Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS
CVE-2026-112400
``` ============================================================================ GIF seek keeps rejected size after Deco
2026-10-21 归档
今日共收录 2917 条安全情报，包含 2077 个 CVE，435 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit
CVE-2026-112899
``` ============================================================================ EPS load(scale) lets Ghostscript render
Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips
CVE-2026-112897
``` ============================================================================ TiffDecode returns uninitialized memory
Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read
CVE-2026-112896
## Summary A small attacker-supplied TIFF can be opened and loaded normally, then reach an out-of-bounds read when an a
Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)
CVE-2026-112895
### Summary When an application appends to an existing PDF with `Image.save(..., format="PDF", append=True)`, Pillow par
Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)
CVE-2026-112395
### Summary Pillow's libImaging `_decodeTile` decoder, used to decode tiled TIFF images, allocates a per-tile buffer us
Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels
CVE-2026-112404
``` ============================================================================ OOB read in TiffDecode.c tile and RGBA
Pillow: Heap buffer overflow in ImagingJpegDecode
CVE-2026-112403
## Summary `JpegImageFile.draft()` — which `Image.thumbnail()` calls automatically — requests 1/2, 1/4 or 1/8 scaled JP
markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)
CVE-2026-111758
### Summary A link reference definition whose label or title is never closed is O(n²) in markdown-it 15.0.2 with defaul
markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled
CVE-2026-111766
### Summary With `html: true`, markdown-it takes quadratic time to parse repeated unterminated HTML constructs inside a
MCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another
CVE-2026-111770
### Summary In affected versions, an MCP server reached over HTTP could deliver one client's responses and notifications
MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation
CVE-2026-111768
### Summary In affected versions, servers put no limit on how many array elements and object keys they validated in one
AIOHTTP: Absolute-form request targets can spoof Request.scheme
CVE-2026-111748
### Summary An attacker sending an absolute-form request can spoof the scheme used. ### Impact If user code depends o
AIOHTTP: Connector pool exhaustion via Max-Age overflow
CVE-2026-111065
### Summary An overflow in Max-Age processing can skip closing a connection. ### Impact An attacker may be able to ex
AIOHTTP: Pure-Python parser request smuggling
CVE-2026-111750
### Summary The pure Python parser is vulnerable to an HTTP request smuggling attack. ### Impact If users are using t
AIOHTTP: File descriptor exhaustion in multipart requests
CVE-2026-111066
### Summary An attacker can exhaust file descriptors with specially crafted multipart requests. ### Impact If a handl
launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors
CVE-2026-112944
### Summary `launch-editor` forwarded file paths directly to editors without sanitization. If a path resembles a CLI fl
launch-editor: `fs.existsSync()` existence check can be bypassed on Windows
CVE-2026-112942
### Summary `launch-editor` checked `fs.existsSync(fileName)` before passing a supplied path to an editor command. On W
MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service
CVE-2026-111771
### Summary In affected versions, the SDK's server-side bearer authentication had no way to check that a token was issue
关于Microsoft ExchangeServer存在多个...
关于Microsoft ExchangeServer存在多个...