# Python 3.14 3.14.6

Python 3.14 3.14.6, released June 10, 2026, fixes 5 CVEs in Python 3.14 (version 3.14.6). None of them is reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/fix/windows-app/python.python.3.14-3.14.6
- Platform: Windows apps
- Released: Jun 10, 2026
- Priority: High (Closes CVE-2026-7210, high severity)
- CVEs: 5, exploited: 0, on CISA KEV: 0

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [Python 3.14](https://patchblox.com/security/data/product/windows-app/python-3.14.md) |  | 3.14.6 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-7210](https://patchblox.com/security/data/cve/CVE-2026-7210.md) | High | The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection | 7.5 | 0.0067 |  |
| [CVE-2026-9669](https://patchblox.com/security/data/cve/CVE-2026-9669.md) | High | bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow | 8.2 | 0.0043 |  |
| [CVE-2026-7774](https://patchblox.com/security/data/cve/CVE-2026-7774.md) | Routine | tarfile.data_filter path traversal bypass allows writing outside the extraction directory | 6.9 | 0.0060 |  |
| [CVE-2026-3276](https://patchblox.com/security/data/cve/CVE-2026-3276.md) | Routine | Potential DoS via quadratic complexity in unicodedata.normalize() | 6.3 | 0.0049 |  |
| [CVE-2026-8328](https://patchblox.com/security/data/cve/CVE-2026-8328.md) | Routine | FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address | 5.9 | 0.0046 |  |

---

Data as of 2026-11-07T00:32:44Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo