High
CVE-2026-106443
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 108
Reset filters
Medium
CVE-2026-105751
Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend
High
CVE-2026-59200
Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()
High
CVE-2026-59204
Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service
High
CVE-2026-54058
Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)
Medium
CVE-2026-59198
Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images
High
CVE-2026-59197
Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`
Medium
CVE-2026-59203
Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service
High
CVE-2026-59205
Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch
High
CVE-2026-59199
Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow
Medium
CVE-2026-12491
vLLM: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations
Medium
CVE-2026-42310
Pillow has a PDF Parsing Trailer Infinite Loop (DoS)
High
CVE-2024-53863
Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders
High
CVE-2024-28219
Pillow buffer overflow vulnerability
High
CVE-2023-44464
pretix allows Pillow to parse EPS files
High
CVE-2026-54060
Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`
High
CVE-2026-54059
Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading
Medium
CVE-2026-55798
Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path
High
CVE-2026-55379
Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading
High
CVE-2026-55380
Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`
Critical
CVE-2023-50447
Arbitrary Code Execution in Pillow
High
CVE-2026-42311
Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)
Medium
CVE-2026-42309
Pillow has a heap buffer overflow with nested list coordinates
Medium
CVE-2026-42308
Pillow has an integer overflow when processing fonts
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.