LIVE · cybersecurity feed
Live wire
ASOS Breach Reveals the Risks in Customer-Facing SaaSUnpatched AhsayCBS flaws exploited to deploy webshells, mine cryptoAI Training Critical as Governance Challenges GrowUS Disrupts Chinese State-Sponsored Hacking ToolsCitrix warns admins to patch new NetScaler RCE flaw immediatelyCisco Patches a Dozen Critical VulnerabilitiesCisco warns of critical flaws allowing Nexus switch takeoverCVE-2026-21589 · Exploitation attempts against critical Atlassian flaw have begun (CVE-2026-21589)Cyber experts call on CISA to create mandatory federal OT rulesGremlin Foresight AI finds system weaknesses and verifies the fixes
vendor

Python

19 CVEs published in the last four months and 2 stories. Exploited flaws first.

Critical2
High15
Medium0
Exploited (KEV)0

All recent CVEs

CVECVSSSeverityProductSummaryPublished
CVE-2026-319009.8criticalblackBlack is the uncompromising Python code formatter.223d ago
CVE-2026-540589.1criticalpillowPillow is a Python imaging library.98d ago
CVE-2026-591978.2highpillowPillow is a Python imaging library.98d ago
CVE-2026-72107.5highpython`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which 162d ago
CVE-2026-444327.5highurllib3urllib3 is an HTTP client library for Python.160d ago
CVE-2026-540597.5highpillowPillow is a Python imaging library.106d ago
CVE-2026-540607.5highpillowPillow is a Python imaging library.106d ago
CVE-2026-553797.5highpillowPillow is a Python imaging library.106d ago
CVE-2026-553807.5highpillowPillow is a Python imaging library.106d ago
CVE-2026-153087.5highpythonThe incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminate103d ago
CVE-2026-591997.5highpillowPillow is a Python imaging library.98d ago
CVE-2026-592047.5highpillowPillow is a Python imaging library.98d ago
CVE-2026-592057.5highpillowPillow is a Python imaging library.98d ago
CVE-2026-592007.5highpillowPillow is a Python imaging library.98d ago
CVE-2026-36447.5highpythonThe fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete.218d ago
CVE-2026-42247.5highpythonWhen an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a de218d ago
CVE-2026-322747.5highblackBlack is the uncompromising Python code formatter.222d ago
CVE-2025-134623.3lowpythonThe "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a222d ago
CVE-2026-45193.3lowpythonThe webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for214d ago

Filter the full tracker by Python →

Our coverage of Python

vulnerability

Flaws in Google APK for Python Unlock Agent-to-Agent Attack

Recent reports indicate that Google has addressed a series of vulnerabilities found within its APK for Python, which could have enabled an agent-to-agent attack scenario. The core of the issue reportedly lay in the exploitation of a trust boundary between two distinct AI agents operating with differing privilege levels. This trust boundary bypass could then trigger automated actions with…

security

HollowFrame Loader Uses Fake Python DLL to Evade Defender

A previously undocumented loader framework has been observed by Blackpoint Cyber's Adversary Pursuit Group (APG) leveraging a counterfeit Python runtime to disguise Go code, after first configuring Microsoft Defender to overlook the directories and processes it intended to exploit. The intrusion, detailed in research published on July 30, affected two endpoints at a law firm, deploying two new…