Readthedocs
python-security.readthedocs.io › vulnerabilities.html
Python Security Vulnerabilities — Python Security 0.0 documentation
The canonical database for vulnerabilities affecting Python is available on GitHub in the Open Source Vulnerability (OSV) format. This database can be viewed online at the Open Source Vulnerability Database. Status of Python branches lists Python branches which get security fixes.
Python
python.org › dev › security
Python Security | Python.org
A Python Security Response Team (PSRT) has been formed that does triage on all reported vulnerabilities and works to resolve them. To reach the response team, send email to security ...
Videos
03:00
How Can I Find Security Vulnerabilities In Python Libraries? - ...
06:00
Why Python apps are becoming less secure - YouTube
53:51
Python Security Best Practices Against Vulnerabilities | Ukanah ...
r/Python on Reddit: 5 Lesser Known Python Security Vulnerabilities
43:27
Python Coding Mistakes, Causes of Vulnerabilities and How to Solve ...
15:11
What's wrong with this Code? Vulnerable Python Code - Walkthrough ...
Reddit
reddit.com › r/learnpython › potential security risks of using python at work
r/learnpython on Reddit: Potential Security Risks of using Python at Work
January 21, 2025 -
So I wanted to install Python, download Selenium library on it, and combine it with Webdriver to access web-driven accounting software to automate some stuff; mainly downloading reports from the accounting software since there are tones of reports to download every month, which the software does not have automation function for. I don't want to deal with any data.
Senior director and I went to IT for the request to download Python and they declined; they said there is a security risk.
Does anyone know what potential security risks they are referring to? I don't have cs background so I'm not very sure. And is there a way to mitigate those risks?
Top answer 1 of 5
12
A few people have given plausible guesses, but the fact is we can't know how to answer this because we don't know where you work, what systems you're trying to install python and what the security requirements of those systems are. There are a million possible reasons the IT people responsible for security might not want a general-purpose programming environment on a given system. Unfortunately, you have to ask them which ones they are actually concerned about.
2 of 5
11
I feel like you should be asking your IT, not reddit. Regardless, you're using open source resources, if those get compromised, who will be responsible? It would be IT, because they were the ones to allow it. If your senior director is willing to sign some paperwork, placing all financial data breaches due to the use of your tool as their responsibility, then I'm certain IT would be more willing. My additional guess, is that your senior director will not sign such paperwork either.
Aqua Security
aquasec.com › home › application security › python security
Python Security: 6 Common Risks & What You Can Do About Them
July 23, 2024 - ... Injection flaws allow an attacker to deliver malicious code through an application to a backend or internal system. Injection vulnerabilities are common in Python, and come in several types such as command injection and SQL injection.
GuardRails
guardrails.io › blog › how-to-detect-and-fix-the-five-most-common-python-security-vulnerabilities
How To Detect and Fix the Five Most Common Python Security Vulnerabilities - GuardRails
February 27, 2023 - Python is one of the biggest programming languages used today. Here are five of its most common security vulnerabilities and how to detect them.
CVE Details
cvedetails.com › vulnerability-list › vendor_id-10210 › product_id-18230 › Python-Python.html
Python Python : Security vulnerabilities, CVEs
This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie "./venv/bin/python") are not affected. ... There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path".
Aikido
aikido.dev › home › articles › top 10 python security vulnerabilities developers should avoid
Python Security Vulnerabilities | Top Issues
January 29, 2026 - A practical overview of the most common Python security vulnerabilities, insecure patterns, and dependency-related risks.
Stack
stack.watch › product › python › python
Python Security Vulnerabilities in 2026 - stack.watch
In 2026 there have been 0 vulnerabilities in Python. Last year, in 2025 Python had 12 security vulnerabilities published.
CVE Details
cvedetails.com › product › 18230 › Python-Python.html
Python Python security vulnerabilities, CVEs, versions and CVE reports
Python Python security vulnerabilities, CVEs, exploits, metasploit modules, vulnerability statistics and list of versions
Security Compass
securitycompass.com › home › kontra › is python secure?
Is Python Secure? - Kontra Hands-on Labs
November 11, 2025 - For instance, a web application that takes user input to create a SQL query can be vulnerable if that input isn’t properly sanitized. Insecure Third-Party Libraries: Python’s rich ecosystem of third-party libraries is one of its greatest ...
Maikuolan
maikuolan.github.io › Vulnerability-Charts › python.html
Vulnerability Charts – Python
A chart of which Python versions are safe/unsafe, and their CVSS.
Python
docs.python.org › 3 › library › security_warnings.html
Security Considerations — Python 3.14.3 documentation
subprocess: Subprocess security considerations · tempfile: mktemp is deprecated due to vulnerability to race conditions · xml: XML security · zipfile: maliciously prepared .zip files can cause disk volume exhaustion · The -I command line option can be used to run Python in isolated mode.
GitHub
github.com › pyupio › safety
GitHub - pyupio/safety: Safety checks Python dependencies for known security vulnerabilities and suggests the proper remediations for vulnerabilities detected. · GitHub
Leveraging the industry's most comprehensive database of vulnerabilities and malicious packages, Safety CLI Scanner allows teams to detect vulnerabilities at every stage of the software development lifecycle. Versatile, comprehensive dependency security scanning for Python packages.
Starred by 2K users
Forked by 178 users
Languages Python 97.3% | HTML 2.3%
Safety
getsafety.com › blog-posts › python-security-best-practices-for-developers
Python Security: Best Practices for Developers | Safety Blog
Safety gives security teams real-time visibility and governance over every AI tool, package, MCP server, and IDE extension across their developer fleet.
Red Hat
redhat.com › en › blog › find-python-vulnerabilities
How to find third-party vulnerabilities in your Python code
November 20, 2025 - A good project keeps versions up to date when a vulnerability is found, and tools like pip-audit make this job easier. Here's how to use pip-audit to scan your Python project and learn whether any of your third-party libraries have known vulnerabilities with CVE identifiers.
CVE
cve.org › CVERecord › SearchResults
CVE Search: Python
Common vulnerabilities and Exposures (CVE) · We're sorry but the CVE Website doesn't work properly without JavaScript enabled. Please enable it to continue
CVE Details
cvedetails.com › version › 1371175 › Python-Python-3.10.4.html
Python Python 3.10.4 security vulnerabilities, CVEs
Python Python version 3.10.4 security vulnerabilities, CVEs, exploits, vulnerability statistics, CVSS scores and references
Reddit
reddit.com › r/python › corporate it have banned all versions of python lower than the latest
r/Python on Reddit: Corporate IT have banned all versions of python lower than the latest
November 21, 2023 -
I.e. right now they are insisting we use v3.12 only because older versions have some vulnerabilities their scanner picked up.
I need to somehow explain that this is a terrible idea and that many packages won't support the most up to date version without causing them to panic and overstep even more.
This requirement is company wide (affects development, data science and analytics).
Edit - thanks for all the advice, I think the crux is that they don't understand how the versioning works and are confusing major and minor versions. I will explain this and hopefully we will be able to use the latest minor versions for 3.11/3.10/3.9
Top answer 1 of 5
707
Don't know what your environments look like, but we upgraded almost all of ours to 3.12, I would definitely recommend it. Most packages are already up to date. That being said, if IT doesn't understand why you might need to run 3.11 for some packages, can't you simply provide them a list of the packages that don't support 3.12 and tell them you'll upgrade those systems when their dependencies catch up?
2 of 5
159
And yet some corporate IT have also banned all Python newer than 2.7.
PyPI
pypi.org › project › safety
safety · PyPI
Leveraging the industry's most comprehensive database of vulnerabilities and malicious packages, Safety CLI Scanner allows teams to detect vulnerabilities at every stage of the software development lifecycle. Versatile, comprehensive dependency security scanning for Python packages.
» pip install safety
Published Nov 06, 2025
Version 3.7.0
Cisco Blogs
blogs.cisco.com › cisco blogs › developer › 5 python security traps you need to avoid
5 Python Security Traps You Need to Avoid
March 30, 2022 - As example Python library, the Requests package (who doesn’t use this one?) before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network. ... This vulnerability can be fixed by updating (and testing!) all the packages for which updates are available. (DUH!) You can also use tools to help with this after the fact: Static application security testing (SAST) – static test that happens without executing the code.