{
  "product": "Python 3.6",
  "url": "https://patchblox.com/security/product/windows-app/python-3.6",
  "summary": "The latest version of Python 3.6 is 3.6.8, released December 23, 2018. Patch Radar has 5 security fixes for Python 3.6, closing 11 CVEs. The newest security fix is Python 3.6 3.6.7, released October 20, 2018. Version 3.6.8 adds no new CVE fixes and includes all of them. 113 CVEs have no fix yet.",
  "platform": "windows-app",
  "vendor": "Python Software Foundation",
  "supported": true,
  "latestVersion": "3.6.8",
  "latestReleased": "2018-12-23T00:00:00Z",
  "latestIncludesAllFixes": true,
  "fixCount": 5,
  "cveCount": 11,
  "exploitedCveCount": 0,
  "unfixedCveCount": 113,
  "fixes": [
    {
      "fix": "Python 3.6 3.6.7",
      "url": "https://patchblox.com/security/fix/windows-app/python.python.3.6-3.6.7",
      "released": "2018-10-20T00:00:00Z",
      "fixedVersion": "3.6.7",
      "priority": "High",
      "cveCount": 1,
      "exploitedCveCount": 0
    },
    {
      "fix": "Python 3.6 3.6.5",
      "url": "https://patchblox.com/security/fix/windows-app/python.python.3.6-3.6.5",
      "released": "2018-03-28T00:00:00Z",
      "fixedVersion": "3.6.5",
      "priority": "High",
      "cveCount": 4,
      "exploitedCveCount": 0
    },
    {
      "fix": "Python 3.6 3.6.4",
      "url": "https://patchblox.com/security/fix/windows-app/python.python.3.6-3.6.4",
      "released": "2017-12-18T00:00:00Z",
      "fixedVersion": "3.6.4",
      "priority": "High",
      "cveCount": 1,
      "exploitedCveCount": 0
    },
    {
      "fix": "Python 3.6 3.6.2",
      "url": "https://patchblox.com/security/fix/windows-app/python.python.3.6-3.6.2",
      "released": "2017-07-17T00:00:00Z",
      "fixedVersion": "3.6.2",
      "priority": "Urgent",
      "cveCount": 4,
      "exploitedCveCount": 0
    },
    {
      "fix": "Python 3.6 3.6.1",
      "url": "https://patchblox.com/security/fix/windows-app/python.python.3.6-3.6.1",
      "released": "2017-03-21T00:00:00Z",
      "fixedVersion": "3.6.1",
      "priority": "High",
      "cveCount": 1,
      "exploitedCveCount": 0
    }
  ],
  "noFixYet": [
    {
      "cveId": "CVE-2026-115557",
      "url": "https://patchblox.com/security/cve/CVE-2026-115557",
      "title": "Distrust compromised intermediate certificates in ssl module",
      "priority": "Urgent",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2026-19445",
      "url": "https://patchblox.com/security/cve/CVE-2026-19445",
      "title": "Use-after-free of a server-side SSLContext when sni_callback switches contexts",
      "priority": "Urgent",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2007-4559",
      "url": "https://patchblox.com/security/cve/CVE-2007-4559",
      "title": "Python 3.10 and 8 others: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2018-20406",
      "url": "https://patchblox.com/security/cve/CVE-2018-20406",
      "title": "Python 3.6 and 2 others: Modules/_pickle.c in Python before 3.7.1 has an integer overflow via a large LONG_BINPUT value that is\u2026",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2019-15903",
      "url": "https://patchblox.com/security/cve/CVE-2019-15903",
      "title": "Python 3.6 and 2 others: Out-of-bounds Read",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2019-16056",
      "url": "https://patchblox.com/security/cve/CVE-2019-16056",
      "title": "Python 3.6 and 2 others: Improper Input Validation",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2019-20907",
      "url": "https://patchblox.com/security/cve/CVE-2019-20907",
      "title": "Python 3.6 and 3 others: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2019-5010",
      "url": "https://patchblox.com/security/cve/CVE-2019-5010",
      "title": "Python 3.6 and 2 others: NULL Pointer Dereference",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2019-9674",
      "url": "https://patchblox.com/security/cve/CVE-2019-9674",
      "title": "Python 3.7 and 3 others: Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource\u2026",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2019-9948",
      "url": "https://patchblox.com/security/cve/CVE-2019-9948",
      "title": "Python 3.6 and 2 others: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2020-15523",
      "url": "https://patchblox.com/security/cve/CVE-2020-15523",
      "title": "Python 3.6 and 3 others: In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows,\u2026",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2020-26116",
      "url": "https://patchblox.com/security/cve/CVE-2020-26116",
      "title": "Python 3.6 and 3 others: http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5\u2026",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2020-27619",
      "url": "https://patchblox.com/security/cve/CVE-2020-27619",
      "title": "Python 3.7 and 3 others: In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content\u2026",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2021-23336",
      "url": "https://patchblox.com/security/cve/CVE-2021-23336",
      "title": "Web Cache Poisoning",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2021-28861",
      "url": "https://patchblox.com/security/cve/CVE-2021-28861",
      "title": "Python 3.8 and 7 others: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2021-3177",
      "url": "https://patchblox.com/security/cve/CVE-2021-3177",
      "title": "Python 3.7 and 2 others: Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2021-3426",
      "url": "https://patchblox.com/security/cve/CVE-2021-3426",
      "title": "Python 3.7 and 3 others: There\u0027s a flaw in Python 3\u0027s pydoc.",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2021-3733",
      "url": "https://patchblox.com/security/cve/CVE-2021-3733",
      "title": "Python 3.7 and 5 others: Uncontrolled Resource Consumption",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2021-3737",
      "url": "https://patchblox.com/security/cve/CVE-2021-3737",
      "title": "Python 3.8 and 2 others: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027), CWE-400 - Uncontrolled Resource Consumption",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2021-4189",
      "url": "https://patchblox.com/security/cve/CVE-2021-4189",
      "title": "Python 3.7 and 3 others: Unchecked Return Value",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2022-0391",
      "url": "https://patchblox.com/security/cve/CVE-2022-0391",
      "title": "Python 3.8 and 5 others: A flaw was found in Python, specifically within the urllib.parse module.",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2022-26488",
      "url": "https://patchblox.com/security/cve/CVE-2022-26488",
      "title": "Python 3.8 and 8 others: In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately\u2026",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2022-37454",
      "url": "https://patchblox.com/security/cve/CVE-2022-37454",
      "title": "Python 3.8 and 5 others: Integer Overflow or Wraparound",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2022-48560",
      "url": "https://patchblox.com/security/cve/CVE-2022-48560",
      "title": "Python 3.6 and 4 others: A use-after-free exists in Python through 3.9 via heappushpop in heapq.",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2022-48565",
      "url": "https://patchblox.com/security/cve/CVE-2022-48565",
      "title": "Python 3.7 and 4 others: An XML External Entity (XXE) issue was discovered in Python through 3.9.1.",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2023-24329",
      "url": "https://patchblox.com/security/cve/CVE-2023-24329",
      "title": "Python 3.10 and 8 others: Improper Input Validation",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2023-36632",
      "url": "https://patchblox.com/security/cve/CVE-2023-36632",
      "title": "Python 3.10 and 8 others: The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger \u0022RecursionError:\u2026",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2023-40217",
      "url": "https://patchblox.com/security/cve/CVE-2023-40217",
      "title": "Python 3.10 and 8 others: An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x\u2026",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2023-6597",
      "url": "https://patchblox.com/security/cve/CVE-2023-6597",
      "title": "Python 3.10 and 9 others: An issue was found in the CPython \u0060tempfile.TemporaryDirectory\u0060 class affecting versions 3.12.1, 3.11.7,\u2026",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2024-0397",
      "url": "https://patchblox.com/security/cve/CVE-2024-0397",
      "title": "Memory race condition in ssl.SSLContext certificate store methods",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2024-11168",
      "url": "https://patchblox.com/security/cve/CVE-2024-11168",
      "title": "Improper validation of IPv6 and IPvFuture addresses",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2024-12254",
      "url": "https://patchblox.com/security/cve/CVE-2024-12254",
      "title": "Unbounded memory buffering in SelectorSocketTransport.writelines()",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2024-12718",
      "url": "https://patchblox.com/security/cve/CVE-2024-12718",
      "title": "Bypass extraction filter to modify file metadata outside extraction directory",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2024-4030",
      "url": "https://patchblox.com/security/cve/CVE-2024-4030",
      "title": "tempfile.mkdtemp() may be readable and writeable by all users on Windows",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2024-4032",
      "url": "https://patchblox.com/security/cve/CVE-2024-4032",
      "title": "Incorrect IPv4 and IPv6 private ranges",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2024-5642",
      "url": "https://patchblox.com/security/cve/CVE-2024-5642",
      "title": "Buffer overread when using an empty list with SSLContext.set_npn_protocols()",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2024-6232",
      "url": "https://patchblox.com/security/cve/CVE-2024-6232",
      "title": "Regular-expression DoS when parsing TarFile headers",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2024-6923",
      "url": "https://patchblox.com/security/cve/CVE-2024-6923",
      "title": "Email header injection due to unquoted newlines",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2024-7592",
      "url": "https://patchblox.com/security/cve/CVE-2024-7592",
      "title": "Quadratic complexity parsing cookies with backslashes",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2024-8088",
      "url": "https://patchblox.com/security/cve/CVE-2024-8088",
      "title": "Infinite loop when iterating over zip archive entry names from zipfile.Path",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2024-9287",
      "url": "https://patchblox.com/security/cve/CVE-2024-9287",
      "title": "Virtual environment (venv) activation scripts don\u0027t quote paths",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2025-0938",
      "url": "https://patchblox.com/security/cve/CVE-2025-0938",
      "title": "URL parser allowed square brackets in domain names",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2025-12084",
      "url": "https://patchblox.com/security/cve/CVE-2025-12084",
      "title": "Quadratic complexity in node ID cache clearing",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2025-13836",
      "url": "https://patchblox.com/security/cve/CVE-2025-13836",
      "title": "Excessive read buffering DoS in http.client",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2025-13837",
      "url": "https://patchblox.com/security/cve/CVE-2025-13837",
      "title": "Out-of-memory when loading Plist",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2025-15282",
      "url": "https://patchblox.com/security/cve/CVE-2025-15282",
      "title": "Header injection via newlines in data URL mediatype",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2025-15366",
      "url": "https://patchblox.com/security/cve/CVE-2025-15366",
      "title": "IMAP command injection in user-controlled commands",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2025-15367",
      "url": "https://patchblox.com/security/cve/CVE-2025-15367",
      "title": "POP3 command injection in user-controlled commands",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2025-4138",
      "url": "https://patchblox.com/security/cve/CVE-2025-4138",
      "title": "Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2025-4330",
      "url": "https://patchblox.com/security/cve/CVE-2025-4330",
      "title": "Extraction filter bypass for linking outside extraction directory",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2025-4435",
      "url": "https://patchblox.com/security/cve/CVE-2025-4435",
      "title": "Tarfile extracts filtered members when errorlevel=0",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2025-4516",
      "url": "https://patchblox.com/security/cve/CVE-2025-4516",
      "title": "Use-after-free in \u0022unicode_escape\u0022 decoder with error handler",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2025-4517",
      "url": "https://patchblox.com/security/cve/CVE-2025-4517",
      "title": "Arbitrary writes via tarfile realpath overflow",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2025-6075",
      "url": "https://patchblox.com/security/cve/CVE-2025-6075",
      "title": "Quadratic complexity in os.path.expandvars() with user-controlled template",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2025-8194",
      "url": "https://patchblox.com/security/cve/CVE-2025-8194",
      "title": "Tarfile infinite loop during parsing with negative member offset",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2025-8291",
      "url": "https://patchblox.com/security/cve/CVE-2025-8291",
      "title": "ZIP64 End of Central Directory (EOCD) Locator record offset not checked",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2026-0672",
      "url": "https://patchblox.com/security/cve/CVE-2026-0672",
      "title": "Header injection in http.cookies.Morsel",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2026-0865",
      "url": "https://patchblox.com/security/cve/CVE-2026-0865",
      "title": "wsgiref.headers.Headers allows header newline injection",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2026-11940",
      "url": "https://patchblox.com/security/cve/CVE-2026-11940",
      "title": "tarfile extraction filter bypass allows escaping the destination directory",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2026-11972",
      "url": "https://patchblox.com/security/cve/CVE-2026-11972",
      "title": "tarfile opened in streaming mode mishandles EOF",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2026-12345",
      "url": "https://patchblox.com/security/cve/CVE-2026-12345",
      "title": "Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2026-1299",
      "url": "https://patchblox.com/security/cve/CVE-2026-1299",
      "title": "email BytesGenerator header injection due to unquoted newlines",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2026-1502",
      "url": "https://patchblox.com/security/cve/CVE-2026-1502",
      "title": "HTTP client proxy tunnel headers not validated for CR/LF",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2026-15308",
      "url": "https://patchblox.com/security/cve/CVE-2026-15308",
      "title": "Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2026-19553",
      "url": "https://patchblox.com/security/cve/CVE-2026-19553",
      "title": "SSLContext.wrap_bio() missing validation of server_hostname parameter",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2026-2297",
      "url": "https://patchblox.com/security/cve/CVE-2026-2297",
      "title": "SourcelessFileLoader does not use io.open_code()",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2026-3298",
      "url": "https://patchblox.com/security/cve/CVE-2026-3298",
      "title": "Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2026-3644",
      "url": "https://patchblox.com/security/cve/CVE-2026-3644",
      "title": "Incomplete control character validation in http.cookies",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2026-4224",
      "url": "https://patchblox.com/security/cve/CVE-2026-4224",
      "title": "Stack overflow parsing XML with deeply nested DTD content models",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2026-4519",
      "url": "https://patchblox.com/security/cve/CVE-2026-4519",
      "title": "webbrowser.open() allows leading dashes in URLs",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2026-4786",
      "url": "https://patchblox.com/security/cve/CVE-2026-4786",
      "title": "Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2026-6019",
      "url": "https://patchblox.com/security/cve/CVE-2026-6019",
      "title": "BaseCookie.js_output() does not neutralize embedded characters",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2026-6100",
      "url": "https://patchblox.com/security/cve/CVE-2026-6100",
      "title": "Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2026-7210",
      "url": "https://patchblox.com/security/cve/CVE-2026-7210",
      "title": "The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2026-82049",
      "url": "https://patchblox.com/security/cve/CVE-2026-82049",
      "title": "tarfile extraction filters allow file modification and content disclosure via hard link to symlink",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2026-9669",
      "url": "https://patchblox.com/security/cve/CVE-2026-9669",
      "title": "bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow",
      "priority": "High",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2013-0340",
      "url": "https://patchblox.com/security/cve/CVE-2013-0340",
      "title": "Python 3.8 and 3 others: expat before version 2.4.0 does not properly handle entities expansion unless an application developer\u2026",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2018-20852",
      "url": "https://patchblox.com/security/cve/CVE-2018-20852",
      "title": "Python 3.6 and 2 others: Improper Input Validation",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2019-16935",
      "url": "https://patchblox.com/security/cve/CVE-2019-16935",
      "title": "Python 3.6 and 2 others: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2019-18348",
      "url": "https://patchblox.com/security/cve/CVE-2019-18348",
      "title": "Python 3.6 and 3 others: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2019-9740",
      "url": "https://patchblox.com/security/cve/CVE-2019-9740",
      "title": "Python 3.6 and 2 others: Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2019-9947",
      "url": "https://patchblox.com/security/cve/CVE-2019-9947",
      "title": "Python 3.6 and 2 others: Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2020-14422",
      "url": "https://patchblox.com/security/cve/CVE-2020-14422",
      "title": "Python 3.6 and 3 others: Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface\u2026",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2020-8315",
      "url": "https://patchblox.com/security/cve/CVE-2020-8315",
      "title": "Python 3.6 and 2 others: In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency\u2026",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2020-8492",
      "url": "https://patchblox.com/security/cve/CVE-2020-8492",
      "title": "Python 3.6 and 3 others: Uncontrolled Resource Consumption",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2022-48564",
      "url": "https://patchblox.com/security/cve/CVE-2022-48564",
      "title": "Python 3.7 and 4 others: read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and\u2026",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2022-48566",
      "url": "https://patchblox.com/security/cve/CVE-2022-48566",
      "title": "Python 3.7 and 4 others: An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1.",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2023-27043",
      "url": "https://patchblox.com/security/cve/CVE-2023-27043",
      "title": "Python 3.10 and 8 others: Improper Input Validation",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2024-0450",
      "url": "https://patchblox.com/security/cve/CVE-2024-0450",
      "title": "Quoted zip-bomb protection for zipfile",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2024-3219",
      "url": "https://patchblox.com/security/cve/CVE-2024-3219",
      "title": "Pure-Python fallback of socket.socketpair() doesn\u2019t authenticate peer connection",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2024-3220",
      "url": "https://patchblox.com/security/cve/CVE-2024-3220",
      "title": "Default mimetype known files writeable on Windows",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2025-11468",
      "url": "https://patchblox.com/security/cve/CVE-2025-11468",
      "title": "Folding email comments of unfoldable characters doesn\u0027t preserve parenthesis",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2025-12781",
      "url": "https://patchblox.com/security/cve/CVE-2025-12781",
      "title": "base64.b64decode() always accepts \u0022\u002B/\u0022 characters, despite setting altchars",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2025-13462",
      "url": "https://patchblox.com/security/cve/CVE-2025-13462",
      "title": "tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2025-1795",
      "url": "https://patchblox.com/security/cve/CVE-2025-1795",
      "title": "Mishandling of comma during folding and unicode-encoding of email headers",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2026-0864",
      "url": "https://patchblox.com/security/cve/CVE-2026-0864",
      "title": "Configuration Injection via Carriage Return (\\r) in write() method",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2026-103995",
      "url": "https://patchblox.com/security/cve/CVE-2026-103995",
      "title": "Lenient parsing of integers for response body and chunk framing",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2026-114583",
      "url": "https://patchblox.com/security/cve/CVE-2026-114583",
      "title": "tar filter allows writing outside destination via empty-named symlink",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2026-116566",
      "url": "https://patchblox.com/security/cve/CVE-2026-116566",
      "title": "socket.getaddrinfo() accepts embedded null bytes in host and port",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2026-12003",
      "url": "https://patchblox.com/security/cve/CVE-2026-12003",
      "title": "CPython \u003E3.11 Insecure Input Validation resulting in privilege escalation",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2026-15310",
      "url": "https://patchblox.com/security/cve/CVE-2026-15310",
      "title": "zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2026-15806",
      "url": "https://patchblox.com/security/cve/CVE-2026-15806",
      "title": "\u0060HTTPPasswordMgr\u0060 can send saved HTTPS credentials via HTTP because of incorrect scheme matching",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2026-17084",
      "url": "https://patchblox.com/security/cve/CVE-2026-17084",
      "title": "stringprep.map_table_b2() deviates from RFC 3454 Table B.2",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2026-18503",
      "url": "https://patchblox.com/security/cve/CVE-2026-18503",
      "title": "Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2026-19672",
      "url": "https://patchblox.com/security/cve/CVE-2026-19672",
      "title": "tarfile extraction filter bypass allows creation of directories outside the destination",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2026-3087",
      "url": "https://patchblox.com/security/cve/CVE-2026-3087",
      "title": "shutil.unpack_archive() doesn\u0027t check for Windows absolute paths in ZIPs",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2026-3276",
      "url": "https://patchblox.com/security/cve/CVE-2026-3276",
      "title": "Potential DoS via quadratic complexity in unicodedata.normalize()",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2026-3446",
      "url": "https://patchblox.com/security/cve/CVE-2026-3446",
      "title": "Base64 decoding stops at first padded quad by default",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2026-3479",
      "url": "https://patchblox.com/security/cve/CVE-2026-3479",
      "title": "pkgutil.get_data() does not enforce documented restrictions",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2026-6879",
      "url": "https://patchblox.com/security/cve/CVE-2026-6879",
      "title": "Quadratic Behavior in xml.etree.ElementPath Index Predicates",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2026-7774",
      "url": "https://patchblox.com/security/cve/CVE-2026-7774",
      "title": "tarfile.data_filter path traversal bypass allows writing outside the extraction directory",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2026-8328",
      "url": "https://patchblox.com/security/cve/CVE-2026-8328",
      "title": "FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "cveId": "CVE-2026-87910",
      "url": "https://patchblox.com/security/cve/CVE-2026-87910",
      "title": "tarfile hardlink fallback ignores custom extraction filter rejection via None",
      "priority": "Routine",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    }
  ],
  "dataAsOf": "2026-11-07T12:40:37Z"
}