Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH

CVE-2026-115774

## Summary An infinite-loop vulnerability (CWE-835) in the Twisted IMAP4 server lets an authenticated client freeze the

历史摘要 · 未重新核验 · GitHub Advisory

Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer

CVE-2026-115776

## Summary An unbounded-buffer vulnerability (CWE-770) in the Twisted words IRC server lets any unauthenticated remote

历史摘要 · 未重新核验 · GitHub Advisory

Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer

CVE-2026-115778

## Summary An allocation-without-limits vulnerability (CWE-770) in the Twisted conch telnet transport lets any unauthen

历史摘要 · 未重新核验 · GitHub Advisory

Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree

CVE-2026-115775

## Summary An allocation-without-limits vulnerability in the Twisted XML element stream lets any unauthenticated remote

历史摘要 · 未重新核验 · GitHub Advisory

Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value

CVE-2026-115877

## Summary An incomplete header-value validation (CWE-444) in the Twisted HTTP server lets a bare carriage return or li

历史摘要 · 未重新核验 · GitHub Advisory

vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine

CVE-2026-114050

## Summary Multimodal content parts (`image_url`, `video_url`, `input_audio`, ...) accept a user-supplied `uuid` field

历史摘要 · 未重新核验 · GitHub Advisory

virtualenv: Generated files can follow existing destination links

CVE-2026-113721

## Summary Generated activation files and pyvenv.cfg can follow existing links and write outside the requested environm

历史摘要 · 未重新核验 · GitHub Advisory

Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()

### Summary Every Pillow wheel from 11.1.0 onward bundles a libopenjp2 containing a heap-buffer-overflow **write** that

历史摘要 · 未重新核验 · GitHub Advisory

pypdf: Possible long runtimes/large memory usage when retrieving form fields

CVE-2026-113789

### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage and/or long runtim

历史摘要 · 未重新核验 · GitHub Advisory

pypdf: Possible large memory usage when parsing arrays and dictionaries

CVE-2026-113790

### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires par

历史摘要 · 未重新核验 · GitHub Advisory

pypdf: Possible large memory usage when parsing content streams

CVE-2026-113791

### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires par

历史摘要 · 未重新核验 · GitHub Advisory

GitPython validates a submodule's ".git" path only after cloning into it (RCE)

CVE-2026-114145

### Summary `create_submodule(name, path, url)` clones a submodule into the repo's own `.git` directory before it reje

历史摘要 · 未重新核验 · GitHub Advisory

GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit

CVE-2026-75508

### Summary The parser's `max_tokens` limit — the documented defence against oversized GraphQL documents — did not coun

历史摘要 · 未重新核验 · GitHub Advisory

GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule

CVE-2026-75507

### Summary The `OverlappingFieldsCanBeMerged` validation rule can be driven into quadratic — and in the worst case `O(

历史摘要 · 未重新核验 · GitHub Advisory

virtualenv: Builtin creation follows linked environment directories

CVE-2026-113716

## Summary The builtin creator accepts existing directory symlinks through ensure_dir() and writes environment files th

历史摘要 · 未重新核验 · GitHub Advisory

virtualenv: Deletion recovery can change a symlink target's mode

CVE-2026-113724

## Summary The deletion error handler obtains permission bits with lstat() but applies them through chmod(), which foll

历史摘要 · 未重新核验 · GitHub Advisory

virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax

CVE-2026-113722

## Summary A destination path supplied to virtualenv can be interpreted as shell syntax by a generated POSIX console la

历史摘要 · 未重新核验 · GitHub Advisory

Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags

CVE-2026-112902

``` ============================================================================ Memory disclosure and segfault in libti

历史摘要 · 未重新核验 · GitHub Advisory

Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO

CVE-2026-112393

``` ============================================================================ Heap buffer overflow in _tiffWriteProc

历史摘要 · 未重新核验 · GitHub Advisory

Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer

CVE-2026-112396

### Summary Saving an image as TIFF to an in-memory buffer can trigger a heap use-after-free if libtiff rejects a tag at

历史摘要 · 未重新核验 · GitHub Advisory