Windows apps · Application version · June 10, 2026

Python 3.13 3.13.14

Python 3.13 3.13.14, released June 10, 2026, fixes 10 CVEs in Python 3.13 (version 3.13.14). None of them is reported as exploited. Patch Radar priority: High.

High

CVEs closed

None rated Critical

Exploited

None reported

Exploitation more likely

Vendor assessment

Highest EPSS

0.0067

52nd percentile

Priority of the 10 CVEs

Patch now 0
                                Urgent 0
                                High 5
                                Routine 5

Applies to

Product	Version
Python 3.13	3.13.14

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
High	CVE-2026-7210	The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection	7.5	0.0067	None reported
High	CVE-2026-6100	Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure	9.1	0.0058	None reported
High	CVE-2026-9669	bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow	8.2	0.0043	None reported
High	CVE-2026-3298	Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes	8.8	0.0039	None reported
High	CVE-2026-4786	Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()	7.1	0.0029	None reported
Routine	CVE-2026-7774	tarfile.data_filter path traversal bypass allows writing outside the extraction directory	6.9	0.0060	None reported
Routine	CVE-2026-1502	HTTP client proxy tunnel headers not validated for CR/LF	5.7	0.0056	None reported
Routine	CVE-2026-3276	Potential DoS via quadratic complexity in unicodedata.normalize()	6.3	0.0049	None reported
Routine	CVE-2026-8328	FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address	5.9	0.0046	None reported
Routine	CVE-2026-6019	BaseCookie.js_output() does not neutralize embedded characters	6.8	0.0021	None reported