# Python 3.13 3.13.14

Python 3.13 3.13.14, released June 10, 2026, fixes 10 CVEs in Python 3.13 (version 3.13.14). None of them is reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/fix/windows-app/python.python.3.13-3.13.14
- Platform: Windows apps
- Released: Jun 10, 2026
- Priority: High (Closes CVE-2026-7210, high severity)
- CVEs: 10, exploited: 0, on CISA KEV: 0

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [Python 3.13](https://patchblox.com/security/data/product/windows-app/python-3.13.md) |  | 3.13.14 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-7210](https://patchblox.com/security/data/cve/CVE-2026-7210.md) | High | The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection | 7.5 | 0.0067 |  |
| [CVE-2026-6100](https://patchblox.com/security/data/cve/CVE-2026-6100.md) | High | Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure | 9.1 | 0.0058 |  |
| [CVE-2026-9669](https://patchblox.com/security/data/cve/CVE-2026-9669.md) | High | bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow | 8.2 | 0.0043 |  |
| [CVE-2026-3298](https://patchblox.com/security/data/cve/CVE-2026-3298.md) | High | Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes | 8.8 | 0.0039 |  |
| [CVE-2026-4786](https://patchblox.com/security/data/cve/CVE-2026-4786.md) | High | Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open() | 7.1 | 0.0029 |  |
| [CVE-2026-7774](https://patchblox.com/security/data/cve/CVE-2026-7774.md) | Routine | tarfile.data_filter path traversal bypass allows writing outside the extraction directory | 6.9 | 0.0060 |  |
| [CVE-2026-1502](https://patchblox.com/security/data/cve/CVE-2026-1502.md) | Routine | HTTP client proxy tunnel headers not validated for CR/LF | 5.7 | 0.0056 |  |
| [CVE-2026-3276](https://patchblox.com/security/data/cve/CVE-2026-3276.md) | Routine | Potential DoS via quadratic complexity in unicodedata.normalize() | 6.3 | 0.0049 |  |
| [CVE-2026-8328](https://patchblox.com/security/data/cve/CVE-2026-8328.md) | Routine | FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address | 5.9 | 0.0046 |  |
| [CVE-2026-6019](https://patchblox.com/security/data/cve/CVE-2026-6019.md) | Routine | BaseCookie.js_output() does not neutralize embedded characters | 6.8 | 0.0021 |  |

---

Data as of 2026-11-07T00:32:44Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo