GHSA-R73J-PQJ5-W3X7 Pillow has a PDF Parsing Trailer Infinite Loop (DoS)

Impact An attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. Patches Patched version: 12.2.0. PdfParser introduced in Pillow 4.2.0 follows Prev pointers in PDF trailers to read cross-reference sections. If ...

PT-2026-37200

Name of the Vulnerable Software and Affected Versions Pillow versions 10.3.0 through 12.1.x Description Processing a malicious PSD file can lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This occurs because bounds checks for tile extents in PSD image...

GHSA-WHJ4-6X5X-4V2J FITS GZIP decompression bomb in Pillow

Impact Pillow did not limit the amount of GZIP-compressed data read when decoding a FITS image, making it vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service OOM crash or severe performance degradation...

CVE-2022-26266

Piwigo v12.2.0 was discovered to contain a SQL injection vulnerability via pwg.users.php...

OPENSUSE-SU-2025:15753-1 ansible-12-12.2.0-1.1 on GA media

These are all security issues fixed in the ansible-12-12.2.0-1.1 package on the GA media of openSUSE Tumbleweed...

EUVD-2019-8892

Malware in sbrugna...

EUVD-2019-8891

Malware in sbrugna...

EUVD-2022-30828

Malicious code in bioql PyPI...

CVE-2023-26100

In Progress Flowmon before 12.2.0, an application endpoint failed to sanitize user-supplied input. A threat actor could leverage a reflected XSS vulnerability to execute arbitrary code within the context of a Flowmon user's web browser...

CVE-2025-34026

The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.This issue is kno...

Versa Concerto SD-WAN 安全漏洞

Versa Concerto SD-WAN is an easy-to-use user interface from Versa for configuring and monitoring Versa OS devices in a secure SD-WAN. A security vulnerability exists in Versa Concerto SD-WAN versions 12.1.2 through 12.2.0, which stems from an insecure host binary path mount that could lead to...

Versa Concerto SD-WAN 安全漏洞

Versa Concerto SD-WAN is an easy-to-use user interface from Versa for configuring and monitoring Versa OS devices in a secure SD-WAN. A security vulnerability exists in Versa Concerto SD-WAN versions 12.1.2 through 12.2.0, which stems from an authentication bypass in the Traefik Reverse Proxy...

PT-2025-3364 · Beijing Sogou Technology Development Co. · Sogou Input

Name of the Vulnerable Software and Affected Versions: Beijing Sogou Technology Development Co., Ltd Sogou Input version 12.2.0 Description: An issue in the software allows attackers to access sensitive user information via supplying a crafted link. This is achieved by providing a manipulated lin...

Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to denial of service [CVE-2024-37168] [CVE-2024-34890]

Summary Node.js is used by IBM App Connect Enterprise Certified Container as a runtime engine. IBM App Connect Enterprise Certified Container operands are vulnerable to denial of service. This bulletin provides patch information to address the reported vulnerability in Node.js modules ws and gRPC...

PT-2024-30937 · Unknown · Miniscript

Name of the Vulnerable Software and Affected Versions: Miniscript library versions prior to 12.2.0 Description: The issue allows stack consumption because the Miniscript library does not properly track tree depth. Recommendations: For versions prior to 12.2.0, update to version 12.2.0 or later to...

PT-2024-20734 · Jungo · Windriver

Name of the Vulnerable Software and Affected Versions: Jungo WinDriver versions prior to 12.2.0 Description: The issue is related to improper privilege management, allowing local attackers to escalate privileges and execute arbitrary code. Recommendations: For versions prior to 12.2.0, update to...

SugarCRM 12.2.0 Shell Upload

----------------------------------------------------------------- SugarCRM = 12.2.0 Notes Unrestricted File Upload Vulnerability ----------------------------------------------------------------- - Software Link: https://www.sugarcrm.com - Affected Versions: Version 12.2.0 and prior versions...

CVE-2023-26100

In Progress Flowmon before 12.2.0, an application endpoint failed to sanitize user-supplied input. A threat actor could leverage a reflected XSS vulnerability to execute arbitrary code within the context of a Flowmon user's web browser...

Progress Flowmon 路径遍历漏洞

Progress Flowmon is a real-time network traffic monitoring tool from Progress. A security vulnerability exists in Progress Flowmon versions prior to 12.2.0, which stems from a path traversal vulnerability that can be exploited by an attacker to retrieve files on the device's local file system...

TYPO3 XSS Vulnerability (TYPO3-core-sa-2023-001)

TYPO3 is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:typo3:typo3"; if...