Overview 54 matches · 0 in Waratek scope · 0 protected · 1 exploited · 1 CISA KEV · 4 public PoC · 0 EPSS ≥ 0.5
54matches
0in Waratek scope0.0%
0protected0.0%
1exploited1.9%
1CISA KEV1.9%
4public PoC7.4%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
5
9.3%
Not applicable
49
90.7%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
54
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 14 / year
20071
Not applicable1
Critical1
not blocked1
Proof of concept only1
20080
20090
20100
20110
20120
20130
20140
20150
20163
Not applicable3
Critical3
not blocked3
No public exploit3
20173
Not applicable3
Critical3
not blocked3
No public exploit3
20182
Not applicable2
Critical2
not blocked2
No public exploit2
20199
Outside Waratek scope1
Not applicable8
Critical9
not blocked9
Proof of concept only1
No public exploit8
20206
Outside Waratek scope2
Not applicable4
Critical6
not blocked6
Working exploit published1
No public exploit5
20213
Outside Waratek scope2
Not applicable1
Critical3
not blocked3
Proof of concept only1
No public exploit2
202214
Not applicable14
Critical14
not blocked14
Proof of concept only4
No public exploit10
20237
Not applicable7
Critical7
not blocked7
Proof of concept only2
No public exploit5
20241
Not applicable1
Critical1
not blocked1
Proof of concept only1
20250
20265
Not applicable5
Critical5
not blocked5
Exploited1
Proof of concept only2
No public exploit2
2008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-78676 | Critical | 2026-08-25 | Not applicable | No public exploit | GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated GitPython config write, enabling arbitrary code execution via hook invocation. |
| CVE-2026-67324 | Critical | 2026-08-01 | Not applicable | No public exploit | GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options into Repo.clone_from(..., multi_options=..., allow_unsafe_options=False), an attacker can supply -u<helper> to bypass the gate that blocks --upload-pack/-u, causing Git to execute the specified helper command during clone. Fixed in 3.1.51. |
| CVE-2026-47103 | Critical | 2026-06-17 | Not applicable | Proof of concept only | Python StateMachine versions 3.0.0 before 3.2.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary code by supplying malicious SCXML documents containing crafted `<data expr="...">` attributes evaluated unsafely. The SCXMLProcessor passes attacker-controlled expression strings through a call chain ending in Python's built-in eval() without sandboxing, enabling arbitrary code execution in the context of the hosting process. |
| CVE-2026-45321 | Critical | 2026-05-12 | Not applicable | Exploited | On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart. |
| CVE-2026-42284 | Critical | 2026-05-07 | Not applicable | Proof of concept only | GitPython is a python library used to interact with Git repositories. Prior to version 3.1.47, _clone() validates multi_options as the original list, then executes shlex.split(" ".join(multi_options)). A string like "--branch main --config core.hooksPath=/x" passes validation (starts with --branch), but after split becomes ["--branch", "main", "--config", "core.hooksPath=/x"]. Git applies the config and executes attacker hooks during clone. This issue has been patched in version 3.1.47. |
| CVE-2024-50649 | Critical | 2024-11-15 | Not applicable | Proof of concept only | The user avatar upload function in python_book V1.0 has an arbitrary file upload vulnerability. |
| CVE-2023-7158 | Critical | 2023-12-29 | Not applicable | No public exploit | A vulnerability was found in MicroPython up to 1.21.0. It has been classified as critical. Affected is the function slice_indices of the file objslice.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.22.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-249180. |
| CVE-2023-7152 | Critical | 2023-12-29 | Not applicable | No public exploit | A vulnerability, which was classified as critical, has been found in MicroPython 1.21.0/1.22.0-preview. Affected by this issue is the function poll_set_add_fd of the file extmod/modselect.c. The manipulation leads to use after free. The exploit has been disclosed to the public and may be used. The patch is identified as 8b24aa36ba978eafc6114b6798b47b7bfecdca26. It is recommended to apply a patch to fix this issue. VDB-249158 is the identifier assigned to this vulnerability. |
| CVE-2022-48565 | Critical | 2023-08-22 | Not applicable | Proof of concept only | An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities. |
| CVE-2023-40267 | Critical | 2023-08-11 | Not applicable | No public exploit | GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439. |
| CVE-2023-37271 | Critical | 2023-07-11 | Not applicable | No public exploit | RestrictedPython is a tool that helps to define a subset of the Python language which allows users to provide a program input into a trusted environment. RestrictedPython does not check access to stack frames and their attributes. Stack frames are accessible within at least generators and generator expressions, which are allowed inside RestrictedPython. Prior to versions 6.1 and 5.3, an attacker with access to a RestrictedPython environment can write code that gets the current stack frame in a generator and then walk the stack all the way beyond the RestrictedPython invocation boundary, thus breaking out of the restricted sandbox and potentially allowing arbitrary code execution in the Python interpreter. All RestrictedPython deployments that allow untrusted users to write Python code in the RestrictedPython environment are at risk. In terms of Zope and Plone, this would mean deployments where the administrator allows untrusted users to create and/or edit objects of type `Script (Python)`, `DTML Method`, `DTML Document` or `Zope Page Template`. This is a non-default configuration and likely to be extremely rare. The problem has been fixed in versions 6.1 and 5.3. |
| CVE-2018-25082 | Critical | 2023-03-21 | Not applicable | No public exploit | A vulnerability was found in zwczou WeChat SDK Python 0.3.0 and classified as critical. This issue affects the function validate/to_xml. The manipulation leads to xml external entity reference. The attack may be initiated remotely. Upgrading to version 0.5.5 is able to address this issue. The patch is named e54abadc777715b6dcb545c13214d1dea63df6c9. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-223403. |
| CVE-2023-24107 | Critical | 2023-02-22 | Not applicable | Proof of concept only | hour_of_code_python_2015 commit 520929797b9ca43bb818b2e8f963fb2025459fa3 was discovered to contain a code execution backdoor via the request package (requirements.txt). This vulnerability allows attackers to access sensitive user information and execute arbitrary code. |
| CVE-2022-46609 | Critical | 2022-12-14 | Not applicable | Proof of concept only | Python3-RESTfulAPI commit d9907f14e9e25dcdb54f5b22252b0e9452e3970e and e772e0beee284c50946e94c54a1d43071ca78b74 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges. |
| CVE-2022-24439 | Critical | 2022-12-06 | Not applicable | No public exploit | All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments. |
| CVE-2022-44049 | Critical | 2022-11-07 | Not applicable | No public exploit | The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-grammars package. The affected version of d8s-htm is 0.1.0. |
| CVE-2022-43305 | Critical | 2022-11-07 | Not applicable | No public exploit | The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-algorithms package. The affected version of d8s-htm is 0.1.0. |
| CVE-2022-37454 | Critical | 2022-10-21 | Not applicable | Proof of concept only | The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface. |
| CVE-2022-39227 | Critical | 2022-09-23 | Not applicable | Proof of concept only | python-jwt is a module for generating and verifying JSON Web Tokens. Versions prior to 3.3.4 are subject to Authentication Bypass by Spoofing, resulting in identity spoofing, session hijacking or authentication bypass. An attacker who obtains a JWT can arbitrarily forge its contents without knowing the secret key. Depending on the application, this may for example enable the attacker to spoof other user's identities, hijack their sessions, or bypass authentication. Users should upgrade to version 3.3.4. There are no known workarounds. |
| CVE-2022-38887 | Critical | 2022-09-19 | Not applicable | No public exploit | The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The democritus-strings package. The affected version is 0.1.0. |
| CVE-2022-31575 | Critical | 2022-07-11 | Not applicable | No public exploit | The duducosmos/livro_python repository through 2018-06-06 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
| CVE-2022-31571 | Critical | 2022-07-11 | Not applicable | No public exploit | The akashtalole/python-flask-restful-api repository through 2019-09-16 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
| CVE-2022-31550 | Critical | 2022-07-11 | Not applicable | No public exploit | The olmax99/pyathenastack repository through 2019-11-08 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
| CVE-2022-31534 | Critical | 2022-07-11 | Not applicable | No public exploit | The echoleegroup/PythonWeb repository through 2018-10-31 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
| CVE-2022-31518 | Critical | 2022-07-11 | Not applicable | No public exploit | The JustAnotherSoftwareDeveloper/Python-Recipe-Database repository through 2021-03-31 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
| CVE-2022-31516 | Critical | 2022-07-11 | Not applicable | No public exploit | The Harveyzyh/Python repository through 2022-05-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
| CVE-2022-30284 | Critical | 2022-05-04 | Not applicable | Proof of concept only | In the python-libnmap package through 0.7.2 for Python, remote command execution can occur (if used in a client application that does not validate arguments). NOTE: the vendor believes it would be unrealistic for an application to call NmapProcess with arguments taken from input data that arrived over an untrusted network, and thus the CVSS score corresponds to an unrealistic use case. None of the NmapProcess documentation implies that this is an expected use case |
| CVE-2021-43572 | Critical | 2021-11-09 | Not applicable | No public exploit | The verify function in the Stark Bank Python ECDSA library (aka starkbank-escada or ecdsa-python) before 2.0.1 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages. |
| CVE-2021-29921 | Critical | 2021-05-06 | Outside Waratek scope | No public exploit | In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses. |
| CVE-2021-3177 | Critical | 2021-01-19 | Outside Waratek scope | Proof of concept only | Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely. |
| CVE-2020-27619 | Critical | 2020-10-22 | Outside Waratek scope | No public exploit | In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP. |
| CVE-2020-25489 | Critical | 2020-09-17 | Not applicable | No public exploit | A heap overflow in Sqreen PyMiniRacer (aka Python Mini Racer) before 0.3.0 allows remote attackers to potentially exploit heap corruption. |
| CVE-2020-15142 | Critical | 2020-08-14 | Not applicable | No public exploit | In openapi-python-client before version 0.5.3, clients generated with a maliciously crafted OpenAPI Document can generate arbitrary Python code. Subsequent execution of this malicious client is arbitrary code execution. |
| CVE-2020-15801 | Critical | 2020-07-17 | Not applicable | No public exploit | In Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The <executable-name>._pth file (e.g., the python._pth file) is not affected. |
| CVE-2014-4650 | Critical | 2020-02-20 | Outside Waratek scope | Working exploit published | The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator. |
| CVE-2019-14859 | Critical | 2020-01-02 | Not applicable | No public exploit | A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. Without this verification, a malformed signature could be accepted, making the signature malleable. Without proper verification, an attacker could use a malleable signature to create false transactions. |
| CVE-2013-2167 | Critical | 2019-12-10 | Not applicable | No public exploit | python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache signing bypass |
| CVE-2013-2166 | Critical | 2019-12-10 | Not applicable | No public exploit | python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache encryption bypass |
| CVE-2009-5042 | Critical | 2019-10-31 | Not applicable | No public exploit | python-docutils allows insecure usage of temporary files |
| CVE-2019-12900 | Critical | 2019-06-19 | Not applicable | No public exploit | BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors. |
| CVE-2019-10160 | Critical | 2019-06-07 | Outside Waratek scope | No public exploit | A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application. |
| CVE-2017-11427 | Critical | 2019-04-17 | Not applicable | Proof of concept only | OneLogin PythonSAML 2.3.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers. |
| CVE-2019-9948 | Critical | 2019-03-23 | Not applicable | No public exploit | urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call. |
| CVE-2019-9636 | Critical | 2019-03-08 | Not applicable | No public exploit | Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9. |
| CVE-2013-5654 | Critical | 2019-02-15 | Not applicable | No public exploit | Vulnerability in YingZhi Python Programming Language v1.9 allows arbitrary anonymous uploads to the phone's storage |
| CVE-2018-1000802 | Critical | 2018-09-18 | Not applicable | No public exploit | Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace. |
| CVE-2016-9063 | Critical | 2018-06-11 | Not applicable | No public exploit | An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50. |
| CVE-2017-1000158 | Critical | 2017-11-17 | Not applicable | No public exploit | CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution) |
| CVE-2017-0906 | Critical | 2017-11-13 | Not applicable | No public exploit | The Recurly Client Python Library before 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, 2.6.2 is vulnerable to a Server-Side Request Forgery vulnerability in the "Resource.get" method that could result in compromise of API keys or other critical resources. |
| CVE-2016-7036 | Critical | 2017-01-23 | Not applicable | No public exploit | python-jose before 1.3.2 allows attackers to have unspecified impact by leveraging failure to use a constant time comparison for HMAC keys. |
| CVE-2016-4972 | Critical | 2016-09-26 | Not applicable | No public exploit | OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), Murano-dashboard before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), and python-muranoclient before 0.7.3 (liberty) and 0.8.x before 0.8.5 (mitaka) improperly use loaders inherited from yaml.Loader when parsing MuranoPL and UI files, which allows remote attackers to create arbitrary Python objects and execute arbitrary code via crafted extended YAML tags in UI definitions in packages. |
| CVE-2016-5636 | Critical | 2016-09-02 | Not applicable | No public exploit | Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 allows remote attackers to have unspecified impact via a negative data size value, which triggers a heap-based buffer overflow. |
| CVE-2016-0718 | Critical | 2016-05-26 | Not applicable | No public exploit | Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow. |
| CVE-2007-4559 | Critical | 2007-08-28 | Not applicable | Proof of concept only | Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267. |