Skip to content
OpenAdvisories

Archive

19 October 2026

Vulnerabilities first published on this day (UTC), newest first.

← September 2026 2026 / October /19 November 2026 →
  1. 1400
  2. 2405
  3. 3114
  4. 464
  5. 5421
  6. 61017
  7. 7330
  8. 8492
  9. 9332
  10. 10412
  11. 11234
  12. 12683
  13. 132293
  14. 14824
  15. 15550
  16. 16480
  17. 17100
  18. 18552
  19. 19444
  20. 201925
  21. 21549
  22. 22488
  23. 23502
  24. 2476
  25. 25133
  26. 26768
  27. 27629
  28. 28636
  29. 29544
  30. 30688
  31. 31113
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 9.2
    CVE-2026-112900 Public exploit

    Pillow: Argument Injection in Ghostscript call, potentially leading into RCE

    Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe abso…

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  • Critical 9.2
    CVE-2026-112403 Public exploit

    Pillow: Heap buffer overflow in ImagingJpegDecode

    Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a full-width scanline into a buffer sized for a requested draft scale. ImagingJpegDecode does not verify libjpeg's actual output width and component count after scaling is re…

    python-pillow Pillow open-webui kserve-storage-controller Debian Ubuntu Wolfi PyPI
  • Critical 9.2
    CVE-2026-112398 Public exploit

    Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution

    Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix JPEG-tile decoder can write decoded scanlines beyond the allocated tile buffer. FlashPix (FPX) JPEG decoding selects raw mode LA with two bytes per pixel, while an unrecognized JPEG mode c…

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  • Critical 9.8
    CVE-2026-111058 Public exploit

    Mercury: Unauthenticated Remote Code Execution via /api/kernels

    Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send execute_request messages containing arbitrary Python. The …

    mljar mercury mercury PyPI
  • Critical 10.0
    CVE-2026-78162 Public exploit

    Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865)

    Deserialization of Untrusted Data vulnerability in Apache Camel. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-hazelcast component applies a default Hazelcast JavaSerializationFilterConfig to the instances it …

    Apache Software Foundation Apache Camel
  • Critical 9.8
    CVE-2026-107083 Public exploit

    SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/…

  • Critical 9.8
    CVE-2026-107081 Public exploit

    SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/…