Real-time CVE monitoring

CVE alerts for
Python

CVEye scans every new CVE and notifies your team the moment Python is affected — before attackers can exploit it.

Monitor Python free →No credit card · 7-day trial

Recent Python CVEs

  • CVE-2026-63720HIGHCVSS 7.5

    datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value is emitted verbatim into a generated 'from ... import ...' statement without identifier validation, causing arbitrary Python code to execute when the generated module is imported.

  • CVE-2025-71408HIGHCVSS 7.8

    NLTK (Natural Language Toolkit) before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arbitrary Python code. When collocations.py is invoked directly, the __main__ block passes command-line arguments directly to eval() as suffixes of BigramAssocMeasures without allowlist validation or sanitization, enabling an attacker to supply a Python expression that escapes the intended attribute lookup and executes arbitrary code including OS commands via the os module.

  • CVE-2026-66138HIGHCVSS 7.2

    In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent via a maliciously constructed configuration, because the value of ntp_server is passed to a shell.

  • CVE-2026-54422MEDIUMCVSS 5.5

    In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials used to download it.

  • CVE-2026-16796HIGHCVSS 7.3

    Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock AgentCore Python SDK before 1.18.1 might allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments. To mitigate this issue, users should upgrade to the patched version 1.18.1.

  • CVE-2026-65908HIGHCVSS 8.6

    In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on untrusted project open

Never miss a Python vulnerability

CVEye monitors Python and your entire stack 24/7, sending instant alerts via email, Slack, Discord, or webhook the moment a new CVE is published.

7-day free trial · No credit card required

Also monitor