Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1
CVE-2026-114501
### Summary When [`PILLOW_ALIGNMENT`](https://pillow.readthedocs.io/en/stable/reference/block_allocator.html#memory-poo
#cwe-226
共收录 17 条相关情报。
← 返回所有主题Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im->blocks[0].ptr even when PILLO...
CVE-2026-114501
Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly cont
Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1
CVE-2026-114501
Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly cont
ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ExrBaseDecompressor.UndoZipCompression accepts a nonempty ZIP or ZIPS inflate result that is shorter than the EXR bl...
CVE-2026-106111
ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ExrBaseDecompressor.UndoZipCompression accepts a nonempty Z
devalue: `stringify`/`uneval` serialize shared memory
CVE-2026-92708
### Impact `stringify` and `uneval` serialize a typed array by emitting its backing `ArrayBuffer`, not just the view. I
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneva...
CVE-2026-92708
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the
Sensitive Information in Resource Not Removed Before Reuse in ASUS Armoury Crate driver allows a...
CVE-2026-18023
Sensitive Information in Resource Not Removed Before Reuse in ASUS Armoury Crate driver allows a local user to disclose
Sensitive Information in Resource Not Removed Before Reuse in ASUS Armoury Crate driver allows a local user to disclose sensitive information from uninitialized memory via a cra...
CVE-2026-18023
Sensitive Information in Resource Not Removed Before Reuse in ASUS Armoury Crate driver allows a local user to disclose
Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset()...
CVE-2026-74791
Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset() is called, allowing cach
Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset() is called, allowing cached templates to persist across reused contexts. Attackers...
CVE-2026-74791
Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset() is called, allowing cach
In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning...
CVE-2026-74250
In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment
In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect deploy interface.
CVE-2026-74250
OpenStack Ironic 是 OpenStack 中用于裸机服务器部署和管理的关键组件。所谓 deploy interface，是 Ironic 在部署过程中负责加载镜像、引导节点并执行必要预配置的插件。autodetect dep
libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded gri...
CVE-2026-47247
libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak p
libheif Vulnerable to Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation
CVE-2026-47247
libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak p
Allocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not...
CVE-2026-13585
Allocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not Removed Before Reuse in
Allocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not Removed Before Reuse in the ASUS System Control Interface driver and ASUS Busines...
CVE-2026-13585
Allocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not Removed Before Reuse in
pam_usb provides hardware authentication for Linux using ordinary removable media. In versions 0.9.1 and below, the xfree() memory release helper in calls free() without first z...
CVE-2026-48984
pam_usb provides hardware authentication for Linux using ordinary removable media. In versions 0.9.1 and below, the xfre