Windows apps · Application version · August 5, 2026

Python 3.14 3.14.7

Python 3.14 3.14.7, released August 5, 2026, fixes 8 CVEs in Python 3.14 (version 3.14.7). None of them is reported as exploited. Patch Radar priority: High.

High

CVEs closed

None rated Critical

Exploited

None reported

Exploitation more likely

Vendor assessment

Highest EPSS

0.0075

55th percentile

Priority of the 8 CVEs

Patch now 0
                                Urgent 0
                                High 4
                                Routine 4

Applies to

Product	Version
Python 3.14	3.14.7

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
High	CVE-2026-11940	tarfile extraction filter bypass allows escaping the destination directory	7.8	0.0075	None reported
High	CVE-2026-11972	tarfile opened in streaming mode mishandles EOF	8.2	0.0072	None reported
High	CVE-2026-15308	Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations	8.7	0.0064	None reported
High	CVE-2025-15366	IMAP command injection in user-controlled commands	7.1	0.0043	None reported
Routine	CVE-2026-6879	Quadratic Behavior in xml.etree.ElementPath Index Predicates	2.0	0.0036	None reported
Routine	CVE-2026-12003	CPython >3.11 Insecure Input Validation resulting in privilege escalation	5.3	0.0014	None reported
Routine	CVE-2026-0864	Configuration Injection via Carriage Return (\r) in write() method	5.5	0.0013	None reported
Routine	CVE-2026-18503	Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()	2.4	0.0012	None reported