abraia (>=0.8.0, <=0.8.9), arcor2 (>=0.19.0, <=0.21.0) +54 more potentially affected by CVE-2026-96641 via pillow (8.3.1)

pillow PYPI version 8.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - abraia =0.8.0, =0.19.0, =0.17.0, =0.12.0, =0.13.0, =2.0.0, =0.0.1, =3.0.0b34, =3.0.1b6 and more Source cves: CVE-2026-96641 Source advisory:...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Pillow is a PIL Python Imaging Library fork. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via missing decompression bomb checks in the seek methods of DcxImagePlugin, MicImagePlugin, and MpoImagePlugin. When a...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the seek method in src/PIL/SpiderImagePlugin.py, which lacks a decompression bomb check after seeking to a new frame in a SPIDER format image. An attacker can supply a...

CVE-2026-113297

A flaw was found in the Ozone component of Chromium. An improper access control issue allows a remote attacker to obtain sensitive information by convincing a user to visit a specially crafted HTML page. Successful exploitation may lead to unauthorized data disclosure...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the chart configuration process. An attacker can execute arbitrary JavaScript code in the context of the user's browser by injecting malicious data into configuration options such as additionalOptions,...

CVE-2026-112056

A flaw was found in wv. When parsing a Microsoft Word document containing malformed stylesheet data, the library fails to properly validate style indexes, leading to a heap-based out-of-bounds read. An attacker could exploit this vulnerability by enticing a user or automated service to open a...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification in BmpImagePlugin.py via the RLE-compressed BMP decoder, where the decode method appends null bytes to an output buffer without bounding the amount against the expected...

CVE-2026-83381

A flaw was found in OpenJDK. An unauthenticated remote attacker can exploit this vulnerability over a network by supplying crafted input to Application Programming Interfaces APIs within the Security component. Successful exploitation can result in unauthorized read and modification access to a...

K000163827: Linux kernel vulnerability CVE-2026-46124

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: isofs: validate block number from NFS file handle in isofsexportiget isofsfhtodentry and isofsfhtoparent pass an attacker- controlled block number ifid-block or ifid-parentblock from the NFS file...

CVE-2026-111808

Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version...

DEBIAN-CVE-2026-111810

Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request carrying many such headers makes the proxy write far more log data than the request contains. This issue affects Apache Traffic Server: 9.2.15, 10.1.4,...

CVE-2026-111810

Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request carrying many such headers makes the proxy write far more log data than the request contains. This issue affects Apache Traffic Server: 9.2.15, 10.1.4,...

DEBIAN-CVE-2026-111808

Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version...

Security Bulletin: Multiple Vulnerabilities in IBM Data Product Hub

Summary Multiple vulnerabilities were addressed in IBM Data Product Hub version 5.4.0 Patch 8 Vulnerability Details CVEID:CVE-2026-75899 DESCRIPTION: fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time...

CVE-2026-101516

A flaw was found in the OpenJDK Libraries component. An unauthenticated remote attacker can exploit this vulnerability over a network by submitting crafted data to affected application programming interfaces APIs, or through sandboxed environments that execute untrusted Java code. Successful...

golang: cmd/compile: no-op interface conversion bypasses overlap checking

A flaw was found in the cmd/compile package in the Go standard library. A no-op interface conversion prevented the compiler from correctly identifying non-overlapping memory moves. As a result, the compiler allows unsafe memory move operations to occur at runtime, potentially causing data...

Security Bulletin: IBM CloudPak for Data Scheduling Service is vulnerable to CVE-2023-44487.

Summary The CPD Scheduling service uses Go lang, golang.org/x/net and gRPC-Go. CVE-2023-44487. Vulnerability Details CVEID:CVE-2023-44487 DESCRIPTION: The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploit...

EUVD-2026-107501

Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request carrying many such headers makes the proxy write far more log data than the request contains. This issue affects Apache Traffic Server: 9.2.15, 10.1.4,...

CVE-2026-111810

Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request carrying many such headers makes the proxy write far more log data than the request contains. This issue affects Apache Traffic Server: 9.2.15, 10.1.4,...

CVE-2026-111808 Apache Traffic Server: HTTP/2 DATA frame padding underflow lets a client trigger backend worker-pool exhaustion

Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version...