Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips
CVE-2026-112897
``` ============================================================================ TiffDecode returns uninitialized memory
#pip
共收录 834 条相关情报。
← 返回所有主题Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read
CVE-2026-112896
## Summary A small attacker-supplied TIFF can be opened and loaded normally, then reach an out-of-bounds read when an a
Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)
CVE-2026-112895
### Summary When an application appends to an existing PDF with `Image.save(..., format="PDF", append=True)`, Pillow par
Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)
CVE-2026-112395
### Summary Pillow's libImaging `_decodeTile` decoder, used to decode tiled TIFF images, allocates a per-tile buffer us
Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels
CVE-2026-112404
``` ============================================================================ OOB read in TiffDecode.c tile and RGBA
Pillow: Heap buffer overflow in ImagingJpegDecode
CVE-2026-112403
## Summary `JpegImageFile.draft()` — which `Image.thumbnail()` calls automatically — requests 1/2, 1/4 or 1/8 scaled JP
AIOHTTP: Absolute-form request targets can spoof Request.scheme
CVE-2026-111748
### Summary An attacker sending an absolute-form request can spoof the scheme used. ### Impact If user code depends o
AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies
CVE-2026-111749
### Summary A subdomain can remove the Host-Only flag from an existing cookie to a parent domain. ### Impact A user a
AIOHTTP: Connector pool exhaustion via Max-Age overflow
CVE-2026-111065
### Summary An overflow in Max-Age processing can skip closing a connection. ### Impact An attacker may be able to ex
AIOHTTP: Pure-Python parser request smuggling
CVE-2026-111750
### Summary The pure Python parser is vulnerable to an HTTP request smuggling attack. ### Impact If users are using t
AIOHTTP: File descriptor exhaustion in multipart requests
CVE-2026-111066
### Summary An attacker can exhaust file descriptors with specially crafted multipart requests. ### Impact If a handl
uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised
By default, uv verifies TLS connections against a vendored copy of the `webpki-root-certs` bundle. Versions before 0.13.
certifi bundles emSign root CAs with compromised intermediate CA keys
Certifi versions before 2026.10.18 include the `emSign ECC Root CA - G3` root certificate in their bundled CA store. Eig
aiohttp server lacks an initial request/header timeout
CVE-2026-111064
### Summary The keepalive timeout was not used during the initial portion of a request. ### Impact An attacker could
AIOHTTP: Secure attribute not enforced for shared cookie
CVE-2026-111063
### Summary The Secure attribute was not being enforced for the shared cookie. ### Impact It may be possible to send
aiohttp: Multiple instances of excessive or unbounded memory/CPU use
### Summary Multiple cases were found where aiohttp could use excessive or unbounded memory, or excessive CPU consumpti
Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML
CVE-2026-111059
## Summary Mercury turns Jupyter notebooks into shared web apps/dashboards. The `mr.Markdown` widget converts its input
Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass
CVE-2026-111057
### Summary A missing comma in `mercury_app/block_handler.py`'s `BLOCKED_PATTERNS` list causes the blocklist to fail to
Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo
## Summary The Fortran extractor's C-preprocessor step (`graphify/extractors/fortran.py`, `_cpp_preprocess`) applies an
Mercury: Unauthenticated Remote Code Execution via /api/kernels
CVE-2026-111058
Mercury runs a JupyterLab server with **anonymous access by default** (`mercury_app/__main__.py` sets `--IdentityProvide