{"schema_version":1,"title":"Python vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 14 vulnerabilities in Python: 5 in the last 7 days and 12 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-16052, was published on 12 November 2026. 4 vulnerabilities in the last four weeks, up 33% on the four before (3). 2 technologies have a page of their own.","url":"https://junglewise.ai/threats/vendors/python","json_url":"https://junglewise.ai/threats/vendors/python.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/python","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","thin":false,"counts":{"high":2,"all_time":14,"critical":0,"exploited":0,"last_7_days":5,"last_30_days":8,"last_90_days":12,"last_365_days":14},"latest":[{"cve":"CVE-2026-16052","slug":"cve-2026-16052-the-http-cookies-morsel-class-allows-separator-semicolons-in","title":"Python http.cookies Morsel cookie attribute injection via unescaped semicolons","severity":"info","exploited":false,"published_at":"2026-11-12T17:17:44.237+00:00","url":"https://junglewise.ai/threats/cve-2026-16052-the-http-cookies-morsel-class-allows-separator-semicolons-in"},{"cve":"CVE-2026-115559","slug":"cve-2026-115559-imap4-starttls-wraps-the-socket-in-tls-but-leaves-self-readbuf","title":"Python imaplib STARTTLS command/response injection","severity":"info","exploited":false,"published_at":"2026-11-10T19:19:11.053+00:00","url":"https://junglewise.ai/threats/cve-2026-115559-imap4-starttls-wraps-the-socket-in-tls-but-leaves-self-readbuf"},{"cve":"CVE-2026-19552","slug":"cve-2026-19552-when-ca-certs-parameter-was-supplied-to-ssl-get-server","title":"CPython ssl.get_server_certificate hostname verification bypass","severity":"info","exploited":false,"published_at":"2026-11-09T15:17:21.017+00:00","url":"https://junglewise.ai/threats/cve-2026-19552-when-ca-certs-parameter-was-supplied-to-ssl-get-server"},{"cve":"CVE-2026-124249","slug":"cve-2026-124249-http-cookiejar-cookiejar-deleted-a-stored-cookie-when-a-response","title":"Python http.cookiejar cookie deletion policy bypass","severity":"info","exploited":false,"published_at":"2026-11-09T15:17:14.963+00:00","url":"https://junglewise.ai/threats/cve-2026-124249-http-cookiejar-cookiejar-deleted-a-stored-cookie-when-a-response"},{"cve":"CVE-2026-119170","slug":"cve-2026-119170-there-was-a-regression-in-how-fips-algorithms-were-enforced-for","title":"Python hashlib FIPS algorithm enforcement regression","severity":"info","exploited":false,"published_at":"2026-11-06T15:17:12.073+00:00","url":"https://junglewise.ai/threats/cve-2026-119170-there-was-a-regression-in-how-fips-algorithms-were-enforced-for"},{"cve":"CVE-2026-116566","slug":"cve-2026-116566-socket-getaddrinfo-previously-accepted-null-bytes-within-host","title":"Python socket.getaddrinfo() null byte truncation","severity":"info","exploited":false,"published_at":"2026-10-29T18:17:24.667+00:00","url":"https://junglewise.ai/threats/cve-2026-116566-socket-getaddrinfo-previously-accepted-null-bytes-within-host"},{"cve":"CVE-2026-103995","slug":"cve-2026-103995-response-body-and-chunk-parsing-would-handle-non-hex-or-negative","title":"Python http.client HTTP response parsing bypass","severity":"info","exploited":false,"published_at":"2026-10-27T20:17:11.137+00:00","url":"https://junglewise.ai/threats/cve-2026-103995-response-body-and-chunk-parsing-would-handle-non-hex-or-negative"},{"cve":"CVE-2026-115557","slug":"cve-2026-115557-python-has-added-a-denylist-for-known-compromised-certificates","title":"Python ssl module denylist for compromised certificates","severity":"info","exploited":false,"published_at":"2026-10-24T15:17:33.6+00:00","url":"https://junglewise.ai/threats/cve-2026-115557-python-has-added-a-denylist-for-known-compromised-certificates"},{"cve":"CVE-2026-19553","slug":"cve-2026-19553-ssl-sslcontext-wrap-bio-didn-t-require-the-server-hostname","title":"Python ssl.SSLContext.wrap_bio() hostname verification bypass","severity":"info","exploited":false,"published_at":"2026-09-30T17:16:45.88+00:00","url":"https://junglewise.ai/threats/cve-2026-19553-ssl-sslcontext-wrap-bio-didn-t-require-the-server-hostname"},{"cve":"CVE-2026-19445","slug":"cve-2026-19445-a-remote-unauthenticated-tls-client-can-make-a-server-crash-or","title":"Python use-after-free in SSL server-side context with sni_callback","severity":"info","exploited":false,"published_at":"2026-09-30T17:16:45.72+00:00","url":"https://junglewise.ai/threats/cve-2026-19445-a-remote-unauthenticated-tls-client-can-make-a-server-crash-or"},{"cve":"CVE-2026-12345","slug":"cve-2026-12345-the-cleanup-of-tempfile-temporarydirectory-is-vulnerable-to-a","title":"Python tempfile.TemporaryDirectory race condition in cleanup","severity":"info","exploited":false,"published_at":"2026-09-29T18:17:14.707+00:00","url":"https://junglewise.ai/threats/cve-2026-12345-the-cleanup-of-tempfile-temporarydirectory-is-vulnerable-to-a"},{"cve":"CVE-2026-87910","epss":0.0054,"slug":"cve-2026-87910-when-tarfile-extracts-a-link-on-a-system-that-doesn-t-support","title":"Python tarfile filter bypass on link extraction fallback","severity":"info","exploited":false,"published_at":"2026-09-11T18:16:59.8+00:00","url":"https://junglewise.ai/threats/cve-2026-87910-when-tarfile-extracts-a-link-on-a-system-that-doesn-t-support"},{"cve":"CVE-2026-5271","cvss":7.8,"epss":0.0017,"slug":"cve-2026-5271-pymanager-included-the-current-working-directory-in-sys-path","title":"pymanager included the current working directory in sys.path meaning modules could be shadowed by modules in the current working directory.","severity":"high","exploited":false,"published_at":"2026-04-01T14:16:59.343+00:00","url":"https://junglewise.ai/threats/cve-2026-5271-pymanager-included-the-current-working-directory-in-sys-path"},{"cve":"CVE-2026-32274","cvss":7.5,"epss":0.0072,"slug":"cve-2026-32274-psf-black-arbitrary-file-write-via-unsanitized-cache-filename","title":"psf Black arbitrary file write via unsanitized cache filename","severity":"high","exploited":false,"published_at":"2026-03-12T20:16:06.35+00:00","url":"https://junglewise.ai/threats/cve-2026-32274-psf-black-arbitrary-file-write-via-unsanitized-cache-filename"}],"vendor":{"hub":true,"name":"Python","slug":"python","homepage":"https://www.python.org/psf/","description":"Organization that develops and maintains the Python programming language.","url":"https://junglewise.ai/threats/vendors/python"},"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":3},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":4}],"most_severe":[{"cve":"CVE-2026-5271","cvss":7.8,"epss":0.0017,"slug":"cve-2026-5271-pymanager-included-the-current-working-directory-in-sys-path","title":"pymanager included the current working directory in sys.path meaning modules could be shadowed by modules in the current working directory.","severity":"high","exploited":false,"published_at":"2026-04-01T14:16:59.343+00:00","url":"https://junglewise.ai/threats/cve-2026-5271-pymanager-included-the-current-working-directory-in-sys-path"},{"cve":"CVE-2026-32274","cvss":7.5,"epss":0.0072,"slug":"cve-2026-32274-psf-black-arbitrary-file-write-via-unsanitized-cache-filename","title":"psf Black arbitrary file write via unsanitized cache filename","severity":"high","exploited":false,"published_at":"2026-03-12T20:16:06.35+00:00","url":"https://junglewise.ai/threats/cve-2026-32274-psf-black-arbitrary-file-write-via-unsanitized-cache-filename"},{"cve":"CVE-2026-87910","epss":0.0054,"slug":"cve-2026-87910-when-tarfile-extracts-a-link-on-a-system-that-doesn-t-support","title":"Python tarfile filter bypass on link extraction fallback","severity":"info","exploited":false,"published_at":"2026-09-11T18:16:59.8+00:00","url":"https://junglewise.ai/threats/cve-2026-87910-when-tarfile-extracts-a-link-on-a-system-that-doesn-t-support"},{"cve":"CVE-2026-16052","slug":"cve-2026-16052-the-http-cookies-morsel-class-allows-separator-semicolons-in","title":"Python http.cookies Morsel cookie attribute injection via unescaped semicolons","severity":"info","exploited":false,"published_at":"2026-11-12T17:17:44.237+00:00","url":"https://junglewise.ai/threats/cve-2026-16052-the-http-cookies-morsel-class-allows-separator-semicolons-in"},{"cve":"CVE-2026-115559","slug":"cve-2026-115559-imap4-starttls-wraps-the-socket-in-tls-but-leaves-self-readbuf","title":"Python imaplib STARTTLS command/response injection","severity":"info","exploited":false,"published_at":"2026-11-10T19:19:11.053+00:00","url":"https://junglewise.ai/threats/cve-2026-115559-imap4-starttls-wraps-the-socket-in-tls-but-leaves-self-readbuf"},{"cve":"CVE-2026-19552","slug":"cve-2026-19552-when-ca-certs-parameter-was-supplied-to-ssl-get-server","title":"CPython ssl.get_server_certificate hostname verification bypass","severity":"info","exploited":false,"published_at":"2026-11-09T15:17:21.017+00:00","url":"https://junglewise.ai/threats/cve-2026-19552-when-ca-certs-parameter-was-supplied-to-ssl-get-server"},{"cve":"CVE-2026-124249","slug":"cve-2026-124249-http-cookiejar-cookiejar-deleted-a-stored-cookie-when-a-response","title":"Python http.cookiejar cookie deletion policy bypass","severity":"info","exploited":false,"published_at":"2026-11-09T15:17:14.963+00:00","url":"https://junglewise.ai/threats/cve-2026-124249-http-cookiejar-cookiejar-deleted-a-stored-cookie-when-a-response"},{"cve":"CVE-2026-119170","slug":"cve-2026-119170-there-was-a-regression-in-how-fips-algorithms-were-enforced-for","title":"Python hashlib FIPS algorithm enforcement regression","severity":"info","exploited":false,"published_at":"2026-11-06T15:17:12.073+00:00","url":"https://junglewise.ai/threats/cve-2026-119170-there-was-a-regression-in-how-fips-algorithms-were-enforced-for"},{"cve":"CVE-2026-116566","slug":"cve-2026-116566-socket-getaddrinfo-previously-accepted-null-bytes-within-host","title":"Python socket.getaddrinfo() null byte truncation","severity":"info","exploited":false,"published_at":"2026-10-29T18:17:24.667+00:00","url":"https://junglewise.ai/threats/cve-2026-116566-socket-getaddrinfo-previously-accepted-null-bytes-within-host"},{"cve":"CVE-2026-103995","slug":"cve-2026-103995-response-body-and-chunk-parsing-would-handle-non-hex-or-negative","title":"Python http.client HTTP response parsing bypass","severity":"info","exploited":false,"published_at":"2026-10-27T20:17:11.137+00:00","url":"https://junglewise.ai/threats/cve-2026-103995-response-body-and-chunk-parsing-would-handle-non-hex-or-negative"}],"generated_at":"2026-11-13T03:07:00.155039+00:00","technologies":[{"name":"Python CPython","slug":"python-cpython","vulnerabilities":9,"url":"https://junglewise.ai/threats/technologies/python-cpython"},{"name":"Python","slug":"python","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/python"}]}