process. This could be a concern, for example, in a web-based service that parses (but does | 26/11/2019 |
| CVE-2012-5578 | MEDIUM6.2 | Python keyring has insecure permissions on new databases allowing world-readable files to be created | 25/11/2019 |
| CVE-2019-5010 | HIGH7.5 | An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger | 31/10/2019 |
| CVE-2012-5577 | HIGH7.5 | Python keyring lib before 0.10 created keyring files with world-readable permissions. | 28/10/2019 |
| CVE-2019-18348 | MEDIUM6.1 | An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the host component of a URL) followed by an HTTP header. | 23/10/2019 |
| CVE-2019-17514 | HIGH7.5 | library/glob.html in the Python 2 and 3 documentation before 2016 has potentially misleading information about whether sorting occurs, as demonstrated by irreproducible cancer-research results. NOTE: the effects of this documentation cross application domains, and thus it is likely that security-relevant code elsewhere | 12/10/2019 |
| CVE-2019-16865 | HIGH7.5 | An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image. | 04/10/2019 |
| CVE-2019-16935 | MEDIUM6.1 | The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delive | 28/09/2019 |
| CVE-2019-16056 | HIGH7.5 | An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be | 06/09/2019 |
| CVE-2019-15903 | HIGH7.5 | In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read. | 04/09/2019 |
| CVE-2019-10138 | HIGH8.8 | A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to generate FreeIPA tokens. | 30/07/2019 |
| CVE-2018-20852 | MEDIUM4.3 | http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix (e.g., | 13/07/2019 |