CVE-2026-75508

The GraphQL-core Python library (versions 3.2.3 through 3.2.12 and 3.3.0rc1 ) is vulnerable to a Denial of Service via memory exhaustion. The root cause is that the max_tokens limit in Parser.advance_lexer only counts non-comment tokens, while Lexer.lookahead() still allocates and retains Token o...

CVE-2021-28378

CVE-2021-28378 Details about this CVE here. This CVE targets a missing string escaping on the client-side from content fetched from the server. It enables an attacker to inject arbitrary code easily, by creating a comment on an issue or a pull request. This was introduced in commit...

EUVD-2019-20209

SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist array parameter. Attackers can send GET requests to /comment/api/index.php with crafted rlist values using backtick-quoted...

CVE-2019-25778

Versions of SeaCMS through 8.7 are vulnerable to an unauthenticated SQL injection vulnerability. The flaw exists in the rlist[] array parameter , which allows remote attackers to manipulate database queries. By sending crafted GET requests to /comment/api/index.php using backtick-quoted variables...

CVE-2019-25778 SeaCMS 8.7 SQL Injection via comment/api/index.php rlist Parameter

SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist array parameter. Attackers can send GET requests to /comment/api/index.php with crafted rlist values using backtick-quoted...

CVE-2026-114377

A security vulnerability has been detected in leomoon-studios wiki-go up to 1.9.1. Affected by this issue is the function DeleteComment of the file internal/comments/comments.go of the component Comment Deletion Handler. The manipulation of the argument documentPath leads to path traversal. The...

GHSA-FC9G-5QG7-MF45 Pillow: Quadratic GIF comment copying during save

On Pillow 12.3.0 and upstream main ad277e2761b489681e71b51e91367d46b0ceabb9, a GIF with a long comment makes getglobalheader copy portions of the comment repeatedly when saving, including comments carried over from untrusted images. I suggest provisional Moderate severity for crafted-image CPU...

Pillow: Quadratic GIF comment copying during save

On Pillow 12.3.0 and upstream main ad277e2761b489681e71b51e91367d46b0ceabb9, a GIF with a long comment makes getglobalheader copy portions of the comment repeatedly when saving, including comments carried over from untrusted images. I suggest provisional Moderate severity for crafted-image CPU...

CVE-2026-114377 leomoon-studios wiki-go Comment Deletion comments.go DeleteComment path traversal

A security vulnerability has been detected in leomoon-studios wiki-go up to 1.9.1. Affected by this issue is the function DeleteComment of the file internal/comments/comments.go of the component Comment Deletion Handler. The manipulation of the argument documentPath leads to path traversal. The...

CVE-2026-114377 leomoon-studios wiki-go Comment Deletion comments.go DeleteComment path traversal

A security vulnerability has been detected in leomoon-studios wiki-go up to 1.9.1. Affected by this issue is the function DeleteComment of the file internal/comments/comments.go of the component Comment Deletion Handler. The manipulation of the argument documentPath leads to path traversal. The...

EUVD-2026-107550

A security vulnerability has been detected in leomoon-studios wiki-go up to 1.9.1. Affected by this issue is the function DeleteComment of the file internal/comments/comments.go of the component Comment Deletion Handler. The manipulation of the argument documentPath leads to path traversal. The...

CVE-2026-114377

The leomoon-studios wiki-go software (up to version 1.9.1 ) is vulnerable to a path traversal vulnerability in the Comment Deletion Handler component. Specifically, the DeleteComment function within the internal/comments/comments.go file fails to properly sanitize the documentPath argument. An at...

PT-2026-120808

Name of the Vulnerable Software and Affected Versions leomoon-studios wiki-go versions prior to 1.9.2 Description Remote manipulation of the documentPath argument within the DeleteComment function of the Comment Deletion Handler component leads to path traversal. Path traversal is a condition whe...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via repeated string concatenation in the seek function of src/PIL/GifImagePlugin.py when parsing GIF comment extension blocks. An attacker can supply a GIF file containing many comment blocks, causing...

CVE-2026-112891

The Pillow Python imaging library (versions 9.2.0 through 13.0.0 ) is vulnerable to a quadratic copying issue when saving a GIF file containing a long comment. The root cause is located in the _get_global_header() function, which repeatedly copies portions of comment data from an untrusted input ...

CVE-2026-112891 Pillow: Quadratic GIF comment copying during save

Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow performs quadratic copying when saving a GIF with a long comment. getglobalheader repeatedly copies portions of comment data while assembling the global header, including comments retained from an untrusted input image. An attack...

CVE-2026-112401 Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()

Pillow is a Python imaging library. From 5.4.0 until 13.0.0, Pillow performs quadratic copying while parsing GIF comments. GifImageFile.seek repeatedly appends immutable bytes for comment sub-blocks and multiple comment extensions, and frame zero is parsed during Image.open. An attacker can submi...

CVE-2026-112401 Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()

Pillow is a Python imaging library. From 5.4.0 until 13.0.0, Pillow performs quadratic copying while parsing GIF comments. GifImageFile.seek repeatedly appends immutable bytes for comment sub-blocks and multiple comment extensions, and frame zero is parsed during Image.open. An attacker can submi...

CVE-2026-112401

The Pillow Python imaging library is vulnerable to a Denial of Service (DoS) condition due to inefficient algorithmic complexity (CWE-407) during GIF comment parsing. Specifically, in versions 5.4.0 through 12.9.0 , the GifImageFile._seek() method performs quadratic copying by repeatedly appendin...

CVE-2026-112401 Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()

Pillow is a Python imaging library. From 5.4.0 until 13.0.0, Pillow performs quadratic copying while parsing GIF comments. GifImageFile.seek repeatedly appends immutable bytes for comment sub-blocks and multiple comment extensions, and frame zero is parsed during Image.open. An attacker can submi...