Windows apps · Application version · June 10, 2026

Python 3.14 3.14.6

Python 3.14 3.14.6, released June 10, 2026, fixes 5 CVEs in Python 3.14 (version 3.14.6). None of them is reported as exploited. Patch Radar priority: High.

High

CVEs closed

None rated Critical

Exploited

None reported

Exploitation more likely

Vendor assessment

Highest EPSS

0.0067

52nd percentile

Priority of the 5 CVEs

Patch now 0
                                Urgent 0
                                High 2
                                Routine 3

Applies to

Product	Version
Python 3.14	3.14.6

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
High	CVE-2026-7210	The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection	7.5	0.0067	None reported
High	CVE-2026-9669	bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow	8.2	0.0043	None reported
Routine	CVE-2026-7774	tarfile.data_filter path traversal bypass allows writing outside the extraction directory	6.9	0.0060	None reported
Routine	CVE-2026-3276	Potential DoS via quadratic complexity in unicodedata.normalize()	6.3	0.0049	None reported
Routine	CVE-2026-8328	FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address	5.9	0.0046	None reported