Güvenlik açıkları (CVE)
NVD (National Vulnerability Database) verisiyle CVE kayıtlarını arayın. Aktif olarak istismar edilen açıklar için CISA KEV kataloğunu inceleyin.
Yerel veritabanında 19.333 CVE, 0 KEV kaydı · son NVD senkronu 28.10.2026 16:14. Belirli bir CVE kimliği yerelde yoksa NVD'den anlık getirilir.
| CVE | Açıklama | CVSS | Yayın |
|---|---|---|---|
| CVE-2026-112893 | Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale glyph variable. An atta | 8.2 | 20.10.2026 |
| CVE-2026-112894 | Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve PDF object identifiers when saving many frames with save_all enabled. PdfParser.next_object_id() repeatedly rebuilds and scans all previously reserved identifie | 8.7 | 20.10.2026 |
| CVE-2026-112895 | Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can exhaust resources while parsing an existing PDF during an append operation. PdfParser follows page-tree child references without cycle or duplication tracking and follows previous-trailer | 8.7 | 20.10.2026 |
| CVE-2026-112896 | Pillow is a Python imaging library. Prior to 13.0.0, Pillow's TIFF encoder can read beyond a ColorMap buffer when retained TIFF metadata has a plane size inconsistent with BitsPerSample. A small TIFF can be opened normally and then retain a crafted ColorMap th | 8.8 | 20.10.2026 |
| CVE-2026-112897 | Pillow is a Python imaging library. From 5.3.0 until 13.0.0, Pillow can return uninitialized memory as pixels when libtiff performs a short decode of JPEG-compressed or Group 4 fax TIFF data. The _decodeStrip and _decodeTile buffers can be larger than the byte | 8.7 | 20.10.2026 |
| CVE-2026-112405 | Pillow is a Python imaging library. From 12.0.0 until 13.0.0, Pillow's Image.merge() can dereference a null image8 plane. Validation skips the first input band, allowing a 32-bit integer or floating-point image backed by image32 storage to be merged as a narro | 8.7 | 20.10.2026 |
| CVE-2026-112406 | Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite loop while rewriting PDF pages. PdfParser.rewrite_pages() follows Parent relationships without detecting a cycle in the page tree. An attacker can supply a cyclic PDF to | 8.7 | 20.10.2026 |
| CVE-2026-112891 | Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow performs quadratic copying when saving a GIF with a long comment. _get_global_header() repeatedly copies portions of comment data while assembling the global header, including comments retaine | 6.9 | 20.10.2026 |
| CVE-2026-112398 | Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix JPEG-tile decoder can write decoded scanlines beyond the allocated tile buffer. FlashPix (FPX) JPEG decoding selects raw mode LA with two bytes per pixel, while an unrecognized JPEG mode ca | 9.2 | 20.10.2026 |
| CVE-2026-112399 | Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow can allocate an APNG disposal background at the full canvas size before applying the decompression-bomb check. A crafted APNG with a small first frame, a very large declared canvas, and backgr | 8.7 | 20.10.2026 |
| CVE-2026-112400 | Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected GIF frame size after a decompression-bomb exception. In GifImageFile._seek, a crafted GIF can leave rejected dimensions stored after Image.DecompressionBombError; if an a | 8.7 | 20.10.2026 |
| CVE-2026-112401 | Pillow is a Python imaging library. From 5.4.0 until 13.0.0, Pillow performs quadratic copying while parsing GIF comments. GifImageFile._seek() repeatedly appends immutable bytes for comment sub-blocks and multiple comment extensions, and frame zero is parsed | 6.9 | 20.10.2026 |
| CVE-2026-112402 | Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double free image memory when ImagingScaleAffine encounters a selective allocation failure. The affected fast path handles Transform.EXTENT or pure scale-and-translate Transform.AFFINE operations | 8.7 | 20.10.2026 |
| CVE-2026-112403 | Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a full-width scanline into a buffer sized for a requested draft scale. ImagingJpegDecode does not verify libjpeg's actual output width and component count after scaling is req | 9.2 | 20.10.2026 |
| CVE-2026-112404 | Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can read beyond row data produced by libtiff. In _decodeTile and the RGBA unpacker path, when Pillow and libtiff interpret duplicated PhotometricInterpretatio | 8.8 | 20.10.2026 |
| CVE-2026-112392 | Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand() allocates a non-empty output and then faults while replicating edges by reading the first pixel from e | 8.2 | 20.10.2026 |
| CVE-2026-112396 | Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when libtiff rejects a tag while encoding TIFF data to an in-memory buffer. When an application saves attacker-influenced TIFF tags to BytesIO, libtiff can reject a | 7.5 | 20.10.2026 |
| CVE-2026-112397 | Pillow is a Python imaging library. Prior to 13.0.0, Pillow's ImageMorph.MorphOp.apply() can access memory before a row buffer for a zero-width image. PPM and PGM input can create an image with width zero, and the native morphology routine indexes outrow[width | 8.7 | 20.10.2026 |
| CVE-2024-54646 | Rejected reason: This candidate was in a CNA pool that was not assigned to any issues. | — | 20.10.2026 |
| CVE-2024-54647 | Rejected reason: This candidate was in a CNA pool that was not assigned to any issues. | — | 20.10.2026 |
| CVE-2024-54648 | Rejected reason: This candidate was in a CNA pool that was not assigned to any issues. | — | 20.10.2026 |
| CVE-2024-54649 | Rejected reason: This candidate was in a CNA pool that was not assigned to any issues. | — | 20.10.2026 |
| CVE-2024-54650 | Rejected reason: This candidate was in a CNA pool that was not assigned to any issues. | — | 20.10.2026 |
| CVE-2024-54651 | Rejected reason: This candidate was in a CNA pool that was not assigned to any issues. | — | 20.10.2026 |
| CVE-2024-54652 | Rejected reason: This candidate was in a CNA pool that was not assigned to any issues. | — | 20.10.2026 |
Kaynak: NIST NVD CVE API 2.0. CVE açıklamaları kaynağındaki İngilizce metinle gösterilir. Bu ürün NVD API'sini kullanır ancak NVD tarafından onaylanmamış veya sertifikalandırılmamıştır.