目標達成 すべての支援者に感謝 — 100%達成しました！

目標: 1000 CNY · 調達済み: 1000 CNY

100.0%
コーヒーを一杯おごる

Python Software Foundation 厂商漏洞列表 / CVE 中文分析 54

Python Software Foundation 厂商相关 54 条 CVE 漏洞，含 AI 中文分析、POC、CVSS 评分与受影响产品。

Python Software Foundation 负责维护 Python 语言及其核心生态系统，包括 PyPI 包索引。其历史漏洞多涉及远程代码执行、路径遍历及权限提升，常源于标准库解析缺陷或第三方包供应链风险。值得关注的是，PSF 建立了安全响应机制，定期发布补丁修复高危漏洞，并推动依赖项安全最佳实践，以保障全球开发者环境稳定。

上位製品 Python Software Foundation: CPython pymanager
CVE IDタイトルCVSS深刻度公開日
CVE-2026-3087 shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs — CPythonCWE-22 6.2AIMediumAI2026-04-27
CVE-2026-6019 BaseCookie.js_output() does not neutralize embedded characters — CPythonCWE-150 6.1AIMediumAI2026-04-22
CVE-2026-3298 Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes — CPythonCWE-787 8.8AIHighAI2026-04-21
CVE-2026-5713 Out-of-bounds read/write during remote profiling and asyncio process introspection when connecting to malicious target — CPythonCWE-121 9.1 -2026-04-14
CVE-2026-4786 Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open() — CPythonCWE-77 9.8 -2026-04-13
CVE-2026-6100 Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure — CPythonCWE-416 8.4 -2026-04-13
CVE-2026-3446 Base64 decoding stops at first padded quad by default — CPython 8.2AIHighAI2026-04-10
CVE-2026-1502 HTTP client proxy tunnel headers not validated for CR/LF — CPython 7.5AIHighAI2026-04-10
CVE-2026-5271 Possible to hijack modules in current working directory — pymanager 8.4AIHighAI2026-04-01
CVE-2026-4519 webbrowser.open() allows leading dashes in URLs — CPython 8.2 -2026-03-20
CVE-2026-3479 pkgutil.get_data() does not enforce documented restrictions — CPython 7.5 -2026-03-18
CVE-2026-4224 Stack overflow parsing XML with deeply nested DTD content models — CPython 9.8 -2026-03-16
CVE-2026-3644 Incomplete control character validation in http.cookies — CPython 9.8 -2026-03-16
CVE-2025-13462 tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling — CPython 6.5AIMediumAI2026-03-12
CVE-2026-2297 SourcelessFileLoader does not use io.open_code() — CPython 8.2 -2026-03-04
CVE-2026-1299 email BytesGenerator header injection due to unquoted newlines — CPythonCWE-93 4.3 -2026-01-23
CVE-2025-12781 base64.b64decode() always accepts "+/" characters, despite setting altchars — CPython 7.5AIHighAI2026-01-21
CVE-2026-0672 Header injection in http.cookies.Morsel — CPythonCWE-93 4.3AIMediumAI2026-01-20
CVE-2025-15367 POP3 command injection in user-controlled commands — CPythonCWE-77 9.8AICriticalAI2026-01-20
CVE-2025-15366 IMAP command injection in user-controlled commands — CPythonCWE-77 9.8AICriticalAI2026-01-20
CVE-2025-15282 Header injection via newlines in data URL mediatype — CPythonCWE-93 5.3AIMediumAI2026-01-20
CVE-2026-0865 wsgiref.headers.Headers allows header newline injection — CPythonCWE-74 4.7AIMediumAI2026-01-20
CVE-2025-11468 Folding email comments of unfoldable characters doesn't preserve parenthesis — CPython 6.5AIMediumAI2026-01-20
CVE-2025-12084 Quadratic complexity in node ID cache clearing — CPython 7.5AIHighAI2025-12-03
CVE-2025-13837 Out-of-memory when loading Plist — CPython 6.5AIMediumAI2025-12-01
CVE-2025-13836 Excessive read buffering DoS in http.client — CPython 9.8AICriticalAI2025-12-01
CVE-2025-6075 Quadratic complexity in os.path.expandvars() with user-controlled template — CPython 7.5 -2025-10-31
CVE-2025-8291 ZIP64 End of Central Directory (EOCD) Locator record offset not checked — CPython 4.3 Medium2025-10-07
CVE-2025-8194 Tarfile infinite loop during parsing with negative member offset — CPythonCWE-835 7.5 High2025-07-28
CVE-2025-6069 HTMLParser quadratic complexity when processing malformed inputs — CPythonCWE-1333 4.3 Medium2025-06-17

本页汇总了 Python Software Foundation 厂商截至目前公开的全部 54 条 CVE 漏洞。每条漏洞均包含 CVSS 评分、CWE 弱点分类、受影响产品与参考链接，并附带 AI 生成的中文分析以便快速判断风险。