Search for packages
| purl | pkg:deb/debian/python3.14@3.14.4-2 |
| Next non-vulnerable version | 3.14.5~rc1-1 |
| Latest non-vulnerable version | 3.14.5~rc1-1 |
| Risk | 4.1 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-rcu5-gpmt-r7cb
Aliases: CVE-2026-6100 |
Affected by 0 other vulnerabilities. |
|
|
VCID-vk3a-td8w-ebfp
Aliases: CVE-2026-6019 |
http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value. |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-11ed-tk56-8khn | python: Python: Command-line option injection in webbrowser.open() via crafted URLs |
CVE-2026-4519
|
| VCID-1pr1-jkqa-43g6 | cpython: CPython: Logging Bypass in Legacy .pyc File Handling |
CVE-2026-2297
|
| VCID-9vcx-2fts-gkfw | cpython: Stack overflow parsing XML with deeply nested DTD content models |
CVE-2026-4224
|
| VCID-gqzt-rh1w-jkfu | cpython: Incomplete control character validation in http.cookies |
CVE-2026-3644
|
| VCID-n4au-q9bs-kucb | The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations. |
CVE-2025-13462
|
| VCID-q653-8f64-gkbe |
CVE-2026-3446
|