UBUNTU-CVE-2026-112895

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can exhaust resources while parsing an existing PDF during an append operation. PdfParser follows page-tree child references without cycle or duplication tracking and follows previous-trailer chains with only an exact...

UBUNTU-CVE-2026-112404

Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can read beyond row data produced by libtiff. In decodeTile and the RGBA unpacker path, when Pillow and libtiff interpret duplicated PhotometricInterpretation or BitsPerSample tags differently,...

UBUNTU-CVE-2026-112891

Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow performs quadratic copying when saving a GIF with a long comment. getglobalheader repeatedly copies portions of comment data while assembling the global header, including comments retained from an untrusted input image. An attack...

UBUNTU-CVE-2026-112396

Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when libtiff rejects a tag while encoding TIFF data to an in-memory buffer. When an application saves attacker-influenced TIFF tags to BytesIO, libtiff can reject a tag during encoding in...

3d-rcnet (>=0.2.2, <=0.2.3), 3lc (>=3.2.0, <=3.4.2) +3074 more potentially affected by CVE-2026-112901 via pillow (>=12.0.0, <=12.3.0)

pillow PYPI version =12.0.0, =0.2.2, =3.2.0, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.6, =0.1.0, =0.0.1, =0.5.0, =0.0.6, =0.25.1 and more Source cves: CVE-2026-112901 Source advisory: MEND:CVE-2026-112901...

CLSA-2026-1792447518 TuxCare security update for axios (7 CVEs)

TuxCare rebuilt axios to address 7 CVEs. Fixed in 1.16.1-tuxcare.1...

3d-rcnet (>=0.2.2, <=0.2.3), 3lc (>=3.2.0, <=3.4.2) +3074 more potentially affected by CVE-2026-112897 via pillow (>=12.0.0, <=12.3.0)

pillow PYPI version =12.0.0, =0.2.2, =3.2.0, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.6, =0.1.0, =0.0.1, =0.5.0, =0.0.6, =0.25.1 and more Source cves: CVE-2026-112897 Source advisory: MEND:CVE-2026-112897...

3d-rcnet (>=0.2.2, <=0.2.3), 3lc (>=3.2.0, <=3.4.2) +3074 more potentially affected by CVE-2026-112896 via pillow (>=12.0.0, <=12.3.0)

pillow PYPI version =12.0.0, =0.2.2, =3.2.0, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.6, =0.1.0, =0.0.1, =0.5.0, =0.0.6, =0.25.1 and more Source cves: CVE-2026-112896 Source advisory: MEND:CVE-2026-112896...

@openinc/parse-server-opendash (>=4.0.0, <=4.2.0) potentially affected by CVE-2026-112768 via parse-server (>=9.6.0-alpha.37, <=9.10.0)

parse-server NPM version =9.6.0-alpha.37, =4.0.0, =4.2.0 Source cves: CVE-2026-112768 Source advisory: SNYK:JS-PARSESERVER-21277852...

@openinc/parse-server-opendash (>=4.0.0, <=4.2.0) potentially affected by CVE-2026-112769 via parse-server (>=9.6.0-alpha.37, <=9.10.0)

parse-server NPM version =9.6.0-alpha.37, =4.0.0, =4.2.0 Source cves: CVE-2026-112769 Source advisory: SNYK:JS-PARSESERVER-21277853...

CLSA-2026-1792446921 TuxCare security update for devalue (6 CVEs)

TuxCare rebuilt devalue to address 6 CVEs. Fixed in 5.8.1-tuxcare.1...

3d-rcnet (>=0.2.2, <=0.2.3), 3lc (>=3.2.0, <=3.4.2) +3074 more potentially affected by CVE-2026-112894 via pillow (>=12.0.0, <=12.3.0)

pillow PYPI version =12.0.0, =0.2.2, =3.2.0, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.6, =0.1.0, =0.0.1, =0.5.0, =0.0.6, =0.25.1 and more Source cves: CVE-2026-112894 Source advisory: MEND:CVE-2026-112894...

3d-rcnet (>=0.2.2, <=0.2.3), 3lc (>=3.2.0, <=3.4.2) +3074 more potentially affected by CVE-2026-112893 via pillow (>=12.0.0, <=12.3.0)

pillow PYPI version =12.0.0, =0.2.2, =3.2.0, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.6, =0.1.0, =0.0.1, =0.5.0, =0.0.6, =0.25.1 and more Source cves: CVE-2026-112893 Source advisory: MEND:CVE-2026-112893...

CLSA-2026-1792446138 TuxCare security update for webpack (2 CVEs)

TuxCare rebuilt webpack to address 2 CVEs. Fixed in 5.99.8-tuxcare.1...

3d-rcnet (>=0.2.2, <=0.2.3), 3lc (>=3.2.0, <=3.4.2) +3074 more potentially affected by CVE-2026-112892 via pillow (>=12.0.0, <=12.3.0)

pillow PYPI version =12.0.0, =0.2.2, =3.2.0, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.6, =0.1.0, =0.0.1, =0.5.0, =0.0.6, =0.25.1 and more Source cves: CVE-2026-112892 Source advisory: MEND:CVE-2026-112892...

3d-rcnet (>=0.2.2, <=0.2.3), 3lc (>=3.2.0, <=3.4.2) +3074 more potentially affected by CVE-2026-112406 via pillow (>=12.0.0, <=12.3.0)

pillow PYPI version =12.0.0, =0.2.2, =3.2.0, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.6, =0.1.0, =0.0.1, =0.5.0, =0.0.6, =0.25.1 and more Source cves: CVE-2026-112406 Source advisory: MEND:CVE-2026-112406...

3d-rcnet (>=0.2.2, <=0.2.3), 3lc (>=3.2.0, <=3.4.2) +3074 more potentially affected by CVE-2026-112405 via pillow (>=12.0.0, <=12.3.0)

pillow PYPI version =12.0.0, =0.2.2, =3.2.0, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.6, =0.1.0, =0.0.1, =0.5.0, =0.0.6, =0.25.1 and more Source cves: CVE-2026-112405 Source advisory: MEND:CVE-2026-112405...

3d-rcnet (>=0.2.2, <=0.2.3), 3lc (>=3.2.0, <=3.4.2) +3074 more potentially affected by CVE-2026-112404 via pillow (>=12.0.0, <=12.3.0)

pillow PYPI version =12.0.0, =0.2.2, =3.2.0, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.6, =0.1.0, =0.0.1, =0.5.0, =0.0.6, =0.25.1 and more Source cves: CVE-2026-112404 Source advisory: MEND:CVE-2026-112404...

3d-rcnet (>=0.2.2, <=0.2.3), 3lc (>=3.2.0, <=3.4.2) +3074 more potentially affected by CVE-2026-112403 via pillow (>=12.0.0, <=12.3.0)

pillow PYPI version =12.0.0, =0.2.2, =3.2.0, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.6, =0.1.0, =0.0.1, =0.5.0, =0.0.6, =0.25.1 and more Source cves: CVE-2026-112403 Source advisory: MEND:CVE-2026-112403...

3d-rcnet (>=0.2.2, <=0.2.3), 3lc (>=3.2.0, <=3.4.2) +3074 more potentially affected by CVE-2026-112402 via pillow (>=12.0.0, <=12.3.0)

pillow PYPI version =12.0.0, =0.2.2, =3.2.0, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.6, =0.1.0, =0.0.1, =0.5.0, =0.0.6, =0.25.1 and more Source cves: CVE-2026-112402 Source advisory: MEND:CVE-2026-112402...