11x-wagtail-blog (>=0.0.0, <=0.2.0), 170051277-trab-final-gces (>=0.3.0, <=0.5.0) +10599 more potentially affected by CVE-2026-112399 via pillow (>=8.1.0, <=12.3.0)

pillow PYPI version =8.1.0, =0.0.0, =0.3.0, =0.1.0, =0.2.2, =0.5.0a0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.7 and more Source cves: CVE-2026-112399 Source advisory: OSV:GHSA-5XM2-6676-QCP9...

3d-rcnet (>=0.2.2, <=0.2.3), 3lc (>=3.2.0, <=3.4.2) +3208 more potentially affected by CVE-2026-114501 via pillow (>=12.0.0, <=12.3.0)

pillow PYPI version =12.0.0, =0.2.2, =3.2.0, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.6, =0.1.0, =0.0.1, =0.5.0, =0.0.6, =0.0.93, =0.0.94 and more Source cves: CVE-2026-114501 Source advisory: MEND:CVE-2026-114501...

11x-wagtail-blog (>=0.0.0, <=0.2.0), 170051277-trab-final-gces (>=0.3.0, <=0.5.0) +11311 more potentially affected by CVE-2026-112892 via pillow (>=4.1.0, <=12.3.0)

pillow PYPI version =4.1.0, =0.0.0, =0.3.0, =0.1.0, =0.2.2, =0.5.0a0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.7 and more Source cves: CVE-2026-112892 Source advisory: GHSA-GG2R-WVFM-Q9RX...

11x-wagtail-blog (>=0.0.0, <=0.2.0), 170051277-trab-final-gces (>=0.3.0, <=0.5.0) +11311 more potentially affected by CVE-2026-112892 via pillow (>=4.1.0, <=12.3.0)

pillow PYPI version =4.1.0, =0.0.0, =0.3.0, =0.1.0, =0.2.2, =0.5.0a0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.7 and more Source cves: CVE-2026-112892 Source advisory: OSV:GHSA-GG2R-WVFM-Q9RX...

11x-wagtail-blog (>=0.0.0, <=0.2.0), 170051277-trab-final-gces (>=0.3.0, <=0.5.0) +11229 more potentially affected by CVE-2026-112894 via pillow (>=5.1.0, <=12.3.0)

pillow PYPI version =5.1.0, =0.0.0, =0.3.0, =0.1.0, =0.2.2, =0.5.0a0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.7 and more Source cves: CVE-2026-112894 Source advisory: GHSA-JG86-V3JV-HRPM...

11x-wagtail-blog (>=0.0.0, <=0.2.0), 170051277-trab-final-gces (>=0.3.0, <=0.5.0) +11229 more potentially affected by CVE-2026-112894 via pillow (>=5.1.0, <=12.3.0)

pillow PYPI version =5.1.0, =0.0.0, =0.3.0, =0.1.0, =0.2.2, =0.5.0a0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.7 and more Source cves: CVE-2026-112894 Source advisory: OSV:GHSA-JG86-V3JV-HRPM...

11x-wagtail-blog (>=0.0.0, <=0.2.0), 170051277-trab-final-gces (>=0.3.0, <=0.5.0) +11229 more potentially affected by CVE-2026-112391 via pillow (>=5.1.0, <=12.3.0)

pillow PYPI version =5.1.0, =0.0.0, =0.3.0, =0.1.0, =0.2.2, =0.5.0a0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.7 and more Source cves: CVE-2026-112391 Source advisory: OSV:GHSA-254F-3936-288H...

11x-wagtail-blog (>=0.0.0, <=0.2.0), 170051277-trab-final-gces (>=0.3.0, <=0.5.0) +11229 more potentially affected by CVE-2026-112391 via pillow (>=5.1.0, <=12.3.0)

pillow PYPI version =5.1.0, =0.0.0, =0.3.0, =0.1.0, =0.2.2, =0.5.0a0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.7 and more Source cves: CVE-2026-112391 Source advisory: GHSA-254F-3936-288H...

3d-rcnet (>=0.2.2, <=0.2.3), 3lc (>=3.2.0, <=3.4.2) +3208 more potentially affected by CVE-2026-96639 via pillow (>=12.0.0, <=12.3.0)

pillow PYPI version =12.0.0, =0.2.2, =3.2.0, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.6, =0.1.0, =0.0.1, =0.5.0, =0.0.6, =0.0.93, =0.0.94 and more Source cves: CVE-2026-96639 Source advisory: MEND:CVE-2026-96639...

3d-rcnet (>=0.2.2, <=0.2.3), 3lc (>=3.2.0, <=3.4.2) +3208 more potentially affected by CVE-2026-96636 via pillow (>=12.0.0, <=12.3.0)

pillow PYPI version =12.0.0, =0.2.2, =3.2.0, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.6, =0.1.0, =0.0.1, =0.5.0, =0.0.6, =0.0.93, =0.0.94 and more Source cves: CVE-2026-96636 Source advisory: MEND:CVE-2026-96636...

11x-wagtail-blog (>=0.0.0, <=0.2.0), 170051277-trab-final-gces (>=0.3.0, <=0.5.0) +11229 more potentially affected by CVE-2026-96640 via pillow (>=5.1.0, <=12.3.0)

pillow PYPI version =5.1.0, =0.0.0, =0.3.0, =0.1.0, =0.2.2, =0.5.0a0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.7 and more Source cves: CVE-2026-96640 Source advisory: SNYK:PYTHON-PILLOW-21431018...

3d-rcnet (>=0.2.2, <=0.2.3), 3lc (>=3.2.0, <=3.4.2) +3208 more potentially affected by CVE-2026-96640 via pillow (>=12.0.0, <=12.3.0)

pillow PYPI version =12.0.0, =0.2.2, =3.2.0, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.6, =0.1.0, =0.0.1, =0.5.0, =0.0.6, =0.0.93, =0.0.94 and more Source cves: CVE-2026-96640 Source advisory: MEND:CVE-2026-96640...

3d-rcnet (>=0.2.2, <=0.2.3), 3lc (>=3.2.0, <=3.4.2) +3208 more potentially affected by CVE-2026-96637 via pillow (>=12.0.0, <=12.3.0)

pillow PYPI version =12.0.0, =0.2.2, =3.2.0, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.6, =0.1.0, =0.0.1, =0.5.0, =0.0.6, =0.0.93, =0.0.94 and more Source cves: CVE-2026-96637 Source advisory: MEND:CVE-2026-96637...

3d-rcnet (>=0.2.2, <=0.2.3), 3lc (>=3.2.0, <=3.4.2) +3208 more potentially affected by CVE-2026-96778 via pillow (>=12.0.0, <=12.3.0)

pillow PYPI version =12.0.0, =0.2.2, =3.2.0, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.6, =0.1.0, =0.0.1, =0.5.0, =0.0.6, =0.0.93, =0.0.94 and more Source cves: CVE-2026-96778 Source advisory: MEND:CVE-2026-96778...

@engenty/wizards (>=0.7.9, <=0.11.13), @findsl/cli (>=1.0.0-rc.1, <=1.2.0) +16 more potentially affected by CVE-2026-114491 via pdfmake (>=0.3.8, <=0.3.11)

pdfmake NPM version =0.3.8, =0.7.9, =1.0.0-rc.1, =1.0.0-rc.1, =1.0.0-rc.1, =0.4.0, =0.4.0, =0.1.0, =262.1026.0, =262.1038.0, =262.1007.0, =1.1.589, =0.0.0-experimental-20260909123240, =0.10.1, =2.0.8-20260610134350, =0.0.0-experimental-1b2e794, =0.0.0-experimental-b4839cb and more Source cves:...

@vaadin/react-components-pro (>=24.10.0, <=24.10.6), @vaadin/vaadin (>=24.10.0, <=24.10.10) potentially affected by CVE-2026-107588 via @vaadin/charts (>=24.10.0, <=24.10.6)

@vaadin/charts NPM version =24.10.0, =24.10.0, =24.10.0, =24.10.10 Source cves: CVE-2026-107588 Source advisory: SNYK:JS-VAADINCHARTS-21691580...

@vaadin/react-components-pro (>=25.0.0, <=25.2.13), @vaadin/vaadin (>=25.0.0, <=25.3.0-alpha3) potentially affected by CVE-2026-107588 via @vaadin/charts (>=25.0.0, <=25.2.13)

@vaadin/charts NPM version =25.0.0, =25.0.0, =25.0.0, =25.3.0-alpha3 Source cves: CVE-2026-107588 Source advisory: SNYK:JS-VAADINCHARTS-21691580...

@vaadin/react-components-pro (>=24.5.0, <=24.7.12), @vaadin/vaadin (>=24.5.0, <=24.8.0-alpha1) potentially affected by CVE-2026-107588 via @vaadin/charts (>=24.5.0, <=24.7.12)

@vaadin/charts NPM version =24.5.0, =24.5.0, =24.5.0, =24.8.0-alpha1 Source cves: CVE-2026-107588 Source advisory: SNYK:JS-VAADINCHARTS-21691580...

@vaadin/react-components-pro (25.3.0), @vaadin/vaadin (25.3.0) potentially affected by CVE-2026-107588 via @vaadin/charts (25.3.0)

@vaadin/charts NPM version 25.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on @vaadin/charts and may be impacted: - @vaadin/react-components-pro 25.3.0 - @vaadin/vaadin 25.3.0 Source cves: CVE-2026-107588 Source advisory: SNYK:JS-VAADINCHARTS-21691...

@vaadin/react-components-pro (>=24.8.0, <=24.9.18), @vaadin/vaadin (>=24.8.0-rc2, <=24.10.0-alpha1) potentially affected by CVE-2026-107588 via @vaadin/charts (>=24.8.0, <=24.9.18)

@vaadin/charts NPM version =24.8.0, =24.8.0, =24.8.0-rc2, =24.10.0-alpha1 Source cves: CVE-2026-107588 Source advisory: SNYK:JS-VAADINCHARTS-21691580...

@hilla/react-components (>=2.0.0, <=2.4.0-alpha2), @hilla/react-crud (>=2.3.0-beta1, <=2.5.8) +6 more potentially affected by CVE-2026-107588 via @vaadin/charts (>=24.0.0, <=24.4.18)

@vaadin/charts NPM version =24.0.0, =2.0.0, =2.3.0-beta1, =2.3.0-alpha1, =24.4.0-alpha10, =24.4.0-alpha12, =24.4.0-alpha10, =24.0.0-rc3, =24.4.23 - hilla-admin-react 1.0.0 Source cves: CVE-2026-107588 Source advisory: SNYK:JS-VAADINCHARTS-21691580...

com.vaadin:vaadin-jandex (>=24.5.0, <=24.7.15), com.vaadin:vaadin-platform-javadoc (>=24.5.0, <=24.7.15) +4 more potentially affected by CVE-2026-107588 via com.vaadin:vaadin (>=24.5.0, <=24.7.15)

com.vaadin:vaadin MAVEN version =24.5.0, =24.5.0, =24.5.0, =24.7.15 - com.vaadin:vaadin-testbench-unit 9.3.15 - com.vaadin:vaadin-testbench-unit-junit5 9.3.15 - com.vaadin:vaadin-testbench-unit-quarkus 9.3.15 - com.vaadin:vaadin-testbench-unit-shared 9.3.15 Source cves: CVE-2026-107588 Source...

com.svenruppert.vaadin:nano-vaadin-jetty (04.00.00), com.vaadin:browserless-test-junit6 (>=1.0.0-rc1, <=1.1.2) +13 more potentially affected by CVE-2026-107588 via com.vaadin:vaadin (>=25.0.0, <=25.2.9)

com.vaadin:vaadin MAVEN version =25.0.0, =1.0.0-rc1, =1.1.1, =1.0.0-rc1, =1.0.0-rc1, =1.1.0-rc1, =25.0.0, =25.0.0, =10.0.1, =10.0.1, =25.2.0-rc1, =10.0.1, =10.0.1, =1.0.561, =1.0.562 Source cves: CVE-2026-107588 Source advisory: SNYK:JAVA-COMVAADIN-21691577...

com.vaadin:vaadin (>=22.0.0, <=23.6.15), com.vaadin:vaadin-charts-flow-demo (>=22.0.0, <=23.0.16) +80 more potentially affected by CVE-2026-107588 via com.vaadin:vaadin-charts-flow (>=22.0.0, <=23.6.15)

com.vaadin:vaadin-charts-flow MAVEN version =22.0.0, =22.0.0, =22.0.0, =22.0.0, =22.0.0, =22.0.0, =8.3.1, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.4 and more Source cves: CVE-2026-107588 Source advisory: SNYK:JAVA-COMVAADIN-21691578...

com.vaadin:vaadin-jandex (>=24.8.0, <=24.9.22), com.vaadin:vaadin-platform-javadoc (>=24.8.0, <=24.9.22) +4 more potentially affected by CVE-2026-107588 via com.vaadin:vaadin (>=24.8.0, <=24.9.22)

com.vaadin:vaadin MAVEN version =24.8.0, =24.8.0, =24.8.0, =9.4.4, =9.4.4, =9.4.4, =9.4.4, =9.5.8 Source cves: CVE-2026-107588 Source advisory: SNYK:JAVA-COMVAADIN-21691577...

com.vaadin:vaadin-jandex (>=24.10.0, <=24.10.10), com.vaadin:vaadin-platform-javadoc (>=24.10.0, <=24.10.10) +5 more potentially affected by CVE-2026-107588 via com.vaadin:vaadin (>=24.10.0, <=24.10.10)

com.vaadin:vaadin MAVEN version =24.10.0, =24.10.0, =24.10.0, =9.6.1, =9.6.1, =9.6.1, =9.6.1, =9.6.3 - io.github.adumeige.vaadin-reactflow:vaadin-reactflow-component 1.0.0 Source cves: CVE-2026-107588 Source advisory: SNYK:JAVA-COMVAADIN-21691577...

com.vaadin:vaadin (>=24.10.0, <=24.10.10), com.vaadin:vaadin-charts-flow-svg-generator (>=24.10.0, <=24.10.10) +9 more potentially affected by CVE-2026-107588 via com.vaadin:vaadin-charts-flow (>=24.10.0, <=24.10.10)

com.vaadin:vaadin-charts-flow MAVEN version =24.10.0, =24.10.0, =24.10.0, =24.10.0, =24.10.0, =24.10.0, =24.10.0, =9.6.1, =9.6.1, =9.6.1, =9.6.1, =9.6.3 - io.github.adumeige.vaadin-reactflow:vaadin-reactflow-component 1.0.0 Source cves: CVE-2026-107588 Source advisory: SNYK:JAVA-COMVAADIN-2169157...

com.vaadin:vaadin (25.3.0), com.vaadin:vaadin-charts-flow-svg-generator (25.3.0) +6 more potentially affected by CVE-2026-107588 via com.vaadin:vaadin-charts-flow (25.3.0)

com.vaadin:vaadin-charts-flow MAVEN version 25.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:vaadin-charts-flow and may be impacted: - com.vaadin:vaadin 25.3.0 - com.vaadin:vaadin-charts-flow-svg-generator 25.3.0 - com.vaadin:vaadin-ee...

com.vaadin:vaadin-jandex (>=22.0.0, <=23.6.15), com.vaadin:vaadin-platform-javadoc (>=22.0.0, <=23.6.15) +76 more potentially affected by CVE-2026-107588 via com.vaadin:vaadin (>=22.0.0, <=23.6.15)

com.vaadin:vaadin MAVEN version =22.0.0, =22.0.0, =22.0.0, =8.3.1, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.4 and more Source cves: CVE-2026-107588 Source advisory: SNYK:JAVA-COMVAADIN-21691577...

com.github.mcollovati:hilla-shaded-deps (>=24.4.0-beta1, <=24.4.2), com.github.mcollovati:quarkus-hilla (>=24.4.0-beta1, <=24.4.2) +10 more potentially affected by CVE-2026-107588 via com.vaadin:vaadin (>=24.0.0, <=24.4.23)

com.vaadin:vaadin MAVEN version =24.0.0, =24.4.0-beta1, =24.4.0-beta1, =24.4.0-beta1, =24.4.0-beta1, =24.4.0-beta1, =24.4.0-beta1, =24.4.0-beta1, =24.0.0, =24.0.0, =24.4.23 - io.sunshower.aire-test:aire-test-spring 1.0.11.final - io.sunshower.aire-test:aire-test-vaadin 1.0.11.final -...

com.vaadin:vaadin (>=24.8.0, <=24.9.22), com.vaadin:vaadin-charts-flow-svg-generator (>=24.8.0, <=24.9.22) +8 more potentially affected by CVE-2026-107588 via com.vaadin:vaadin-charts-flow (>=24.8.0, <=24.9.22)

com.vaadin:vaadin-charts-flow MAVEN version =24.8.0, =24.8.0, =24.8.0, =24.8.0, =24.8.0, =24.8.0, =24.8.0, =9.4.4, =9.4.4, =9.4.4, =9.4.4, =9.5.8 Source cves: CVE-2026-107588 Source advisory: SNYK:JAVA-COMVAADIN-21691578...

com.vaadin:vaadin-platform-javadoc (25.3.0), com.wontlost:zxing-vaadin (4.0.0) potentially affected by CVE-2026-107588 via com.vaadin:vaadin (25.3.0)

com.vaadin:vaadin MAVEN version 25.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:vaadin and may be impacted: - com.vaadin:vaadin-platform-javadoc 25.3.0 - com.wontlost:zxing-vaadin 4.0.0 Source cves: CVE-2026-107588 Source advisory:...

com.github.mcollovati:hilla-shaded-deps (>=24.4.0-beta1, <=24.4.2), com.github.mcollovati:quarkus-hilla (>=24.4.0-beta1, <=24.4.2) +14 more potentially affected by CVE-2026-107588 via com.vaadin:vaadin-charts-flow (>=24.0.0, <=24.4.22)

com.vaadin:vaadin-charts-flow MAVEN version =24.0.0, =24.4.0-beta1, =24.4.0-beta1, =24.4.0-beta1, =24.4.0-beta1, =24.4.0-beta1, =24.4.0-beta1, =24.4.0-beta1, =24.0.0, =24.0.0, =24.0.0, =24.0.0, =24.0.0, =24.0.0, =24.4.22 - io.sunshower.aire-test:aire-test-spring 1.0.11.final -...

com.vaadin:vaadin (>=24.5.0, <=24.7.15), com.vaadin:vaadin-charts-flow-svg-generator (>=24.5.0, <=24.7.14) +8 more potentially affected by CVE-2026-107588 via com.vaadin:vaadin-charts-flow (>=24.5.0, <=24.7.14)

com.vaadin:vaadin-charts-flow MAVEN version =24.5.0, =24.5.0, =24.5.0, =24.5.0, =24.5.0, =24.5.0, =24.5.0, =24.7.14 - com.vaadin:vaadin-testbench-unit 9.3.15 - com.vaadin:vaadin-testbench-unit-junit5 9.3.15 - com.vaadin:vaadin-testbench-unit-quarkus 9.3.15 - com.vaadin:vaadin-testbench-unit-share...

com.svenruppert.vaadin:nano-vaadin-jetty (04.00.00), com.vaadin:browserless-test-junit6 (>=1.0.0-rc1, <=1.1.2) +18 more potentially affected by CVE-2026-107588 via com.vaadin:vaadin-charts-flow (>=25.0.0, <=25.2.9)

com.vaadin:vaadin-charts-flow MAVEN version =25.0.0, =1.0.0-rc1, =1.1.1, =1.0.0-rc1, =1.0.0-rc1, =1.1.0-rc1, =25.0.0, =25.0.0, =25.2.2, =25.0.0, =25.0.0, =25.0.0, =25.0.0, =10.0.1, =25.2.2 and more Source cves: CVE-2026-107588 Source advisory: SNYK:JAVA-COMVAADIN-21691578...

@frc-web-components/frc-web-components (>=4.4.0-alpha.0, <=4.5.3-alpha.0), @frc-web-components/fwc (>=1.0.0, <=2.4.4) +8 more potentially affected by CVE-2026-107588 via @vaadin/charts (>=22.0.0, <=23.6.6)

@vaadin/charts NPM version =22.0.0, =4.4.0-alpha.0, =1.0.0, =0.1.0, =1.3.0-alpha3, =1.0.1, =22.0.0, =22.0.0, =22.0.0, =1.0.2, =1.0.2, =1.0.3 Source cves: CVE-2026-107588 Source advisory: SNYK:JS-VAADINCHARTS-21691580...

3d-rcnet (>=0.2.2, <=0.2.3), 3lc (>=3.2.0, <=3.4.2) +3208 more potentially affected by CVE-2026-96643 via pillow (>=12.0.0, <=12.3.0)

pillow PYPI version =12.0.0, =0.2.2, =3.2.0, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.6, =0.1.0, =0.0.1, =0.5.0, =0.0.6, =0.0.93, =0.0.94 and more Source cves: CVE-2026-96643 Source advisory: MEND:CVE-2026-96643...

com.github.mvysny.kaributesting:karibu-testing-v8 (>=1.3.17, <=1.4.5), com.vaadin:mpr-core (>=7.0.0, <=7.0.11) +18 more potentially affected by CVE-2026-110803 via com.vaadin:vaadin-server (>=8.16.0, <=8.32.1)

com.vaadin:vaadin-server MAVEN version =8.16.0, =1.3.17, =7.0.0, =6.0.3, =8.16.0, =8.16.0, =8.16.0, =8.16.0, =8.16.0, =8.16.0, =8.16.0, =8.16.0, =8.16.0, =8.16.0, =8.18.0, =8.32.1 and more Source cves: CVE-2026-110803 Source advisory: SNYK:JAVA-COMVAADIN-21691526...

com.vaadin:mpr-core (>=7.0.0, <=8.0.1), com.vaadin:mpr-v8 (>=7.0.0, <=8.0.1) +13 more potentially affected by CVE-2026-110803 via com.vaadin:vaadin-server-mpr-jakarta (>=8.19.0, <=8.32.1)

com.vaadin:vaadin-server-mpr-jakarta MAVEN version =8.19.0, =7.0.0, =7.0.0, =4.0.0-beta0, =8.19.0, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.5.1-alpha1 Source cves:...

3d-rcnet (>=0.2.2, <=0.2.3), 3lc (>=3.2.0, <=3.4.2) +3208 more potentially affected by CVE-2026-96644 via pillow (>=12.0.0, <=12.3.0)

pillow PYPI version =12.0.0, =0.2.2, =3.2.0, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.6, =0.1.0, =0.0.1, =0.5.0, =0.0.6, =0.0.93, =0.0.94 and more Source cves: CVE-2026-96644 Source advisory: MEND:CVE-2026-96644...

3d-rcnet (>=0.2.2, <=0.2.3), 3lc (>=3.2.0, <=3.4.2) +3208 more potentially affected by CVE-2026-96641 via pillow (>=12.0.0, <=12.3.0)

pillow PYPI version =12.0.0, =0.2.2, =3.2.0, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.6, =0.1.0, =0.0.1, =0.5.0, =0.0.6, =0.0.93, =0.0.94 and more Source cves: CVE-2026-96641 Source advisory: MEND:CVE-2026-96641...

3d-rcnet (>=0.2.2, <=0.2.3), 3lc (>=3.2.0, <=3.4.2) +3208 more potentially affected by CVE-2026-96642 via pillow (>=12.0.0, <=12.3.0)

pillow PYPI version =12.0.0, =0.2.2, =3.2.0, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.6, =0.1.0, =0.0.1, =0.5.0, =0.0.6, =0.0.93, =0.0.94 and more Source cves: CVE-2026-96642 Source advisory: MEND:CVE-2026-96642...

11x-wagtail-blog (>=0.0.0, <=0.2.0), 170051277-trab-final-gces (>=0.3.0, <=0.5.0) +9848 more potentially affected by CVE-2026-96638 via pillow (>=9.1.0, <=12.3.0)

pillow PYPI version =9.1.0, =0.0.0, =0.3.0, =0.1.0, =0.2.2, =0.5.0a0, =2.3.84, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.2.4 and more Source cves: CVE-2026-96638 Source advisory: SNYK:PYTHON-PILLOW-21430999...

3d-rcnet (>=0.2.2, <=0.2.3), 3lc (>=3.2.0, <=3.4.2) +3208 more potentially affected by CVE-2026-96638 via pillow (>=12.0.0, <=12.3.0)

pillow PYPI version =12.0.0, =0.2.2, =3.2.0, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.6, =0.1.0, =0.0.1, =0.5.0, =0.0.6, =0.0.93, =0.0.94 and more Source cves: CVE-2026-96638 Source advisory: MEND:CVE-2026-96638...

11x-wagtail-blog (>=0.0.0, <=0.2.0), 3lc (>=2.12.0, <=2.22.0) +2455 more potentially affected by CVE-2026-112901 via pillow (10.4.0)

pillow PYPI version 10.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - 11x-wagtail-blog =0.0.0, =2.12.0, =0.1.0, =0.1.3, =0.3.0, =0.1.3, =0.1.0, =0.1.4, =0.3.0, =0.2.1, =0.2.0, =0.0.1, =0.0.0, =0.0.9 and more Source...

addownloader (0.2.11), airosentris (>=0.1.8, <=0.1.31) +209 more potentially affected by CVE-2026-112901 via pillow (11.0.0)

pillow PYPI version 11.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - addownloader 0.2.11 - airosentris =0.1.8, =0.0.0, =24.11.0, =3.0.0.dev38, =0.4.0rc6, =0.2.2b2, =0.1.2, =4.2.1, =0.8.26, =0.2.0, =0.4.0, =0.60.2,...

agkit (>=0.17.0, <=0.26.0), ai-puti (0.1.0b5) +236 more potentially affected by CVE-2026-112901 via pillow (11.1.0)

pillow PYPI version 11.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - agkit =0.17.0, =0.2.0, =0.1.0, =0.76.0, =0.1.1, =3.1.8, =0.1.0, =0.1.0, =0.5.0, =25.2.0, =1.0.4, =0.1.0, =0.1.12 - arched-emailer 0.4.6 and more...

aider-chat (>=0.82.3, <=0.85.2), aider-code (>=0.1.0.dev19, <=0.1.1.post14) +186 more potentially affected by CVE-2026-112901 via pillow (11.2.1)

pillow PYPI version 11.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - aider-chat =0.82.3, =0.1.0.dev19, =0.0.1, =3.1.20260611, =0.1.0, =0.2.0, =0.1.0, =2026.5.28, =2026.4.15, =2.0.6, =25.5.0, =0.0.0, =1.4.3, =0.5.0b2,...

2dify (1.0.1), 3deecelltracker (1.0.1) +2371 more potentially affected by CVE-2026-112901 via pillow (11.3.0)

pillow PYPI version 11.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - 2dify 1.0.1 - 3deecelltracker 1.0.1 - aaa-ml-datasets-course 1.0.0 - aaanalysis =1.0.1, =1.0.0, =0.2.0a0, =0.1.32, =0.0.29, =2.6.7, =0.1.3, =0.1.0,...

agentomics (>=0.1.0rc1, <=1.2.0), airunner (>=5.0.0, <=5.6.1) +136 more potentially affected by CVE-2026-112901 via pillow (12.0.0)

pillow PYPI version 12.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - agentomics =0.1.0rc1, =5.0.0, =1.0.5, =25.11.0, =0.1.27, =0.1.0, =0.1.0.post5, =0.0.34, =7.0.3, =0.1.0a1, =2.9.0, =0.1.0, =0.1.0, =0.1.3 and more...