Archive
19 October 2026
Vulnerabilities first published on this day (UTC), newest first.
142 results · Clear filters · Feed
-
High 8.4
IBM Sterling Connect:Direct for Unix Improper Privilege Management
IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 could allow a local attacker to gain elevated privileges due to improper privilege management.
-
High 8.3
Langflow OSS Authorization Bypass Through User-Controlled Key
IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hijack an entire conversat…
-
High 8.8
Security Vulnerability identified in IBM TRIRIGA - GWT Mock Authentication
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper authentication.
-
High 8.8
IBM Verify Identity Access and IBM Security Verify Access Hard-coded Credentials
IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow a physically proximate attacker to gain elevated privileges due to the use of hard-coded credentials.
-
High 8.7
Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips
Pillow is a Python imaging library. From 5.3.0 until 13.0.0, Pillow can return uninitialized memory as pixels when libtiff performs a short decode of JPEG-compressed or Group 4 fax TIFF data. The _decodeStrip and _decodeTile buffers can be larger than the byt…
-
High 8.8
Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's TIFF encoder can read beyond a ColorMap buffer when retained TIFF metadata has a plane size inconsistent with BitsPerSample. A small TIFF can be opened normally and then retain a crafted ColorMap t…
-
High 8.7
Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can exhaust resources while parsing an existing PDF during an append operation. PdfParser follows page-tree child references without cycle or duplication tracking and follows previous-trailer…
-
High 8.7
Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve PDF object identifiers when saving many frames with save_all enabled. PdfParser.next_object_id() repeatedly rebuilds and scans all previously reserved identifi…
-
High 8.2
Pillow: Invalid free in FreeType glyph rendering when a stroker is active
Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale glyph variable. An att…
-
High 7.8
Gimp: gimp: use-after-free in xcf loader via prop_selected_path
A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free in the main process, leading to a crash and potentially arbitrary code execution.
-
High 7.8
Gimp: gimp: use-after-free in xcf loader via prop_linked and prop_selection on channels
A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leading to a c…
-
High 7.8
Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033)
A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in th…
-
High 8.7
Pillow: MSP RLE decoder expands a tiny file into unbounded memory
Pillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow's MSP RLE decoder can expand a small file into an unbounded in-memory buffer. The decoder writes run-length output to BytesIO without limiting expansion to the declared image size. An attacke…
-
High 8.7
Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite loop while rewriting PDF pages. PdfParser.rewrite_pages() follows Parent relationships without detecting a cycle in the page tree. An attacker can supply a cyclic PDF to…
-
High 8.0
Netis EAP930 CGI Endpoint debug return200 backdoor
A security vulnerability has been detected in Netis EAP930 1.250905.115454. This issue affects the function return200 of the file /cgi-bin/debug of the component CGI Endpoint. The manipulation of the argument SIGNATURE leads to backdoor. The attack may be ini…
-
High 8.7
Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0
Pillow is a Python imaging library. From 12.0.0 until 13.0.0, Pillow's Image.merge() can dereference a null image8 plane. Validation skips the first input band, allowing a 32-bit integer or floating-point image backed by image32 storage to be merged as a narr…
-
High 8.8
Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels
Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can read beyond row data produced by libtiff. In _decodeTile and the RGBA unpacker path, when Pillow and libtiff interpret duplicated PhotometricInterpretati…
-
High 7.1
Credential Material Exposure Leading to Unauthorized Streamed Media-Session Access in TP-Link Tapo C210
TP-Link Tapo C210 V3.60 may expose shared credential material and cryptographic metadata through unauthenticated DS JSON API requests. The exposed shared credential can be accepted by the Streamd Digest authentication mechanism as an administrative password, …
-
High 8.7
Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform
Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double free image memory when ImagingScaleAffine encounters a selective allocation failure. The affected fast path handles Transform.EXTENT or pure scale-and-translate Transform.AFFINE operations…
-
High 8.7
Pillow: Out-of-bounds access in _imagingmorph on a zero-width image
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's ImageMorph.MorphOp.apply() can access memory before a row buffer for a zero-width image. PPM and PGM input can create an image with width zero, and the native morphology routine indexes outrow[widt…
-
High 8.2
Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand() allocates a non-empty output and then faults while replicating edges by reading the first pixel from …
-
High 8.7
Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS
Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected GIF frame size after a decompression-bomb exception. In GifImageFile._seek, a crafted GIF can leave rejected dimensions stored after Image.DecompressionBombError; if an …
-
High 8.7
Pillow: APNG background disposal allocates full canvas before decompression bomb check
Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow can allocate an APNG disposal background at the full canvas size before applying the decompression-bomb check. A crafted APNG with a small first frame, a very large declared canvas, and backg…
-
High 8.2CVE-2026-53995 Public exploit
MLflow < 3.18.0 Path Traversal via Trace ID API
MLflow before 3.18.0 contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces…
-
High 7.3
orbitale imagemagick-php Command.php font os command injection
A security flaw has been discovered in orbitale imagemagick-php up to 3.3.5. Affected by this issue is the function Command::font of the file src/Command.php. The manipulation of the argument fontFile results in os command injection. The attack can be execute…
-
High 8.8
Stack out-of-bounds write in the OSDP Control Panel reply parser
The OSDP Control Panel reply parser cp_decode_response() in subsys/mgmt/osdp/src/osdp_cp.c decodes replies from a Peripheral Device into a stack-allocated struct osdp_event. For the REPLY_KEYPPAD and REPLY_RAW reply types, the payload length is taken from the…
-
High 8.2
Pillow: Infinite loop in MIC n_frames when the embedded TIFF
Pillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an infinite loop while determining the frame count of a MIC image. MicImageFile inherits TIFF frame traversal, but MicImageFile.tell reports the OLE stream index and its seek() rese…
-
High 7.0
Dell Application Store, versions prior to 26.05.0.7, contain an Incorrect Permission Assignment for Critical Resource v…
-
High 8.8
Dell Application Store, versions prior to 26.05.0.7, contain a Missing Authentication for Critical Function vulnerabili…
-
High 7.8
Dell Application Store, versions prior to 26.05.0.7, contains an Uncontrolled Path Element vulnerability. A low privile…
-
High 7.1
Gimp: gimp: heap out-of-bounds read in xcf text-layer parasite parsing
A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacent heap data into layer text and causing denial of service.
-
High 7.5
Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of Service
Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion vulnerability that allows anonymous visitors to bypass the system.images.max_pixels limit when system.images.url_actions is enabled. Attackers can send single-dimension or …
-
High 8.8
Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@
Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming Flex form fields with replace-name@. Attackers with page-edit permission can smuggle data-*@ directives past …
-
High 7.2
Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist Bypass Leading to RCE
Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks are case-sensitive while PHP class resolution is not. Attackers with template-execution rights, such as Control Panel adm…
-
High 7.5
Craft CMS 5.0.0 before 5.11.0 Verification Code Reuse via users/set-password
Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's emailed code can submit …
-
High 7.2
Craft CMS 5.8.0 before 5.11.0 Admin RCE via ContentBlock Field Layout
Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii behaviors by supplying a JSON-string field layout to ContentBlock::setFieldLayout(). Attackers with allowAdminChanges enab…
-
High 8.8
Craft CMS 5.0.0 before 5.11.0 RCE via Asset::getMimeType Transform Injection
Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox via Asset::getMimeType transforms. Attackers can supply 'as' or 'on' keys passed unfiltered to Craft::cr…
-
High 8.8
Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection
Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners. Attackers can inject Yii "as" or "on" …
-
High 8.8
Craft CMS before 4.18.8 and 5.11.0 Authenticated RCE via Twig group Filter Array-Callable
Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter, which invokes non-string arrow arguments as callables without the checkArrow guard used by other arrow-accepting filters. Authenticated …
-
High 7.3
Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System ws.asmx xp_cmdshell sql injection
A vulnerability has been found in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System up to 3.5. Affected is the function xp_cmdshell of the file /ws.asmx. The manipulation of the argument sql leads to sql injectio…