Windows apps · Application version · August 5, 2026
Python 3.13 3.13.15
Python 3.13 3.13.15, released August 5, 2026, fixes 8 CVEs in Python 3.13 (version 3.13.15). None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
8
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0075
55th percentile
Priority of the 8 CVEs
Patch now 0
Urgent 0
High 4
Routine 4
Applies to
| Product | Version |
|---|---|
| Python 3.13 | 3.13.15 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| High | CVE-2026-11940 | tarfile extraction filter bypass allows escaping the destination directory | 7.8 | 0.0075 | None reported | |
| High | CVE-2026-11972 | tarfile opened in streaming mode mishandles EOF | 8.2 | 0.0072 | None reported | |
| High | CVE-2026-15308 | Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations | 8.7 | 0.0064 | None reported | |
| High | CVE-2025-15366 | IMAP command injection in user-controlled commands | 7.1 | 0.0043 | None reported | |
| Routine | CVE-2026-6879 | Quadratic Behavior in xml.etree.ElementPath Index Predicates | 2.0 | 0.0036 | None reported | |
| Routine | CVE-2026-12003 | CPython >3.11 Insecure Input Validation resulting in privilege escalation | 5.3 | 0.0014 | None reported | |
| Routine | CVE-2026-0864 | Configuration Injection via Carriage Return (\r) in write() method | 5.5 | 0.0013 | None reported | |
| Routine | CVE-2026-18503 | Super-linear CPU usage for unbounded input to csv.Sniffer.sniff() | 2.4 | 0.0012 | None reported |
Showing 1 to 8 of 8
1