CVE-2026-54059 vulnerabilities

Vulnerabilities for packages: mlflow, open-webui, superset...

Security Bulletin: IBM Edge Data Collector uses multiple dependencies which are vulnerable to multiple CVEs.

Summary IBM Edge Data Collector uses pillow-12.2.0-cp314-cp314-manylinux227x8664.manylinux228x8664.whl, immutable-4.3.8.tgz, urllib3-2.6.3-py3-none-any.whl, form-data-4.0.5.tgz, pyjwt-2.12.1-py3-none-any.whl which are vulnerable to CVE-2026-54059, CVE-2026-54060, CVE-2026-55379, CVE-2026-55380,...

Security Bulletin: IBM Maximo Application Suite - Monitor Component uses multiple dependencies which are vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - Monitor component uses multiple third-party libraries that are vulnerable to several security vulnerabilities. The CVE details are listed in the Vulnerability Details section below. This bulletin provides information about the affected components and the...

SUSE SLED15 / SLES15 Security Update : python-Pillow (SUSE-SU-2026:3268-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3268-1 advisory. - CVE-2026-54058: out-of-bounds read via attacker-controlled row stride on mmap path bsc1271419. -...

CVE-2026-54059

creationtimestamp| type| source ---|---|--- 2026-07-20 22:37:46+00:00| published-proof-of-concept| https://github.com/python-pillow/Pillow/security/advisories/GHSA-8v84-f9pq-wr9x...

aamutils (>=0.0.11, <=0.0.12), adversarial-workflow (>=0.4.0, <=0.9.8) +516 more potentially affected by CVE-2026-54059 via pillow (>=12.0.0, <=12.2.0)

pillow PYPI version =12.0.0, =0.0.11, =0.4.0, =1.10.0rc1, =0.0.116, =0.13.2, =0.1.0rc1, =1.0.7, =0.1.0, =1.1.0, =1.3.0, =0.1.0, =0.2.0, =0.6.0, =0.8.0.dev20260511, =0.13.0.dev20261012 and more Source cves: CVE-2026-54059 Source advisory: GHSA-8V84-F9PQ-WR9X...

appixer-metadata (>=1.0.0, <=1.0.2), bcipy (1.5.0) +11 more potentially affected by CVE-2026-54059 via pillow (8.0.0)

pillow PYPI version 8.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - appixer-metadata =1.0.0, =0.2.0, =0.0.3, =1.0.1, =2.0.6, =0.7.0, =0.0.1, =0.3.0 Source cves: CVE-2026-54059 Source advisory: OSV:GHSA-8V84-F9PQ-WR9X...

agkit (>=0.17.0, <=0.26.0), ai-puti (0.1.0b5) +237 more potentially affected by CVE-2026-54059 via pillow (11.1.0)

pillow PYPI version 11.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - agkit =0.17.0, =0.2.0, =0.1.0, =0.76.0, =0.1.1, =3.1.8, =0.1.0, =0.1.0, =0.5.0, =25.2.0, =1.0.4, =0.1.0, =0.1.12 - arched-emailer 0.4.6 and more...

3deecelltracker (0.5.0a0), aima (2023.2.4) +60 more potentially affected by CVE-2026-54059 via pillow (9.1.0)

pillow PYPI version 9.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - 3deecelltracker 0.5.0a0 - aima 2023.2.4 - an-website =22.5.13, =2.4.5, =0.2.4rc1, =22.14.1, =0.0.3, =1.0.1, =0.1.0, =0.0.36, =0.0.39 and more Source...

diacamma-asso (>=2.0.1.16012810, <=2.1.16.17102513), diacamma-financial (>=2.0.1.16012810, <=2.1.15.17102513) +5 more potentially affected by CVE-2026-54059 via pillow (2.8.0)

pillow PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - diacamma-asso =2.0.1.16012810, =2.0.1.16012810, =2.0.1.16012810, =2.0.1.15101417, =2.0.1.15101417, =2.0.1.15101417, =0.1.2.1, =0.1.3 Source cves:...

cleanunet (0.0.1), cryptoadvance-specter (>=0.0.2, <=0.2.0) +25 more potentially affected by CVE-2026-54059 via pillow (6.2.0)

pillow PYPI version 6.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - cleanunet 0.0.1 - cryptoadvance-specter =0.0.2, =2.3.0rc2, =5.0.3, =0.1.4, =0.0.3, =0.1.9, =0.0.1, =1.13.0.dev5, =0.4.3, =0.4.4 and more Source cves...

coil (1.2.1), kraken (>=0.2.5, <=0.4.3) potentially affected by CVE-2026-54059 via pillow (2.8.1)

pillow PYPI version 2.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - coil 1.2.1 - kraken =0.2.5, =0.4.3 Source cves: CVE-2026-54059 Source advisory: OSV:GHSA-8V84-F9PQ-WR9X...

3lc (>=2.3.84, <=2.11.2), a-data-processing (0.0.1) +295 more potentially affected by CVE-2026-54059 via pillow (10.2.0)

pillow PYPI version 10.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - 3lc =2.3.84, =0.2.3, =1.6.0, =0.21.0, =0.0.2, =0.0.1, =0.0.1, =24.2.0, =0.0.7, =1.0.3.dev0, =1.1.0 and more Source cves: CVE-2026-54059 Source...

a2grunnerp (>=0.1.0, <=0.1.8), abejacli (>=2.2.0rc3, <=2.2.8) +282 more potentially affected by CVE-2026-54059 via pillow (9.4.0)

pillow PYPI version 9.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - a2grunnerp =0.1.0, =2.2.0rc3, =1.8.15, =1.8.17, =0.0.1, =1.8.14, =1.2.0, =1.2.0, =0.5.9, =0.5.10 and more Source cves: CVE-2026-54059 Source advisor...

aamutils (>=0.0.11, <=0.0.12), adversarial-workflow (>=0.4.0, <=0.9.8) +516 more potentially affected by CVE-2026-54059 via pillow (>=12.0.0, <=12.2.0)

pillow PYPI version =12.0.0, =0.0.11, =0.4.0, =1.10.0rc1, =0.0.116, =0.13.2, =0.1.0rc1, =1.0.7, =0.1.0, =1.1.0, =1.3.0, =0.1.0, =0.2.0, =0.6.0, =0.8.0.dev20260511, =0.13.0.dev20261012 and more Source cves: CVE-2026-54059 Source advisory: OSV:GHSA-8V84-F9PQ-WR9X...

abraia (>=0.8.0, <=0.8.9), arcor2 (>=0.19.0, <=0.21.0) +53 more potentially affected by CVE-2026-54059 via pillow (8.3.1)

pillow PYPI version 8.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - abraia =0.8.0, =0.19.0, =0.17.0, =0.12.0, =0.13.0, =2.0.0, =0.0.1, =3.0.0b34, =3.0.1b6 and more Source cves: CVE-2026-54059 Source advisory:...

acapy-patched-old (0.5.6), agl-predict-endo-frame (0.1.1) +271 more potentially affected by CVE-2026-54059 via pillow (7.2.0)

pillow PYPI version 7.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - acapy-patched-old 0.5.6 - agl-predict-endo-frame 0.1.1 - ailab-lite =0.1.1, =0.0.2, =0.3.10, =0.1.0, =2020.1.0, =0.9.0, =0.9.0, =0.8.1, =0.8.1,...

academic-emotion (0.1.2), afipcaeqrdecode (>=0.0.1b0, <=0.0.4) +267 more potentially affected by CVE-2026-54059 via pillow (10.1.0)

pillow PYPI version 10.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - academic-emotion 0.1.2 - afipcaeqrdecode =0.0.1b0, =0.1.6, =0.1.0, =23.11.0, =0.9.0, =0.3.5rc1, =0.1.0, =1.2.0 - asterai 0.1.1 - automate3 2023.11....

al-for-design (0.0.1), autogluon (>=0.0.5, <=0.1.0b20210209) +48 more potentially affected by CVE-2026-54059 via pillow (6.2.1)

pillow PYPI version 6.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - al-for-design 0.0.1 - autogluon =0.0.5, =0.0.15b20201014, =0.0.15b20201024, =0.0.16b20210114, =0.0.15b20201024, =0.0.121, =0.0.1, =0.0.1, =0.0.1,...

abracadabra (0.0.6), agilecode-test-tools (>=0.4.0, <=0.5.0) +76 more potentially affected by CVE-2026-54059 via pillow (8.1.0)

pillow PYPI version 8.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - abracadabra 0.0.6 - agilecode-test-tools =0.4.0, =0.1.1, =0.1.0, =0.11.0, =0.1.0, =0.4.0, =0.11.0, =0.11.0, =0.12.0 and more Source cves:...