{
  "product": "Python3",
  "url": "https://patchblox.com/security/product/macos/python3",
  "summary": "The latest version of Python3 is 3.13.13, released April 7, 2026. Patch Radar has 0 security fixes for Python3, closing 0 CVEs. 33 CVEs have no fix yet.",
  "platform": "macos",
  "vendor": "Python Software Foundation",
  "supported": true,
  "latestVersion": "3.13.13",
  "latestReleased": "2026-04-07T13:58:49Z",
  "fixCount": 0,
  "cveCount": 0,
  "exploitedCveCount": 0,
  "unfixedCveCount": 33,
  "fixes": [],
  "noFixYet": [
    {
      "cveId": "CVE-2026-115557",
      "url": "https://patchblox.com/security/cve/CVE-2026-115557",
      "title": "Distrust compromised intermediate certificates in ssl module",
      "priority": "Urgent",
      "status": "no-fix",
      "affectedVersion": "3.13.13"
    },
    {
      "cveId": "CVE-2026-19445",
      "url": "https://patchblox.com/security/cve/CVE-2026-19445",
      "title": "Use-after-free of a server-side SSLContext when sni_callback switches contexts",
      "priority": "Urgent",
      "status": "no-fix",
      "affectedVersion": "3.13.13"
    },
    {
      "cveId": "CVE-2025-15366",
      "url": "https://patchblox.com/security/cve/CVE-2025-15366",
      "title": "IMAP command injection in user-controlled commands",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.13.13"
    },
    {
      "cveId": "CVE-2025-15367",
      "url": "https://patchblox.com/security/cve/CVE-2025-15367",
      "title": "POP3 command injection in user-controlled commands",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.13.13"
    },
    {
      "cveId": "CVE-2026-11940",
      "url": "https://patchblox.com/security/cve/CVE-2026-11940",
      "title": "tarfile extraction filter bypass allows escaping the destination directory",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.13.13"
    },
    {
      "cveId": "CVE-2026-11972",
      "url": "https://patchblox.com/security/cve/CVE-2026-11972",
      "title": "tarfile opened in streaming mode mishandles EOF",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.13.13"
    },
    {
      "cveId": "CVE-2026-15308",
      "url": "https://patchblox.com/security/cve/CVE-2026-15308",
      "title": "Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.13.13"
    },
    {
      "cveId": "CVE-2026-19553",
      "url": "https://patchblox.com/security/cve/CVE-2026-19553",
      "title": "SSLContext.wrap_bio() missing validation of server_hostname parameter",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.13.13"
    },
    {
      "cveId": "CVE-2026-3298",
      "url": "https://patchblox.com/security/cve/CVE-2026-3298",
      "title": "Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.13.13"
    },
    {
      "cveId": "CVE-2026-4786",
      "url": "https://patchblox.com/security/cve/CVE-2026-4786",
      "title": "Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.13.13"
    },
    {
      "cveId": "CVE-2026-6100",
      "url": "https://patchblox.com/security/cve/CVE-2026-6100",
      "title": "Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.13.13"
    },
    {
      "cveId": "CVE-2026-7210",
      "url": "https://patchblox.com/security/cve/CVE-2026-7210",
      "title": "The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.13.13"
    },
    {
      "cveId": "CVE-2026-82049",
      "url": "https://patchblox.com/security/cve/CVE-2026-82049",
      "title": "tarfile extraction filters allow file modification and content disclosure via hard link to symlink",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.13.13"
    },
    {
      "cveId": "CVE-2026-9669",
      "url": "https://patchblox.com/security/cve/CVE-2026-9669",
      "title": "bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.13.13"
    },
    {
      "cveId": "CVE-2024-3220",
      "url": "https://patchblox.com/security/cve/CVE-2024-3220",
      "title": "Default mimetype known files writeable on Windows",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.13.13"
    },
    {
      "cveId": "CVE-2026-0864",
      "url": "https://patchblox.com/security/cve/CVE-2026-0864",
      "title": "Configuration Injection via Carriage Return (\\r) in write() method",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.13.13"
    },
    {
      "cveId": "CVE-2026-103995",
      "url": "https://patchblox.com/security/cve/CVE-2026-103995",
      "title": "Lenient parsing of integers for response body and chunk framing",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.13.13"
    },
    {
      "cveId": "CVE-2026-114583",
      "url": "https://patchblox.com/security/cve/CVE-2026-114583",
      "title": "tar filter allows writing outside destination via empty-named symlink",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.13.13"
    },
    {
      "cveId": "CVE-2026-116566",
      "url": "https://patchblox.com/security/cve/CVE-2026-116566",
      "title": "socket.getaddrinfo() accepts embedded null bytes in host and port",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.13.13"
    },
    {
      "cveId": "CVE-2026-12003",
      "url": "https://patchblox.com/security/cve/CVE-2026-12003",
      "title": "CPython \u003E3.11 Insecure Input Validation resulting in privilege escalation",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.13.13"
    },
    {
      "cveId": "CVE-2026-12345",
      "url": "https://patchblox.com/security/cve/CVE-2026-12345",
      "title": "Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.13.13"
    },
    {
      "cveId": "CVE-2026-1502",
      "url": "https://patchblox.com/security/cve/CVE-2026-1502",
      "title": "HTTP client proxy tunnel headers not validated for CR/LF",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.13.13"
    },
    {
      "cveId": "CVE-2026-15310",
      "url": "https://patchblox.com/security/cve/CVE-2026-15310",
      "title": "zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.13.13"
    },
    {
      "cveId": "CVE-2026-15806",
      "url": "https://patchblox.com/security/cve/CVE-2026-15806",
      "title": "\u0060HTTPPasswordMgr\u0060 can send saved HTTPS credentials via HTTP because of incorrect scheme matching",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.13.13"
    },
    {
      "cveId": "CVE-2026-17084",
      "url": "https://patchblox.com/security/cve/CVE-2026-17084",
      "title": "stringprep.map_table_b2() deviates from RFC 3454 Table B.2",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.13.13"
    },
    {
      "cveId": "CVE-2026-18503",
      "url": "https://patchblox.com/security/cve/CVE-2026-18503",
      "title": "Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.13.13"
    },
    {
      "cveId": "CVE-2026-19672",
      "url": "https://patchblox.com/security/cve/CVE-2026-19672",
      "title": "tarfile extraction filter bypass allows creation of directories outside the destination",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.13.13"
    },
    {
      "cveId": "CVE-2026-3276",
      "url": "https://patchblox.com/security/cve/CVE-2026-3276",
      "title": "Potential DoS via quadratic complexity in unicodedata.normalize()",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.13.13"
    },
    {
      "cveId": "CVE-2026-6019",
      "url": "https://patchblox.com/security/cve/CVE-2026-6019",
      "title": "BaseCookie.js_output() does not neutralize embedded characters",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.13.13"
    },
    {
      "cveId": "CVE-2026-6879",
      "url": "https://patchblox.com/security/cve/CVE-2026-6879",
      "title": "Quadratic Behavior in xml.etree.ElementPath Index Predicates",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.13.13"
    },
    {
      "cveId": "CVE-2026-7774",
      "url": "https://patchblox.com/security/cve/CVE-2026-7774",
      "title": "tarfile.data_filter path traversal bypass allows writing outside the extraction directory",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.13.13"
    },
    {
      "cveId": "CVE-2026-8328",
      "url": "https://patchblox.com/security/cve/CVE-2026-8328",
      "title": "FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.13.13"
    },
    {
      "cveId": "CVE-2026-87910",
      "url": "https://patchblox.com/security/cve/CVE-2026-87910",
      "title": "tarfile hardlink fallback ignores custom extraction filter rejection via None",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.13.13"
    }
  ],
  "dataAsOf": "2026-11-07T00:32:44Z"
}