413570 matches found
Exploit for Improperly Controlled Sequential Memory Allocation in Php
php2shell-guard !Lizenz: MIThttps://img.shields.io/badge/...
Exploit for Improperly Controlled Sequential Memory Allocation in Php
php2shell-audit !CVEhttps://img.shields.io/badge/CVE-2026-...
CVE-2026-114501
Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im-blocks0.ptr even when PILLOWALIGNMENT makes alignedlinesize include row padding or an aligned offset before the first row. The resulting Arrow buffer...
CVE-2026-98658
A flaw was found in the Linux kernel's aw96103 proximity sensor driver. This vulnerability can lead to a Denial of Service DoS or kernel information disclosure via an out-of-bounds memory read. The issue occurs because the driver's firmware parser does not properly validate the data length...
CVE-2026-96638
A flaw was found in Pillow. When processing run-length encoded RLE bitmap images, the decoder fails to properly limit memory allocation for certain escape sequences and data runs. A remote attacker could exploit this flaw by supplying a specially crafted BMP image file to an application, causing...
CVE-2026-96644
A flaw was found in Pillow. When processing Windows Metafile WMF or Enhanced Metafile EMF images on Windows systems, the image parser improperly handles dimension values, allocating an undersized buffer while reading full dimensions. A remote attacker could exploit this vulnerability by enticing ...
brotli: Out-of-Bounds Write in Google Brotli Decoder
A flaw was found in the Google Brotli decoder. An out-of-bounds write in the block-type switch handling in c/dec/decode.c can be triggered by a crafted Brotli-compressed stream. When an application decompresses untrusted Brotli data, this can lead to memory disclosure, denial of service, or...
Exploit for Improperly Controlled Sequential Memory Allocation in Php
PHP2SHELL HTTP-only, ASLR-bypassing remote code execution f...
Exploit for Improperly Controlled Sequential Memory Allocation in Php
php2shell checker Find out if your PHP site is exposed to p...
Exploit for Improperly Controlled Sequential Memory Allocation in Php
php2shell-check CVE-2026-109618 / CVE-2026-109619 !CIht...
Exploit for Improperly Controlled Sequential Memory Allocation in Php
PHP2Shell — Hardening e Laboratório Defensivo CVE-2026-1096...
CVE-2026-98656
A flaw was found in the Linux kernel's Industrial I/O IIO subsystem. A race condition occurs when deferred background tasks are not canceled prior to releasing trigger device structures, allowing a worker thread to access memory after it has been freed. A local user could exploit this flaw during...
Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags
============================================================================ Memory disclosure and segfault in libtiff encoder via crafted TIFF tags Location: src/encode.c:1014 in PyImagingLibTiffEncoderNew Commit: a707c6b21c313880d0771e54965d142dd42358b6...
GHSA-XVH5-G6GV-559V Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags
============================================================================ Memory disclosure and segfault in libtiff encoder via crafted TIFF tags Location: src/encode.c:1014 in PyImagingLibTiffEncoderNew Commit: a707c6b21c313880d0771e54965d142dd42358b6...
php: OOM bailout during request parsing leads to memory corruption and RCE
A flaw was found in PHP's memory limit handling during request parsing. PHP records certain state as ready for use before all required memory allocations complete. If an allocation fails due to memory exhaustion, the incomplete state is not rolled back. Subsequent cleanup operations treat the...
GHSA-4RR5-89J8-MWWM Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer
Summary Saving an image as TIFF to an in-memory buffer can trigger a heap use-after-free if libtiff rejects a tag at encode time. When TIFFWriteScanline fails, the encoder frees its output buffer but leaves the libtiff handle open. Later, when the encoder object is torn down, TIFFClose flushes...
Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer
Summary Saving an image as TIFF to an in-memory buffer can trigger a heap use-after-free if libtiff rejects a tag at encode time. When TIFFWriteScanline fails, the encoder frees its output buffer but leaves the libtiff handle open. Later, when the encoder object is torn down, TIFFClose flushes...
PYSEC-2026-4343
Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src/display.c. The handler sizes a DIB allocation from 16-bit-truncated bcWidth and bcHeight fields but copies pixel data using...
PYSEC-2026-4343
Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src/display.c. The handler sizes a DIB allocation from 16-bit-truncated bcWidth and bcHeight fields but copies pixel data using...
CVE-2026-96638
Pillow is a Python imaging library. From 9.1.0 until 13.0.0, BmpRleDecoder.decode in src/PIL/BmpImagePlugin.py permits crafted RLE BMP delta escapes and absolute-mode runs to append beyond the remaining destlength without a per-branch cap. A delta can add roughly 255 image rows in one iteration, ...