CVE-2022-48560High· 7.5▾ TwilightA use-after-free exists in Python through 3.9 via heappushpop in heapq.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.4 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
1.8%
A use-after-free exists in Python through 3.9 via heappushpop in heapq.
python < 3.6.11python >= 3.7.0, < 3.7.7python >= 3.8.0, < 3.8.2python = 3.9.0debian_linux = 10.0Upgrade past the affected range:
python 3.8.2Connected by shared product, vendor, weakness, or advisory.
CVE-2023-24329High· 7.5An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.
CVE-2022-0391High· 7.5A flaw was found in Python, specifically within the urllib.parse module
CVE-2021-23336Medium· 5.9The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by usi…
CVE-2022-43552Medium· 5.9A use after free vulnerability exists in curl <7.87.0
CVE-2022-45061High· 7.5An issue was discovered in Python before 3.11.1
CVE-2021-28861High· 7.4Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure