# Python vulnerabilities Source: https://junglewise.ai/threats/vendors/python Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/python.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 14 vulnerabilities in Python: 5 in the last 7 days and 12 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-16052, was published on 12 November 2026. 4 vulnerabilities in the last four weeks, up 33% on the four before (3). 2 technologies have a page of their own. ## Counts - Last 7 days: 5 - Last 30 days: 8 - Last 90 days: 12 - All time: 14 (0 critical, 0 exploited in the wild) ## About Python Organization that develops and maintains the Python programming language. ## Latest Python vulnerabilities - [CVE-2026-16052: Python http.cookies Morsel cookie attribute injection via unescaped semicolons](https://junglewise.ai/threats/cve-2026-16052-the-http-cookies-morsel-class-allows-separator-semicolons-in) (info, published 12 Nov 2026) - [CVE-2026-115559: Python imaplib STARTTLS command/response injection](https://junglewise.ai/threats/cve-2026-115559-imap4-starttls-wraps-the-socket-in-tls-but-leaves-self-readbuf) (info, published 10 Nov 2026) - [CVE-2026-19552: CPython ssl.get_server_certificate hostname verification bypass](https://junglewise.ai/threats/cve-2026-19552-when-ca-certs-parameter-was-supplied-to-ssl-get-server) (info, published 9 Nov 2026) - [CVE-2026-124249: Python http.cookiejar cookie deletion policy bypass](https://junglewise.ai/threats/cve-2026-124249-http-cookiejar-cookiejar-deleted-a-stored-cookie-when-a-response) (info, published 9 Nov 2026) - [CVE-2026-119170: Python hashlib FIPS algorithm enforcement regression](https://junglewise.ai/threats/cve-2026-119170-there-was-a-regression-in-how-fips-algorithms-were-enforced-for) (info, published 6 Nov 2026) - [CVE-2026-116566: Python socket.getaddrinfo() null byte truncation](https://junglewise.ai/threats/cve-2026-116566-socket-getaddrinfo-previously-accepted-null-bytes-within-host) (info, published 29 Oct 2026) - [CVE-2026-103995: Python http.client HTTP response parsing bypass](https://junglewise.ai/threats/cve-2026-103995-response-body-and-chunk-parsing-would-handle-non-hex-or-negative) (info, published 27 Oct 2026) - [CVE-2026-115557: Python ssl module denylist for compromised certificates](https://junglewise.ai/threats/cve-2026-115557-python-has-added-a-denylist-for-known-compromised-certificates) (info, published 24 Oct 2026) - [CVE-2026-19553: Python ssl.SSLContext.wrap_bio() hostname verification bypass](https://junglewise.ai/threats/cve-2026-19553-ssl-sslcontext-wrap-bio-didn-t-require-the-server-hostname) (info, published 30 Sep 2026) - [CVE-2026-19445: Python use-after-free in SSL server-side context with sni_callback](https://junglewise.ai/threats/cve-2026-19445-a-remote-unauthenticated-tls-client-can-make-a-server-crash-or) (info, published 30 Sep 2026) - [CVE-2026-12345: Python tempfile.TemporaryDirectory race condition in cleanup](https://junglewise.ai/threats/cve-2026-12345-the-cleanup-of-tempfile-temporarydirectory-is-vulnerable-to-a) (info, published 29 Sep 2026) - [CVE-2026-87910: Python tarfile filter bypass on link extraction fallback](https://junglewise.ai/threats/cve-2026-87910-when-tarfile-extracts-a-link-on-a-system-that-doesn-t-support) (info, published 11 Sep 2026) - [CVE-2026-5271: pymanager included the current working directory in sys.path meaning modules could be shadowed by modules in the current…](https://junglewise.ai/threats/cve-2026-5271-pymanager-included-the-current-working-directory-in-sys-path) (high, CVSS 7.8, published 1 Apr 2026) - [CVE-2026-32274: psf Black arbitrary file write via unsanitized cache filename](https://junglewise.ai/threats/cve-2026-32274-psf-black-arbitrary-file-write-via-unsanitized-cache-filename) (high, CVSS 7.5, published 12 Mar 2026) ## Most severe Python vulnerabilities - [CVE-2026-5271: pymanager included the current working directory in sys.path meaning modules could be shadowed by modules in the current…](https://junglewise.ai/threats/cve-2026-5271-pymanager-included-the-current-working-directory-in-sys-path) (high, CVSS 7.8, published 1 Apr 2026) - [CVE-2026-32274: psf Black arbitrary file write via unsanitized cache filename](https://junglewise.ai/threats/cve-2026-32274-psf-black-arbitrary-file-write-via-unsanitized-cache-filename) (high, CVSS 7.5, published 12 Mar 2026) - [CVE-2026-87910: Python tarfile filter bypass on link extraction fallback](https://junglewise.ai/threats/cve-2026-87910-when-tarfile-extracts-a-link-on-a-system-that-doesn-t-support) (info, published 11 Sep 2026) - [CVE-2026-16052: Python http.cookies Morsel cookie attribute injection via unescaped semicolons](https://junglewise.ai/threats/cve-2026-16052-the-http-cookies-morsel-class-allows-separator-semicolons-in) (info, published 12 Nov 2026) - [CVE-2026-115559: Python imaplib STARTTLS command/response injection](https://junglewise.ai/threats/cve-2026-115559-imap4-starttls-wraps-the-socket-in-tls-but-leaves-self-readbuf) (info, published 10 Nov 2026) - [CVE-2026-19552: CPython ssl.get_server_certificate hostname verification bypass](https://junglewise.ai/threats/cve-2026-19552-when-ca-certs-parameter-was-supplied-to-ssl-get-server) (info, published 9 Nov 2026) - [CVE-2026-124249: Python http.cookiejar cookie deletion policy bypass](https://junglewise.ai/threats/cve-2026-124249-http-cookiejar-cookiejar-deleted-a-stored-cookie-when-a-response) (info, published 9 Nov 2026) - [CVE-2026-119170: Python hashlib FIPS algorithm enforcement regression](https://junglewise.ai/threats/cve-2026-119170-there-was-a-regression-in-how-fips-algorithms-were-enforced-for) (info, published 6 Nov 2026) - [CVE-2026-116566: Python socket.getaddrinfo() null byte truncation](https://junglewise.ai/threats/cve-2026-116566-socket-getaddrinfo-previously-accepted-null-bytes-within-host) (info, published 29 Oct 2026) - [CVE-2026-103995: Python http.client HTTP response parsing bypass](https://junglewise.ai/threats/cve-2026-103995-response-body-and-chunk-parsing-would-handle-non-hex-or-negative) (info, published 27 Oct 2026) ## Vulnerabilities per week 4 vulnerabilities in the last four weeks, up 33% on the four before (3). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 1 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 3 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 1 | 0 | 0 | | 26 Oct 2026 | 2 | 0 | 0 | | 2 Nov 2026 | 1 | 0 | 0 | | 9 Nov 2026 | 4 | 0 | 0 | ## Python technologies - [Python CPython](https://junglewise.ai/threats/technologies/python-cpython): 9 vulnerabilities - [Python](https://junglewise.ai/threats/technologies/python): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Python vulnerabilities", https://junglewise.ai/threats/vendors/python, 13 November 2026.