Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()

### Summary Every Pillow wheel from 11.1.0 onward bundles a libopenjp2 containing a heap-buffer-overflow **write** that

历史摘要 · 未重新核验 · GitHub Advisory

Ghost: Remote Code Execution via Bookmark Card Images

CVE-2026-105642

### Impact An image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user

历史摘要 · 未重新核验 · GitHub Advisory

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

A vulnerability in the underlying `libheif` library used by `sharp` which Next.js uses for image optimization can lead t

历史摘要 · 未重新核验 · GitHub Advisory

olm dependency deprecation: CVE-2022-39255 and CVE-2024-45193

### Problem Multiple vulnerabilities were disclosed in 2024 affecting libolm (Olm): AES timing / side‑channel, Ed25519

历史摘要 · 未重新核验 · GitHub Advisory

sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591

### Impact A number of vulnerabilities, two rated as "High" severity using CVSSv4, have been discovered and fixed in th

历史摘要 · 未重新核验 · GitHub Advisory

Gogs: XSS in .ipynb files renderer due to outdated notebookjs

### Summary Gogs renders Jupyter notebook files (`.ipynb`) using [jsvine/notebookjs](https://github.com/jsvine/notebook

历史摘要 · 未重新核验 · GitHub Advisory

Vulnerable OpenSSL included in cryptography wheels

pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in wheels prior

历史摘要 · 未重新核验 · GitHub Advisory