424766 matches found
PT-2026-120338
Affected versions include emSign ECC Root CA - G3, which can allow certificate paths through distrusted emSign intermediates. Affected versions may accept certificate paths containing distrusted emSign intermediate public keys. The private keys corresponding to these intermediates are now well...
PT-2026-117410
SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled rid. Attackers can submit streaming /generate requests with single hex character rids and disconnect, triggering...
PT-2026-117671
Name of the Vulnerable Software and Affected Versions Pillow versions 12.0.0 through 12.x Description The Image.merge function can dereference a null image8 plane because validation skips the first input band. This allows a 32-bit integer or floating-point image backed by image32 storage to be...
PT-2026-117675
Name of the Vulnerable Software and Affected Versions Pillow versions 10.0.0 through 12.9.9 Description During FreeType rendering with an active stroker, the library may free an invalid glyph pointer. This occurs when the FT Load Glyph function fails, leading the cleanup process to call FT Done...
PT-2026-117646
Name of the Vulnerable Software and Affected Versions Pillow versions 5.1.0 through 12.11.0 Description The PdfParser.get value function can recurse without a limit when reading nested PDF objects. This occurs when the parser follows attacker-controlled arrays and dictionaries while an existing P...
PT-2026-117661
Name of the Vulnerable Software and Affected Versions MLflow versions prior to 3.17.2 Description The FileStore tracking backend contains a path traversal issue. Unauthenticated attackers can control filesystem paths by submitting a crafted trace ID containing traversal sequences to the 'POST...
PT-2026-117676
Name of the Vulnerable Software and Affected Versions Pillow versions 5.1.0 through 12.11.0 Description When saving many frames with save all enabled, the library takes quadratic time to reserve PDF object identifiers. This occurs because the PdfParser.next object id function repeatedly rebuilds...
PT-2026-117657
Name of the Vulnerable Software and Affected Versions Pillow versions 8.1.0 through 12.11.0 Description An issue exists where the library can allocate an APNG disposal background at the full canvas size before the decompression-bomb check is applied. A specially crafted APNG file containing a sma...
PT-2026-117687
Name of the Vulnerable Software and Affected Versions Pillow versions prior to 13.0.0 Description The XBM header parser in the Python imaging library is susceptible to a regular-expression denial of service. When the Image.open function is called on a specially crafted XBM file, the XbmImagePlugi...
PT-2026-117617
Name of the Vulnerable Software and Affected Versions Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System versions prior to 3.6 Description An unauthenticated SQL injection exists in the /ws.asmx endpoint. The issue occurs when the sql argument is...
PT-2026-117673
Name of the Vulnerable Software and Affected Versions Pillow versions 9.2.0 through 12.11.0 Description When saving a GIF with a long comment, the library performs quadratic copying. The get global header function repeatedly copies portions of comment data while assembling the global header, whic...
PT-2026-117684
Name of the Vulnerable Software and Affected Versions Pillow versions 5.3.0 through 12.11.0 Description Pillow can return uninitialized memory as pixels when libtiff performs a short decode of JPEG-compressed or Group 4 fax TIFF data. This occurs because the decodeStrip and decodeTile buffers may...
PT-2026-117653
Name of the Vulnerable Software and Affected Versions Pillow versions prior to 13.0.0 Description Rank-based filters in the Pillow Python imaging library can dereference invalid image storage when processing a zero-size image. The ImagingExpand function allocates a non-empty output but faults...
PT-2026-117655
Name of the Vulnerable Software and Affected Versions Pillow versions prior to 13.0.0 Description A flaw exists in the Python imaging library where the ImageMorph.MorphOp.apply function can access memory before a row buffer when processing images with a width of zero. This occurs because the PPM...
PT-2026-117677
Name of the Vulnerable Software and Affected Versions Pillow versions 5.1.0 through 12.9.9 Description Pillow can exhaust system resources when parsing an existing PDF during an append operation. The PdfParser follows page-tree child references without tracking cycles or duplications and follows...
PT-2026-117683
Name of the Vulnerable Software and Affected Versions Pillow versions prior to 13.0.0 Description The TIFF encoder in Pillow can perform an out-of-bounds read when processing images with retained TIFF metadata where the plane size is inconsistent with BitsPerSample. An attacker can provide a...
PT-2026-117660
Name of the Vulnerable Software and Affected Versions Pillow versions prior to 13.0.0 Description A double free of image memory can occur when the ImagingScaleAffine function encounters a selective allocation failure. This happens during the fast path processing of Transform.EXTENT or pure...
PT-2026-117685
Name of the Vulnerable Software and Affected Versions Pillow versions 9.1.0 through 12.x Description Pillow can disclose uninitialized stack memory when the Image.quantize function uses an empty palette. This occurs because the ImagingPaletteCacheUpdate function leaves a local cache array...
PT-2026-117432
Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users with webhook permissions to reach internal addresses via DNS rebinding. Attackers can return a public address during WebhookService::isSafeEndpoint validation and an internal address when Guzzle...
PT-2026-131973
TuxCare rebuilt @angular/service-worker to address 1 CVE. Fixed in 5.1.0-tuxcare.1...
PT-2026-117303
A vulnerability was determined in DeepPavlov up to 1.7.0. This affects the function MultiTaskPipelinePreprocessor. init of the file deeppavlov/models/preprocessors/multitask preprocessor.py. This manipulation of the argument preprocessor causes code injection. The attack is possible to be carried...
PT-2026-133119
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.7.0-tuxcare.1...
PT-2026-133124
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 8 CVEs. Fixed in 2.18.5-tuxcare.1...
PT-2026-118034
ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud getFileURL Endpoint Leads to Remote Denial of Service in github.com/luskaner/ageLANServer/server...
PT-2026-131412
TuxCare rebuilt @angular/platform-browser-dynamic to address 17 CVEs. Fixed in 18.1.2-tuxcare.2...
PT-2026-133148
TuxCare rebuilt @babel/plugin-transform-react-jsx-source to address 1 CVE. Fixed in 7.16.7-tuxcare.3...
PT-2026-133196
TuxCare rebuilt @babel/plugin-transform-destructuring to address 2 CVEs. Fixed in 7.21.5-tuxcare.2...
PT-2026-133200
TuxCare rebuilt @babel/plugin-transform-destructuring to address 2 CVEs. Fixed in 7.23.0-tuxcare.1...
PT-2026-133185
TuxCare rebuilt markdown-it to address 2 CVEs. Fixed in 12.3.0-tuxcare.2...
PT-2026-117333
Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.2.0 through 4.18.4 Apache Camel versions 4.19.0 through 4.22.0 Description A path traversal issue exists in the Apache Camel SMB component. The remote-file consumers build absolute remote paths by concatenating a...
PT-2026-133149
TuxCare rebuilt @babel/plugin-transform-react-jsx-source to address 1 CVE. Fixed in 7.25.7-tuxcare.4...
PT-2026-131762
TuxCare rebuilt @angular/service-worker to address 11 CVEs. Fixed in 6.0.1-tuxcare.4...
PT-2026-131760
TuxCare rebuilt @angular/service-worker to address 20 CVEs. Fixed in 16.2.11-tuxcare.1...
PT-2026-131312
TuxCare rebuilt @angular/platform-server to address 1 CVE. Fixed in 15.2.10-tuxcare.4...
PT-2026-131310
TuxCare rebuilt @angular/platform-server to address 2 CVEs. Fixed in 12.2.17-tuxcare.9...
PT-2026-131319
TuxCare rebuilt @angular/platform-server to address 1 CVE. Fixed in 18.1.2-tuxcare.3...
PT-2026-133205
TuxCare rebuilt fast-xml-parser to address 7 CVEs. Fixed in 5.2.5-tuxcare.1...
PT-2026-133202
TuxCare rebuilt dompurify to address 5 CVEs. Fixed in 3.0.5-tuxcare.2...
PT-2026-132041
TuxCare rebuilt 7 io.micrometer packages to address 1 CVE. Fixed in 1.5.12-tuxcare.2...
PT-2026-132634
TuxCare rebuilt @react-router/dev to address 3 CVEs. Fixed in 7.5.1-tuxcare.5...
PT-2026-131946
TuxCare rebuilt @angular/service-worker to address 2 CVEs. Fixed in 8.0.3-tuxcare.4...
PT-2026-131557
TuxCare rebuilt @angular/platform-browser-dynamic to address 1 CVE. Fixed in 9.1.13-tuxcare.4...
PT-2026-132042
TuxCare rebuilt 3 io.projectreactor packages to address 1 CVE. Fixed in 3.4.22-tuxcare.1...
PT-2026-131523
TuxCare rebuilt @angular/platform-browser-dynamic to address 1 CVE. Fixed in 18.2.14-tuxcare.17...
PT-2026-131905
TuxCare rebuilt @angular/service-worker to address 1 CVE. Fixed in 12.0.0-tuxcare.1...
PT-2026-118089
SFTPGo source-side file-pattern filter bypass during copy operations in github.com/drakkan/sftpgo...
PT-2026-131800
TuxCare rebuilt @angular/service-worker to address 3 CVEs. Fixed in 8.0.0-tuxcare.5...
PT-2026-130801
TuxCare rebuilt @angular/platform-browser to address 2 CVEs. Fixed in 15.2.9-tuxcare.3...