pillow: pillow: Denial of service via crafted PDF during append operations

A flaw was found in Pillow. This vulnerability allows a remote attacker to cause a Denial of Service DoS by supplying a specially crafted PDF document to an application performing PDF append operations. Because the PDF parser fails to properly track cyclic or deeply nested object references,...

pillow: pillow: Denial of service via crafted PDF during append operations

A flaw was found in Pillow. This vulnerability allows a remote attacker to cause a Denial of Service DoS by supplying a specially crafted PDF document to an application performing PDF append operations. Because the PDF parser fails to properly track cyclic or deeply nested object references,...

pillow: pillow: Denial of service via crafted PDF during append operations

A flaw was found in Pillow. This vulnerability allows a remote attacker to cause a Denial of Service DoS by supplying a specially crafted PDF document to an application performing PDF append operations. Because the PDF parser fails to properly track cyclic or deeply nested object references,...

pillow: pillow: Denial of service via crafted PDF during append operations

A flaw was found in Pillow. This vulnerability allows a remote attacker to cause a Denial of Service DoS by supplying a specially crafted PDF document to an application performing PDF append operations. Because the PDF parser fails to properly track cyclic or deeply nested object references,...

pillow: pillow: Denial of service via crafted PDF during append operations

A flaw was found in Pillow. This vulnerability allows a remote attacker to cause a Denial of Service DoS by supplying a specially crafted PDF document to an application performing PDF append operations. Because the PDF parser fails to properly track cyclic or deeply nested object references,...

About Time Technologies Herowatch Go Server authorization issue vulnerability

The Herowatch Go Server by About Time Technologies contains an authorization issue vulnerability stemming from unsafe direct object references. Authenticated remote attackers can exploit this flaw by modifying certain parameters to access or manipulate data and features belonging to other users...

pillow: pillow: Denial of service via crafted PDF during append operations

A flaw was found in Pillow. This vulnerability allows a remote attacker to cause a Denial of Service DoS by supplying a specially crafted PDF document to an application performing PDF append operations. Because the PDF parser fails to properly track cyclic or deeply nested object references,...

ThinkGEM JeeSite authorization issue vulnerability

Versions 5.11.0 through 5.19.1 of thinkgem JeeSite contain an authorization issue vulnerability. This vulnerability stems from unsafe direct object references within the AI CMS chat module. Due to the absence of proper ownership checks and reversal mechanisms, authenticated attackers can utilize...

YunaiV yudao-cloud authorization issue vulnerability

Versions 2026.09 and earlier of YunaiV yudao-cloud contain an authorization issue vulnerability. This vulnerability stems from unsafe direct object references within the mall trade module. Authentication members can exploit this by providing any valid afterSaleId value and enumerating subsequent...

ONE ARMY authorization issue vulnerability

Versions prior to ONE ARMY 2.165.2 contain an authorization issue vulnerability. This vulnerability stems from unsafe direct object references; authenticated users can mark notifications from other users as read via POST /api/notifications/:id/read. Attackers can then iterate through consecutive...

CervantesSec Cervantes authorization issue vulnerability

Versions 0.3 through 1.3-beta of CervantesSec contain an authorization issue vulnerability. This vulnerability stems from unsafe direct object references; authenticated attackers can access sensitive findings, concept validation details, credentials, and customer information that do not belong to...

PT-2026-122420

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires loading relevant parts of a file like their pages where the same, but non-existent indirect object is referenced multiple times. Patches This has been fixed in pypdf==6.21.2. Workarounds If...

CVE-2026-112895

A flaw was found in Pillow. This vulnerability allows a remote attacker to cause a Denial of Service DoS by supplying a specially crafted PDF document to an application performing PDF append operations. Because the PDF parser fails to properly track cyclic or deeply nested object references,...

Modoboa authorization issue vulnerability

Versions of Modoboa prior to 2.8.0 contained an authorization issue vulnerability. This vulnerability stemmed from insecure direct object references. Certified users can delete alarms from other domains using the POST /api/v2/alarms/bulkdelete/ endpoint. Attackers can enumerate sequential alarm I...

Modoboa authorization issue vulnerability

Versions of Modoboa prior to 2.8.0 contained an authorization issue vulnerability. This vulnerability stemmed from insecure direct object references. Certified users could create automatic reply messages for any email address by providing the mbox value of another user. Attackers could also send...

Grafana Enterprise: Permissions, licensing, and access control issues

Grafana Enterprise versions 11.6.0 to 12.3.11, 12.4.13, and 12.4.x prior to version 12.4.13, 13.0.11 prior to version 13.0.x, 13.1.8 prior to version 13.1.x, and 13.2.4 prior to version 13.2.x have security vulnerabilities. These vulnerabilities stem from insecure direct object references in the...

Coze-Dev and Coze-Studio: Authorization issue vulnerabilities

In versions of coze-dev and coze-studio prior to 0.5.1, there is an authorization issue vulnerability. This vulnerability stems from insecure direct object references in the workflow.go file. It allows authenticated users to access workflows in other spaces by providing the workflow ID of that...

Krayin Laravel-CRM authorization issue vulnerability

The Krayin Laravel-CRM versions prior to 2.2.7 have a vulnerability related to authorization. This vulnerability stems from insecure direct object references in the QuoteController, along with improper execution of data range checks for each user. As a result, authenticated users with limited...

WordPress Tutor LMS Authorization Issue Vulnerability

WordPress Tutor LMS versions 4.1.0 and earlier have an authorization issue vulnerability. This vulnerability stems from Input::sanitizearray, which does not remove the POST keys provided by attackers including IDs, resulting in a lack of validation for user-controlled keys. This leads to insecure...

Hui Ge Open Source Charging Station Platform HUIZHI-ChargeOS-cloud: Authorization Issues and Vulnerabilities

The HUIZHI-ChargeOS-cloud 3.0.9 and earlier versions have an authorization issue vulnerability. This vulnerability stems from the fact that the hcp-mp MeController and OrderController trust the userId, openId, and orderNumber parameters provided by clients. There are insecure direct object...