Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode
CVE-2026-96638
Pillow is a Python imaging library. From 9.1.0 until 13.0.0, BmpRleDecoder.decode() in src/PIL/BmpImagePlugin.py permits
#advisory
共收录 22948 条相关情报。
← 返回所有主题EKKOLearnAI ekko-studio Media Generation API media.ts saveGeneratedImages file inclusion
CVE-2026-114379
A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImage
Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes
CVE-2026-112901
``` ============================================================================ ReDoS in XbmImagePlugin: 512-byte file
Pillow: Image.quantize() with empty palette leaks uninitialized stack memory
CVE-2026-112898
``` ============================================================================ Image.quantize() with empty palette lea
Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()
CVE-2026-112401
``` ============================================================================ Quadratic GIF comment concatenation all
Pillow: Infinite loop in MIC n_frames when the embedded TIFF
CVE-2026-112390
``` ============================================================================ Infinite loop in MIC n_frames when the
Pillow: Quadratic GIF comment copying during save
CVE-2026-112891
On Pillow 12.3.0 and upstream `main` (`ad277e2761b489681e71b51e91367d46b0ceabb9`), a GIF with a long comment makes `_get
GitPython validates a submodule's ".git" path only after cloning into it (RCE)
CVE-2026-114145
GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, create_submodule() in git/objects/
toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()
CVE-2026-114144
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() passes unbounded hexadecimal, octal
Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images
CVE-2026-112392
``` ============================================================================ NULL dereference in ImagingExpand via r
toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()
CVE-2026-114143
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slices and rejoins every
Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0
CVE-2026-112405
### Summary `Image.merge()` checks the mode of every input band except band 0. If band 0 is a single-band `I` or `F` ima
toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype
CVE-2026-114142
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() can write attacker-controlled prope
toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()
CVE-2026-114141
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse() compiler's addTableArray() func
nbconvert: File write via path traversal in cell output filenames
CVE-2026-114140
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4
leomoon-studios wiki-go Comment Deletion comments.go DeleteComment path traversal
CVE-2026-114377
A security vulnerability has been detected in leomoon-studios wiki-go up to 1.9.1. Affected by this issue is the functio
Sentry-Javascript: Middleware Bypass when using Tunnel route
CVE-2026-114139
Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the web
Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation
CVE-2026-114138
Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation.get_accept_list in
Django REST framework: TokenProxy.delete() reports success and revokes nothing
CVE-2026-114137
Django REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18.2, TokenProxy.delete() in rest_framewor
Pillow: Invalid free in FreeType glyph rendering when a stroker is active
CVE-2026-112893
### Summary When text is drawn with a non-zero stroke width, Pillow creates a FreeType stroker and then loads each glyph