CVE-2026-4519Low· 3.3▾ SunlitThe webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 18.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().
python < 3.13.13python >= 3.14.0, < 3.14.4python = 3.15.0Upgrade past the affected range:
python 3.14.4Connected by shared product, vendor, weakness, or advisory.
CVE-2026-4224High· 7.5When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.
CVE-2026-40192High· 7.5Pillow is a Python imaging library
CVE-2025-13462Low· 3.3The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK
CVE-2026-3644High· 7.5The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete
CVE-2025-13837Medium· 5.5When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues
CVE-2025-13836High· 7.5When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length