High
CVE-2024-53863
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 96
Reset filters
High
CVE-2024-28219
Pillow buffer overflow vulnerability
High
CVE-2023-44464
pretix allows Pillow to parse EPS files
High
CVE-2026-54060
Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`
High
CVE-2026-54059
Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading
Medium
CVE-2026-55798
Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path
High
CVE-2026-55379
Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading
High
CVE-2026-55380
Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`
Critical
CVE-2023-50447
Arbitrary Code Execution in Pillow
High
CVE-2026-42311
Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)
Medium
CVE-2026-42309
Pillow has a heap buffer overflow with nested list coordinates
Medium
CVE-2026-42308
Pillow has an integer overflow when processing fonts
Low
CVE-2026-41488
langchain-openai: Image token counting SSRF protection can be bypassed via DNS rebinding
High
CVE-2026-40192
FITS GZIP decompression bomb in Pillow
Medium
CVE-2026-28231
pillow-heif: Integer Overflow in Encode Path Buffer Validation Leads to Heap Out-of-Bounds Read
High
CVE-2026-25990
Pillow affected by out-of-bounds write when loading PSD images
High
CVE-2025-48379
Pillow vulnerability can cause write buffer overflow on BCn encoding
High
CVE-2023-44271
An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of
Unrated
pysec-2023-175
Pillow versions before v10.0.1 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863). Pillow v10.0.1 upgrades the bundled libwebp binary to v1.3.2.
High
Exploited in attacks
CVE-2023-4863
libwebp: OOB write in BuildHuffmanTable
High
CVE-2022-45199
Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL.
High
CVE-2022-45198
Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).
High
CVE-2022-30595
Buffer over-flow in Pillow
Critical
CVE-2014-3007
Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibl
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.