Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- GO-2026-6651Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks in github.com/xtls/xray-coreGo · github.com/xtls/xray-core · fixed in 1.260327.1-0.20260710210335-64fada32b5b9
- CVE-2026-112901Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutesPyPI · pillow · fixed in 13.0.0
- CVE-2026-112900Pillow: Argument Injection in Ghostscript call, potentially leading into RCEPyPI · pillow · fixed in 13.0.0
- CVE-2026-112898Pillow: Image.quantize() with empty palette leaks uninitialized stack memoryPyPI · pillow · fixed in 13.0.0
- CVE-2026-112897Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG stripsPyPI · pillow · fixed in 13.0.0
- CVE-2026-112896Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds readPyPI · pillow · fixed in 13.0.0
- CVE-2026-112895Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)PyPI · pillow · fixed in 13.0.0
- CVE-2026-112894Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)PyPI · pillow · fixed in 13.0.0
- CVE-2026-112893Pillow: Invalid free in FreeType glyph rendering when a stroker is activePyPI · pillow · fixed in 13.0.0
- CVE-2026-112892Pillow: MSP RLE decoder expands a tiny file into unbounded memoryPyPI · pillow · fixed in 13.0.0
- CVE-2026-112891Pillow: Quadratic GIF comment copying during savePyPI · pillow · fixed in 13.0.0
- CVE-2026-112406Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cyclePyPI · pillow · fixed in 13.0.0
- CVE-2026-112405Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0PyPI · pillow · fixed in 13.0.0
- CVE-2026-112404Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixelsPyPI · pillow · fixed in 13.0.0
- CVE-2026-112403Pillow: Heap buffer overflow in ImagingJpegDecodePyPI · pillow · fixed in 13.0.0
- CVE-2026-112402Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transformPyPI · pillow · fixed in 13.0.0
- CVE-2026-112397Pillow: Out-of-bounds access in _imagingmorph on a zero-width imagePyPI · pillow · fixed in 13.0.0
- CVE-2026-112392Pillow: NULL dereference in ImagingExpand via rank filters on zero-size imagesPyPI · pillow · fixed in 13.0.0
- CVE-2026-112401Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()PyPI · pillow · fixed in 13.0.0
- CVE-2026-112400Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoSPyPI · pillow · fixed in 13.0.0
- CVE-2026-112399Pillow: APNG background disposal allocates full canvas before decompression bomb checkPyPI · pillow · fixed in 13.0.0
- CVE-2026-112398Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code executionPyPI · pillow · fixed in 13.0.0
- CVE-2026-53995MLflow 3.17.1 and prior Path Traversal via Trace ID APIPyPI · mlflow · fixed in 3.17.2
- CVE-2026-112396Pillow: Heap use-after-free when encoding TIFF to an in-memory bufferPyPI · pillow · fixed in 13.0.0
- CVE-2026-112395Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)PyPI · pillow · fixed in 13.0.0
- CVE-2026-112394Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer sizePyPI · pillow · fixed in 13.0.0
- CVE-2026-112393Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIOPyPI · pillow · fixed in 13.0.0
- CVE-2026-112391Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()PyPI · pillow · fixed in 13.0.0
- CVE-2026-112390Pillow: Infinite loop in MIC n_frames when the embedded TIFFPyPI · pillow · fixed in 13.0.0
- CVE-2026-111766markdown-it: Quadratic-time denial of service in inline HTML parsing with html enablednpm · markdown-it · fixed in 14.3.3, 15.0.3