Vulnerability archive

Understand vulnerabilities. Protect your applications.

Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.

Platform

Severity

Disclosed from

Disclosed to

Vulnerability archive 6,828

Reset filters

High 21.10.2026

CVE-2026-113722

virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax

A vulnerability in virtualenv allows destination paths to be interpreted as shell syntax by generated POSIX console launchers. If an attacker influences the environment destination path, executing the resulting launcher can execute arbitrary commands with the calling user's privileges.

High 21.10.2026

CVE-2026-112892

Pillow: MSP RLE decoder expands a tiny file into unbounded memory

A vulnerability in Pillow's MSP RLE decoder allows crafted images to trigger excessive memory allocation, leading to a denial of service. The issue affects versions from 4.1.0 prior to 13.0.0 and is resolved in version 13.0.0.

Critical 22.10.2026

CVE-2026-96639

Pillow multi-frame loaders can reuse stale native image storage after mode transitions

A vulnerability in Pillow multi-frame image loaders allows stale native image storage to be reused after mode transitions, potentially causing out-of-bounds writes, process crashes, or arbitrary code execution.

Medium 22.10.2026

CVE-2026-113721

virtualenv: Generated files can follow existing destination links

Medium 22.10.2026

CVE-2026-113790

pypdf: Possible large memory usage when parsing arrays and dictionaries

Medium 22.10.2026

CVE-2026-113791

pypdf: Possible large memory usage when parsing content streams

Medium 22.10.2026

CVE-2026-113789

pypdf: Possible long runtimes/large memory usage when retrieving form fields

Medium 22.10.2026

CVE-2026-114603

OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api

Medium 22.10.2026

CVE-2026-96636

Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)

Medium 22.10.2026

CVE-2026-96641

Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise

Medium 22.10.2026

CVE-2026-96638

Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode

Medium 21.10.2026

CVE-2026-112396

Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer

Medium 21.10.2026

CVE-2026-113724

virtualenv: Deletion recovery can change a symlink target's mode

Medium 21.10.2026

CVE-2026-113716

virtualenv: Builtin creation follows linked environment directories

Medium 21.10.2026

CVE-2026-112391

Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()

Medium 21.10.2026

CVE-2026-112898

Pillow: Image.quantize() with empty palette leaks uninitialized stack memory

Medium 21.10.2026

CVE-2026-112401

Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()

Medium 21.10.2026

CVE-2026-112901

Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes

Low 21.10.2026

CVE-2026-113786

pypdf: Unvalidated JPEG image data loading

Low 21.10.2026

CVE-2026-113731

djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool

Medium 20.10.2026

CVE-2026-112899

Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit

Medium 19.10.2026

CVE-2026-111059

Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML

Medium 15.10.2026

CVE-2026-104250

unstructured: Stored XSS via unescaped HTML generation

Medium 15.10.2026

CVE-2026-104102

copyparty FTP: upload outside defined volumes (limited path traversal)

Showing 1 to 24 of 6828 results

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application

Understand vulnerabilities. Protect your applications.

Vulnerability archive 6,828

Know which vulnerabilities affect your application

Application security in your inbox