CVE-2026-19178 TS4500 Tape Library Race Condition

IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 could allow a remote authenticated attacker to gain unauthorized administrative privileges due to a race condition...

CVE-2026-77684 Bluetooth Classic HFP Hands-Free: TX buffer leak on RFCOMM disconnect leads to permanent Bluetooth denial of service

The Bluetooth Classic Hands-Free Profile HF role in subsys/bluetooth/host/classic/hfphf.c does not release the AT command buffers that are still queued on hf-txpending when the RFCOMM DLC goes down. hfphfdisconnected only cancelled the work items and cleared hf-acl, and no other code path ever...

CVE-2026-19595 Zephyr RTIO syscall verifier validates output parameters for read instead of write access

The user-mode syscall verifier zvrfyrtiocqegetmempoolbuffer in subsys/rtio/rtiosyscalls.c validated its two output parameters, buff and bufflen, with KSYSCALLMEMORYREAD rather than KSYSCALLMEMORYWRITE. Both are pure out-parameters: zimplrtiocqegetmempoolbuffer stores the mempool buffer address an...

CVE-2026-112372 H3C Magic NX15 upload importprofile path traversal

A weakness has been identified in H3C Magic NX15 V100R017. This affects the function importprofile of the file /api/upload. This manipulation of the argument fileName causes path traversal. It is possible to initiate the attack remotely. The exploit has been made available to the public and could...

CVE-2026-112371 H3C Magic NX15 RPC esps write code injection

A vulnerability was determined in H3C Magic NX15 NX15V100R017. Impacted is the function write of the file /api/esps of the component RPC Interface. Executing a manipulation of the argument path can lead to code injection. The attack can be executed remotely. The exploit has been publicly disclose...

CVE-2026-112991 MISP html_to_markdown Module SSRF via Incomplete IP Range Blocking in is_safe_url()

The htmltomarkdown expansion module in MISP Modules contains a server-side request forgery SSRF vulnerability in its issafeurl URL validation function. The BLOCKEDRANGES list used to reject unsafe destination addresses was incomplete, omitting several critical IP address ranges. Specifically, the...

CVE-2026-112370 H3C Magic NX15 usrlist sub_416874 os command injection

A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub416874 of the file /usr/bin/usrlist. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was...

CVE-2026-112901 Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's XBM header parser is vulnerable to regular-expression denial of service. In XbmImageFile.open, when an application calls Image.open on a small crafted XBM file, XbmImagePlugin applies a backtracking expression to the attacker-controlle...

CVE-2026-112900 Pillow: Argument Injection in Ghostscript call, potentially leading into RCE

Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name beginning with a...

CVE-2026-112898 Pillow: Image.quantize() with empty palette leaks uninitialized stack memory

Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack memory when Image.quantize uses an empty palette. ImagingPaletteCacheUpdate leaves a local cache array uninitialized when the palette has zero entries, and the conversion path emits those bytes as...

CVE-2026-112897 Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips

Pillow is a Python imaging library. From 5.3.0 until 13.0.0, Pillow can return uninitialized memory as pixels when libtiff performs a short decode of JPEG-compressed or Group 4 fax TIFF data. The decodeStrip and decodeTile buffers can be larger than the bytes written by libtiff, but Pillow conver...

CVE-2026-112896 Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's TIFF encoder can read beyond a ColorMap buffer when retained TIFF metadata has a plane size inconsistent with BitsPerSample. A small TIFF can be opened normally and then retain a crafted ColorMap that is reused when the image is saved...

CVE-2026-112895 Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can exhaust resources while parsing an existing PDF during an append operation. PdfParser follows page-tree child references without cycle or duplication tracking and follows previous-trailer chains with only an exact...

CVE-2026-112894 Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve PDF object identifiers when saving many frames with saveall enabled. PdfParser.nextobjectid repeatedly rebuilds and scans all previously reserved identifiers for every object. An attacker can suppl...

CVE-2026-112893 Pillow: Invalid free in FreeType glyph rendering when a stroker is active

Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FTLoadGlyph fails, cleanup may call FTDoneGlyph on an uninitialized or stale glyph variable. An attacker can supply a malformed font as...

CVE-2026-112361 Dolibarr CSP document.php protection mechanism

A vulnerability has been found in Dolibarr up to 23.0.2. The impacted element is an unknown function of the file htdocs/document.php of the component CSP. Such manipulation leads to protection mechanism failure. The attack can be executed remotely. Upgrading to version 24.0.0 is sufficient to...

CVE-2026-112261 Gimp: gimp: use-after-free in xcf loader via prop_selected_path

A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free in the main process, leading to a crash and potentially arbitrary code execution...

CVE-2026-112258 Gimp: gimp: use-after-free in xcf loader via prop_linked and prop_selection on channels

A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leading to a crash and potentially arbitrary code...

CVE-2026-112257 Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033)

A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash...

CVE-2026-112892 Pillow: MSP RLE decoder expands a tiny file into unbounded memory

Pillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow's MSP RLE decoder can expand a small file into an unbounded in-memory buffer. The decoder writes run-length output to BytesIO without limiting expansion to the declared image size. An attacker can supply a crafted MSP image to an...

CVE-2026-112891 Pillow: Quadratic GIF comment copying during save

Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow performs quadratic copying when saving a GIF with a long comment. getglobalheader repeatedly copies portions of comment data while assembling the global header, including comments retained from an untrusted input image. An attack...

CVE-2026-112406 Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite loop while rewriting PDF pages. PdfParser.rewritepages follows Parent relationships without detecting a cycle in the page tree. An attacker can supply a cyclic PDF to an application that appends an image to...

CVE-2026-112360 Netis EAP930 CGI Endpoint debug return200 backdoor

A security vulnerability has been detected in Netis EAP930 1.250905.115454. This issue affects the function return200 of the file /cgi-bin/debug of the component CGI Endpoint. The manipulation of the argument SIGNATURE leads to backdoor. The attack may be initiated remotely. A high degree of...

CVE-2026-112405 Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0

Pillow is a Python imaging library. From 12.0.0 until 13.0.0, Pillow's Image.merge can dereference a null image8 plane. Validation skips the first input band, allowing a 32-bit integer or floating-point image backed by image32 storage to be merged as a narrower multiband image. A crafted IPTC fil...

CVE-2026-112404 Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels

Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can read beyond row data produced by libtiff. In decodeTile and the RGBA unpacker path, when Pillow and libtiff interpret duplicated PhotometricInterpretation or BitsPerSample tags differently,...

CVE-2026-105815 Credential Material Exposure Leading to Unauthorized Streamed Media-Session Access in TP-Link Tapo C210

TP-Link Tapo C210 V3.60 may expose shared credential material and cryptographic metadata through unauthenticated DS JSON API requests. The exposed shared credential can be accepted by the Streamd Digest authentication mechanism as an administrative password, allowing an unauthenticated...

CVE-2026-105814 Order-Dependent Authentication Bypass in the DS JSON API in TP-Link Tapo C210

TP-Link Tapo C210 V3.60 contains an authentication bypass vulnerability in the DS JSON API. A crafted JSON request containing both a protected operation and public onboarding-related fields may cause module-level authorization checks to be applied inconsistently, allowing protected camera...

CVE-2026-112403 Pillow: Heap buffer overflow in ImagingJpegDecode

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a full-width scanline into a buffer sized for a requested draft scale. ImagingJpegDecode does not verify libjpeg's actual output width and component count after scaling is requested, and an 8-bit lossless SOF3 JP...

CVE-2026-112402 Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform

Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double free image memory when ImagingScaleAffine encounters a selective allocation failure. The affected fast path handles Transform.EXTENT or pure scale-and-translate Transform.AFFINE operations with the default NEAREST resampling...

CVE-2026-112397 Pillow: Out-of-bounds access in _imagingmorph on a zero-width image

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's ImageMorph.MorphOp.apply can access memory before a row buffer for a zero-width image. PPM and PGM input can create an image with width zero, and the native morphology routine indexes outrowwidth - 1 without rejecting that geometry. An...

CVE-2026-112392 Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand allocates a non-empty output and then faults while replicating edges by reading the first pixel from empty input storage; ImagingRankFilter i...

CVE-2026-112401 Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()

Pillow is a Python imaging library. From 5.4.0 until 13.0.0, Pillow performs quadratic copying while parsing GIF comments. GifImageFile.seek repeatedly appends immutable bytes for comment sub-blocks and multiple comment extensions, and frame zero is parsed during Image.open. An attacker can submi...

CVE-2026-112358 TiBillet Lespass APIv1 serializers.py get_img_from_url server-side request forgery

A weakness has been identified in TiBillet Lespass up to 10e87909c5d526dffa6d424c104fc12860740537. This vulnerability affects the function getimgfromurl of the file ApiBillet/serializers.py of the component APIv1. Executing a manipulation of the argument imgurl/imageurl can lead to server-side...

CVE-2026-112400 Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS

Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected GIF frame size after a decompression-bomb exception. In GifImageFile.seek, a crafted GIF can leave rejected dimensions stored after Image.DecompressionBombError; if an application catches that exception and...

CVE-2026-112399 Pillow: APNG background disposal allocates full canvas before decompression bomb check

Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow can allocate an APNG disposal background at the full canvas size before applying the decompression-bomb check. A crafted APNG with a small first frame, a very large declared canvas, and background disposal or first-frame OPPREVIO...

CVE-2026-112398 Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix JPEG-tile decoder can write decoded scanlines beyond the allocated tile buffer. FlashPix FPX JPEG decoding selects raw mode LA with two bytes per pixel, while an unrecognized JPEG mode can be decoded as JCSUNKNOWN with four...

CVE-2026-53995 MLflow 3.17.1 and prior Path Traversal via Trace ID API

MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit...

CVE-2026-112396 Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer

Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when libtiff rejects a tag while encoding TIFF data to an in-memory buffer. When an application saves attacker-influenced TIFF tags to BytesIO, libtiff can reject a tag during encoding in...

CVE-2026-112302 kiwilan php-archive Extraction ArchiveZip.php extract path traversal

A weakness has been identified in kiwilan php-archive up to 2.3.02. This affects the function ArchiveZip::extract of the file src/Readers/ArchiveZip.php of the component Extraction. This manipulation causes path traversal. The attack is possible to be carried out remotely. The exploit has been ma...

CVE-2026-112395 Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)

Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read past the tile buffer while copying four-byte pixels. In decodeTile, libtiff can return a tile allocation smaller than the required row stride multiplied by the tile length, and Pillow's stride-and-co...

CVE-2026-111946 Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header

Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header. When the response body is a filehandle and the fileetag option is not set, the ETag is built from the file's inode number, modification time and size. Clients receiving affected...

CVE-2026-112394 Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's P;2L and P;4L raw decoders can read past the end of an input buffer. ImagingRawDecode calculates a packed-pixel row size, while the unpackers read separately padded bit planes. A caller can supply a buffer and image dimensions whose...

CVE-2026-112393 Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO

Pillow is a Python imaging library. From 2.0.0 until 13.0.0, Pillow has a heap buffer overflow and stale-heap disclosure in tiffWriteProc when saving compressed TIFF data through libtiff to a target without a usable fileno, such as BytesIO. The callback sizes its allocation from the prior buffer...

CVE-2026-112301 orbitale imagemagick-php Command.php font os command injection

A security flaw has been discovered in orbitale imagemagick-php up to 3.3.5. Affected by this issue is the function Command::font of the file src/Command.php. The manipulation of the argument fontFile results in os command injection. The attack can be executed remotely. The exploit has been...

CVE-2026-112391 Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow's PdfParser.getvalue can recurse without a limit while reading nested PDF objects. The parser follows attacker-controlled arrays and dictionaries when an existing PDF is opened for append. An attacker can provide a deeply nested...

CVE-2026-76788 Stack out-of-bounds write in the OSDP Control Panel reply parser

The OSDP Control Panel reply parser cpdecoderesponse in subsys/mgmt/osdp/src/osdpcp.c decodes replies from a Peripheral Device into a stack-allocated struct osdpevent. For the REPLYKEYPPAD and REPLYRAW reply types, the payload length is taken from the received frame and the only validation...

CVE-2026-76787 NULL pointer dereference in the UpdateHub FOTA client when probe metadata omits sha256sum

The UpdateHub firmware-over-the-air client parses the CoAP probe response with Zephyr's JSON library in zimplupdatehubprobe subsys/mgmt/updatehub/updatehub.c. The decoder treats every descriptor field as optional — jsonobjparse returns a bitmask of the fields it actually decoded and never fails o...

CVE-2026-112390 Pillow: Infinite loop in MIC n_frames when the embedded TIFF

Pillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an infinite loop while determining the frame count of a MIC image. MicImageFile inherits TIFF frame traversal, but MicImageFile.tell reports the OLE stream index and its seek resets TIFF frame state, so an embedded TIFF...

CVE-2026-112300 DiffSK configobj __init__.py _sectionmarker redos

A vulnerability was identified in DiffSK configobj up to 5.0.9. Affected by this vulnerability is the function sectionmarker of the file configobj/init.py. The manipulation leads to inefficient regular expression complexity. Remote exploitation of the attack is possible. The project was informed ...

CVE-2026-112299 smrealms smr Album Website AlbumEditProcessor.php isUrlReachable server-side request forgery

A vulnerability was determined in smrealms smr up to f40380c017bc35cd8db6ffdb9d4e78bf65b9d43d. Affected is the function isUrlReachable of the file src/pages/Account/AlbumEditProcessor.php of the component Album Website. Executing a manipulation of the argument Website can lead to server-side...