High
CVE-2026-55380
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 89
Reset filters
Critical
CVE-2023-50447
Arbitrary Code Execution in Pillow
High
CVE-2026-42311
Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)
Medium
CVE-2026-42309
Pillow has a heap buffer overflow with nested list coordinates
Medium
CVE-2026-42308
Pillow has an integer overflow when processing fonts
Low
CVE-2026-41488
langchain-openai: Image token counting SSRF protection can be bypassed via DNS rebinding
High
CVE-2026-40192
FITS GZIP decompression bomb in Pillow
Medium
CVE-2026-28231
pillow-heif: Integer Overflow in Encode Path Buffer Validation Leads to Heap Out-of-Bounds Read
High
CVE-2026-25990
Pillow affected by out-of-bounds write when loading PSD images
High
CVE-2025-48379
Pillow vulnerability can cause write buffer overflow on BCn encoding
High
CVE-2023-44271
An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of
Unrated
pysec-2023-175
Pillow versions before v10.0.1 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-5129 (previously CVE-2023-4863). Pillow v10.0.1 upgrades the bundled libwebp binary to v1.3.2.
High
Exploited in attacks
CVE-2023-4863
libwebp: OOB write in BuildHuffmanTable
High
CVE-2022-45199
Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL.
High
CVE-2022-45198
Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).
High
CVE-2022-30595
Buffer over-flow in Pillow
Critical
CVE-2014-3007
Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibl
High
CVE-2016-3076
Heap-based buffer overflow in the j2k_encode_entry function in Pillow 2.5.0 through 3.1.1 allows remote attackers to cause a denial of service (memory corruption) via a crafted Jpeg2000 file.
High
CVE-2014-1932
The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy function in Image.py in Python Image Library (P
High
CVE-2014-9601
Pillow before 2.7.0 allows remote attackers to cause a denial of service via a compressed text chunk in a PNG image that has a large size when it is decompressed.
High
CVE-2014-3598
The Jpeg2KImagePlugin plugin in Pillow before 2.5.3 allows remote attackers to cause a denial of service via a crafted image.
High
CVE-2014-3589
PIL/IcnsImagePlugin.py in Python Imaging Library (PIL) and Pillow before 2.3.2 and 2.5.x before 2.5.2 allows remote attackers to cause a denial of service via a crafted block size.
High
CVE-2022-24303
Path traversal in Pillow
Low
ghsa-4fx9-vc88-q2xc
Infinite loop in Pillow
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.