目標達成 すべての支援者に感謝 — 100%達成しました！

目標: 1000 CNY · 調達済み: 1336 CNY

100%
コーヒーを一杯おごる

Python Software Foundation 厂商漏洞列表 / CVE 中文分析 64

Python Software Foundation 厂商相关 64 条 CVE 漏洞，含 AI 中文分析、POC、CVSS 评分与受影响产品。

Python Software Foundation 负责维护 Python 语言及其核心生态系统，包括 PyPI 包索引。其历史漏洞多涉及远程代码执行、路径遍历及权限提升，常源于标准库解析缺陷或第三方包供应链风险。值得关注的是，PSF 建立了安全响应机制，定期发布补丁修复高危漏洞，并推动依赖项安全最佳实践，以保障全球开发者环境稳定。

上位製品 Python Software Foundation: CPython pymanager
CVE IDタイトルCVSS深刻度公開日
CVE-2026-4360 Tarfile.extract() doesn't fully respect filter parameter — CPythonCWE-281--2026-06-30
CVE-2026-11972 tarfile opened in streaming mode mishandles EOF — CPythonCWE-252--2026-06-23
CVE-2026-0864 Configuration Injection via Carriage Return (\r) in write() method — CPython--2026-06-23
CVE-2026-11940 tarfile extraction filter bypass allows escaping the destination directory — CPythonCWE-22--2026-06-23
CVE-2026-12003 CPython >3.11 Insecure Input Validation resulting in privilege escalation — CPythonCWE-427--2026-06-16
CVE-2026-9669 bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow — CPythonCWE-121--2026-06-08
CVE-2026-7774 tarfile.data_filter path traversal bypass allows writing outside the extraction directory — CPythonCWE-22--2026-06-04
CVE-2026-3276 Potential DoS via quadratic complexity in unicodedata.normalize() — CPythonCWE-407--2026-06-03
CVE-2026-8328 FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address — CPythonCWE-918--2026-05-13
CVE-2026-7210 The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection — CPythonCWE-331--2026-05-11
CVE-2026-3087 shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs — CPythonCWE-22 6.2AIMediumAI2026-04-27
CVE-2026-6019 BaseCookie.js_output() does not neutralize embedded characters — CPythonCWE-150 6.1AIMediumAI2026-04-22
CVE-2026-3298 Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes — CPythonCWE-787 8.8AIHighAI2026-04-21
CVE-2026-5713 Out-of-bounds read/write during remote profiling and asyncio process introspection when connecting to malicious target — CPythonCWE-121 9.1 -2026-04-14
CVE-2026-4786 Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open() — CPythonCWE-77 9.8 -2026-04-13
CVE-2026-6100 Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure — CPythonCWE-416 8.4 -2026-04-13
CVE-2026-3446 Base64 decoding stops at first padded quad by default — CPython 8.2AIHighAI2026-04-10
CVE-2026-1502 HTTP client proxy tunnel headers not validated for CR/LF — CPython 7.5AIHighAI2026-04-10
CVE-2026-5271 Possible to hijack modules in current working directory — pymanager 8.4AIHighAI2026-04-01
CVE-2026-4519 webbrowser.open() allows leading dashes in URLs — CPython 8.2 -2026-03-20
CVE-2026-3479 pkgutil.get_data() does not enforce documented restrictions — CPython 7.5 -2026-03-18
CVE-2026-4224 Stack overflow parsing XML with deeply nested DTD content models — CPython 9.8 -2026-03-16
CVE-2026-3644 Incomplete control character validation in http.cookies — CPython 9.8 -2026-03-16
CVE-2025-13462 tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling — CPython 6.5AIMediumAI2026-03-12
CVE-2026-2297 SourcelessFileLoader does not use io.open_code() — CPython 8.2 -2026-03-04
CVE-2026-1299 email BytesGenerator header injection due to unquoted newlines — CPythonCWE-93 4.3 -2026-01-23
CVE-2025-12781 base64.b64decode() always accepts "+/" characters, despite setting altchars — CPython 7.5AIHighAI2026-01-21
CVE-2026-0672 Header injection in http.cookies.Morsel — CPythonCWE-93 4.3AIMediumAI2026-01-20
CVE-2025-15367 POP3 command injection in user-controlled commands — CPythonCWE-77 9.8AICriticalAI2026-01-20
CVE-2025-15366 IMAP command injection in user-controlled commands — CPythonCWE-77 9.8AICriticalAI2026-01-20

本页汇总了 Python Software Foundation 厂商截至目前公开的全部 64 条 CVE 漏洞。每条漏洞均包含 CVSS 评分、CWE 弱点分类、受影响产品与参考链接，并附带 AI 生成的中文分析以便快速判断风险。