SUSE CVE-2026-111497

A buffer overflow vulnerability in the Brotli decoder c/dec/decode.c in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially...

CLSA-2026-1783337056 Fix of 30 CVEs

CVE-2026-46113 - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN/role CVE-2026-46113 CVE-2022-50300 - btrfs: fix extent map use-after-free when handling missing device in readonechunk CVE-2022-50300 CVE-2022-50082 - ext4: fix warning in ext4iomapbegin as race between bmap and wri...

CLSA-2026-1792622946 corosync: Fix of 4 CVEs

CVE-2025-30472: stack buffer overflow in orftokenendianconvert - CVE-2026-35091: out-of-bounds read via checkmembcommittokensanity - CVE-2026-35092: integer overflow in checkmembjoinsanity - CVE-2026-81665: heap buffer overflow in totempgdeliverfn...

CVE-2017-14980.RCE

CVE-2017-14980 The exploit targets Sync Breeze Enterprise running on Windows 10 x86, build: 16299 , affecting version 10.0.28 , where an unauthenticated attacker can perform a buffer overflow via an HTTP-request body , resulting in arbitrary code execution. This exploit assumes all security...

CVE-2026-114383

A weakness has been identified in TOTOLINK EX200 5.2.3c.7200. This impacts the function setWiFiAclAddConfig of the file /cgi-bin/cstecgi.cgi of the component wireless.so. This manipulation of the argument macAddress causes stack-based buffer overflow. The attack can be initiated remotely. The...

CVE-2026-114382

A security flaw has been discovered in TOTOLINK EX200 5.2.3c.7200. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the component lan.so. The manipulation of the argument Comment results in stack-based buffer overflow. It is possible to launch the attack remotely...

CVE-2026-96778

A flaw was found in Pillow. A remote attacker could exploit a heap buffer overflow vulnerability to achieve arbitrary code execution or cause a Denial of Service DoS. This issue occurs when an application re-encodes an untrusted image into JPEG format while preserving specially crafted color...

GHSA-332P-7HRC-92WF Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO

============================================================================ Heap buffer overflow in tiffWriteProc when saving TIFF to BytesIO Location: src/libImaging/TiffDecode.c:94 in tiffWriteProc Commit: a707c6b21c313880d0771e54965d142dd42358b6...

EUVD-2026-104603

Pillow: Heap buffer overflow in tiffWriteProc when saving TIFF to BytesIO...

Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO

============================================================================ Heap buffer overflow in tiffWriteProc when saving TIFF to BytesIO Location: src/libImaging/TiffDecode.c:94 in tiffWriteProc Commit: a707c6b21c313880d0771e54965d142dd42358b6...

PYSEC-2026-4343

Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src/display.c. The handler sizes a DIB allocation from 16-bit-truncated bcWidth and bcHeight fields but copies pixel data using...

PYSEC-2026-4343

Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src/display.c. The handler sizes a DIB allocation from 16-bit-truncated bcWidth and bcHeight fields but copies pixel data using...

CVE-2026-96644

Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src/display.c. The handler sizes a DIB allocation from 16-bit-truncated bcWidth and bcHeight fields but copies pixel data using...

UBUNTU-CVE-2026-96642

Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to the same 512-byte header. When the requested member name does not match, the parser repeatedly reads that header, consum...

UBUNTU-CVE-2026-96641

Pillow is a Python imaging library. Prior to 13.0.0, PILfont text-width accumulation in src/imaging.c checks positive glyph advances against INTMAX but does not check negative advances against INTMIN. Repeating a signed 16-bit advance of -32768 can therefore execute a signed C integer overflow in...

CVE-2026-96641

Pillow is a Python imaging library. Prior to 13.0.0, PILfont text-width accumulation in src/imaging.c checks positive glyph advances against INTMAX but does not check negative advances against INTMIN. Repeating a signed 16-bit advance of -32768 can therefore execute a signed C integer overflow in...

CVE-2026-96778 Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer

Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode in src/libImaging/JpegEncode.c can call jpegwritemarker for a JPEG COM comment when an ICC profile has exactly filled the 65536-byte encoder buffer. libjpeg writes one byte before checking the exhausted freeinbuffer...

CVE-2026-96778 Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer

Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode in src/libImaging/JpegEncode.c can call jpegwritemarker for a JPEG COM comment when an ICC profile has exactly filled the 65536-byte encoder buffer. libjpeg writes one byte before checking the exhausted freeinbuffer...

CVE-2026-96778 Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer

Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode in src/libImaging/JpegEncode.c can call jpegwritemarker for a JPEG COM comment when an ICC profile has exactly filled the 65536-byte encoder buffer. libjpeg writes one byte before checking the exhausted freeinbuffer...

CVE-2026-96778

The Pillow Python imaging library (versions 9.4.0 through 13.0.0 ) contains a heap buffer overflow in src/libImaging/JpegEncode.c. The ImagingJpegEncode() function can call jpeg_write_marker() for a JPEG COM comment when an ICC profile exactly fills the 65536-byte encoder buffer. Due to libjpeg w...