Multiple security vulnerabilities exist in python-aiohttp versions prior to 3.14.4, including improper enforcement of the Secure cookie attribute, missing keepalive timeout handling, connection pool exhaustion, unbounded file descriptor retention in multipart requests, incorrect Request.scheme handling, host-only cookie scope removal by subdomains, and ambiguous HTTP request framing leading to request smuggling. These issues are fixed in version 3.14.4.