Medium
CVE-2026-113721
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,330
Reset filters
Medium
CVE-2026-114603
OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api
Medium
CVE-2026-96636
Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)
Medium
CVE-2026-96641
Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise
Medium
CVE-2026-96638
Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode
Medium
CVE-2026-112396
Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer
Medium
CVE-2026-113724
virtualenv: Deletion recovery can change a symlink target's mode
Medium
CVE-2026-113716
virtualenv: Builtin creation follows linked environment directories
Medium
CVE-2026-112391
Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()
Medium
CVE-2026-112898
Pillow: Image.quantize() with empty palette leaks uninitialized stack memory
Medium
CVE-2026-112401
Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()
Medium
CVE-2026-112901
Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes
Low
CVE-2026-113786
pypdf: Unvalidated JPEG image data loading
Low
CVE-2026-113731
djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool
Medium
CVE-2026-112899
Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit
Medium
CVE-2026-111059
Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML
Medium
CVE-2026-104250
unstructured: Stored XSS via unescaped HTML generation
Medium
CVE-2026-104102
copyparty FTP: upload outside defined volumes (limited path traversal)
Medium
CVE-2026-59951
MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion
Medium
CVE-2026-62268
borg extract might modify out-of-tree files when extracting maliciously crafted archives
Medium
CVE-2026-62322
Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)
Medium
CVE-2026-112891
Pillow: Quadratic GIF comment copying during save
A vulnerability in Pillow causes repeated copying of long comments when saving GIF images. This can lead to excessive CPU consumption and potential denial of service when processing untrusted image uploads.
Medium
CVE-2026-112394
Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size
An out-of-bounds read vulnerability in Pillow allows certain decoders to read heap memory past the end of a buffer when processing specific image dimensions. This may disclose adjacent memory into decoded pixel data or cause an application crash.
High
CVE-2026-112392
Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images
Applying rank, median, minimum, or maximum filters to zero-width or zero-height images in Pillow triggers a NULL pointer dereference in ImagingExpand, causing Python worker processes to crash and enabling denial of service.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.