CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2025-1795 – Mishandling of comma during folding and unicode-encoding of email headers
https://notcve.org/view.php?id=CVE-2025-1795
28 Feb 2025 — During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also unicode-encoded. Expected behavior is that the separating comma remains a plan comma. This can result in the address header being misinterpreted by some mail servers. It was discovered that Python incorrectly handled certain unicode characters during decoding. An attacker could possibly use this issue to cause a denial of service. • https://github.com/python/cpython/commit/09fab93c3d857496c0bd162797fab816c311ee48 • CWE-116: Improper Encoding or Escaping of Output •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-3220 – Default mimetype known files writeable on Windows
https://notcve.org/view.php?id=CVE-2024-3220
14 Feb 2025 — There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of known file locations are writable meaning other users can create invalid files to cause MemoryError to be raised on Python runtime startup or have file extensions be interpreted as the incorrect file type. This defect is caused by the default locations of Linux and macOS platforms (such as “/etc/mime.types”) also being used on Windows, where they are user-writable locations (“C:\etc\mime.types”). To wor... • https://mail.python.org/archives/list/security-announce@python.org/thread/CDXW34ND2LSAOYAR5N6UNONP4ZBX4D6R • CWE-426: Untrusted Search Path •
CVSS: 6.8EPSS: 0%CPEs: 5EXPL: 0CVE-2025-0938 – URL parser allowed square brackets in domain names
https://notcve.org/view.php?id=CVE-2025-0938
31 Jan 2025 — The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-compliant URL parsers. A flaw was found in Python. The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accept domain ... • https://github.com/python/cpython/commit/d89a5f6a6e65511a5f6e0618c4c30a7aa5aba56a • CWE-20: Improper Input Validation •
CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 0CVE-2024-12254 – Unbounded memory buffering in SelectorSocketTransport.writelines()
https://notcve.org/view.php?id=CVE-2024-12254
06 Dec 2024 — Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer potentially leading to memory exhaustion. This vulnerability likely impacts a small number of users, you must be using Python 3.12.0 or later, on macOS or Linux, using the asyncio module with protocols, and using .wri... • https://github.com/python/cpython/commit/71e8429ac8e2adc10084ab5ec29a62f4b6671a82 • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-53848 – check-jsonschema default caching for remote schemas allows for cache confusion
https://notcve.org/view.php?id=CVE-2024-53848
29 Nov 2024 — check-jsonschema is a CLI and set of pre-commit hooks for jsonschema validation. The default cache strategy uses the basename of a remote schema as the name of the file in the cache, e.g. `https://example.org/schema.json` will be stored as `schema.json`. This naming allows for conflicts. If an attacker can get a user to run `check-jsonschema` against a malicious schema URL, e.g., `https://example.evil.org/schema.json`, they can insert their own schema into the cache and it will be picked up and used instead... • https://github.com/python-jsonschema/check-jsonschema/commit/c52714b85e6725b1b24516fbdedacb333b939152 • CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data •
CVSS: 7.7EPSS: 0%CPEs: 1EXPL: 0CVE-2024-52595 – HTML Cleaner allows crafted scripts in special contexts like svg or math to pass through
https://notcve.org/view.php?id=CVE-2024-52595
19 Nov 2024 — lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.0, the HTML Parser in lxml does not properly handle context-switching for special HTML tags such as `
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-50649
https://notcve.org/view.php?id=CVE-2024-50649
15 Nov 2024 — The user avatar upload function in python_book V1.0 has an arbitrary file upload vulnerability. • https://github.com/Yllxx03/CVE/blob/main/python_book/FileUpload.md • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-50650
https://notcve.org/view.php?id=CVE-2024-50650
15 Nov 2024 — python_book V1.0 is vulnerable to Incorrect Access Control, which allows attackers to obtain sensitive information of users with different IDs by modifying the ID parameter. • https://github.com/Yllxx03/CVE/blob/main/python_book/BrokenAccessControl.md • CWE-863: Incorrect Authorization •
CVSS: 9.1EPSS: 0%CPEs: 3EXPL: 0CVE-2024-11168 – Improper validation of IPv6 and IPvFuture addresses
https://notcve.org/view.php?id=CVE-2024-11168
12 Nov 2024 — The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser. A flaw was found in Python. The `urllib.parse.urlsplit()` and `urlparse()` functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture compliant. This behavior was not conformant to RFC 3986 and was po... • https://github.com/python/cpython/commit/29f348e232e82938ba2165843c448c2b291504c5 • CWE-918: Server-Side Request Forgery (SSRF) CWE-1287: Improper Validation of Specified Type of Input •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2024-9287 – Virtual environment (venv) activation scripts don't quote paths
https://notcve.org/view.php?id=CVE-2024-9287
22 Oct 2024 — A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie "./ven... • https://github.com/python/cpython/issues/124651 • CWE-428: Unquoted Search Path or Element •