Feed live

python CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

344,180

All time

Critical · Active

11,533

CVSS ≥ 9.0

New · 14 days

2,691

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 1–30 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-69264	critical	9.4/10	Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation	Aug 4, 2026 2d ago
CVE-2026-18770	medium	6.9/10	vibesurf-ai VibeSurf Python Validation code code injection	Aug 4, 2026 2d ago
CVE-2026-69249	high	8.7/10	python-cryptography: Duplicate self-signed intermediates can cause exponential path-building	Aug 3, 2026 3d ago
CVE-2026-69248	medium	6.9/10	python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees	Aug 3, 2026 3d ago
CVE-2026-69097	high	7.3/10	GitPython before 3.1.53 Config Injection via Submodule Names	Aug 3, 2026 3d ago
CVE-2026-67326	high	7.3/10	GitPython before 3.1.50 Newline Injection via config_writer section	Aug 1, 2026 5d ago
CVE-2026-67324	critical	9.3/10	GitPython 3.1.50 Authentication Bypass via Joined Short Options	Aug 1, 2026 5d ago
CVE-2026-67323	high	8.6/10	GitPython before 3.1.51 Command Injection via unguarded Git options	Aug 1, 2026 5d ago
CVE-2026-67322	high	8.7/10	GitPython before 3.1.52 Environment Variable Exfiltration via clone_from	Aug 1, 2026 5d ago
CVE-2026-67325	high	8.7/10	GitPython before 3.1.51 Command Injection via option prefix abbreviation	Aug 1, 2026 5d ago
CVE-2026-55415	high	7.5/10	datamodel-code-generator vulnerable to code injection via `x-python-import` / `customTypePath` in generated import statements	Jul 28, 2026 9d ago
CVE-2026-54655	high	7.8/10	`datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generator	Jul 28, 2026 9d ago
CVE-2026-66053	medium	5.9/10	Apache Thrift: Python TSSLSocket Hostname Matcher Import	Jul 27, 2026 11d ago
CVE-2026-41608	—	—	Apache Thrift: Unbounded Zlib Decompression in Python THeaderTransport	Jul 27, 2026 11d ago
CVE-2026-17497	high	8.3/10	NoteGen arbitrary OS command execution via Tauri shell:allow-execute for bash/python	Jul 26, 2026 11d ago
CVE-2026-16796	high	7.3/10	Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()	Jul 23, 2026 14d ago
CVE-2026-59862	high	7.5/10	Kiota: Code Generation Literal Injection in the Python Generator	Jul 16, 2026 21d ago
CVE-2026-15925	critical	9.2/10	Improper TLS Hostname Verification in Snowflake Connector for Python	Jul 16, 2026 22d ago
CVE-2026-55865	high	7.1/10	Python Liquid: Infinite loop when parsing malformed `{% case %}` tags	Jul 9, 2026 28d ago
CVE-2026-55830	high	8.3/10	RestrictedPython guard hooks can be shadowed via positional-only arguments	Jul 8, 2026 29d ago
CVE-2026-15062	critical	9.6/10	SQL Injection in Snowflake Snowpark Python SDK	Jul 8, 2026 29d ago
CVE-2026-10134	critical	10.0/10	Unauthenticated Server-Side RCE via PythonCodeStructuredTool in Public Flows	Jun 30, 2026 1mo ago
CVE-2026-12003	medium	5.3/10	CPython >3.11 Insecure Input Validation resulting in privilege escalation	Jun 16, 2026 1mo ago
CVE-2026-12210	medium	5.3/10	universal-tool-calling-protocol python-utcp utcp-gql/utcp-websocket server-side request forgery	Jun 15, 2026 1mo ago
CVE-2026-52860	high	7.5/10	Vim: Arbitrary Code Execution via Python Omni-Completion	Jun 11, 2026 1mo ago
CVE-2026-52858	high	7.3/10	Vim: Arbitrary Code Execution via Python Omni-Completion	Jun 11, 2026 1mo ago
CVE-2026-10143	high	7.5/10	kafka-python prior to 2.3.2 DoS via SCRAM Iteration Count in scram.py	Jun 10, 2026 1mo ago
CVE-2026-10142	high	7.5/10	kafka-python prior to 2.3.2 Denial of Service via Protocol Parser Frame Length	Jun 10, 2026 1mo ago
CVE-2026-46497	low	2.3/10	SSRF via sitemap-derived URLs in Crawlee for Python	Jun 10, 2026 1mo ago
CVE-2026-45426	—	—	Apache Airflow: Log server JWT authorization bypass via Python lstrip() character stripping allows cross-Dag log access	Jun 1, 2026 2mo ago