Search: 18.8.3.2

A high-severity vulnerability (CVE-2026-114716) in Roundcube allows mail header injection via the media type in an inline image data URI. This flaw affects multiple specific versions of Roundcube and can lead to partial confidentiality loss and high integrity impact without availability impact. The vulnerability was published on October 23, 2026, and has a CVSS score of 8.5.

A vulnerability in Roundcube involves unsafe use of a login name in the SquirrelMail import file path, potentially allowing unauthorized access to sensitive data. The issue affects multiple specific versions of Roundcube. The CVSS score is 5.3, indicating a medium severity vulnerability with network attack vector, high attack complexity, low privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact.

CVE-2026-12664 is an authorization vulnerability in GitLab CE/EE versions from 18.2 up to but not including 19.3.6, 19.4 up to 19.4.3, and 19.5 up to 19.5.1. It allows an authenticated user with a read_api-scoped token to bypass scope restrictions and retrieve a project's incoming email address and create work items due to insufficient scope enforcement on a GraphQL field. This issue has been fixed in versions 19.3.6, 19.4.3, and 19.5.1.

CVE-2026-112212 is a high-severity vulnerability in GitLab CE/EE versions from 18.3 up to but not including 19.3.6, 19.4 up to 19.4.3, and 19.5 up to 19.5.1. It involves HTTP request/response smuggling where an unauthenticated attacker could poison a shared cache's OAuth/OIDC discovery document. This could redirect certain authentication flows to an attacker-controlled server due to improper trust of user-supplied values in cached discovery responses. The issue has been fixed in versions 19.3.6, 19.4.3, and 19.5.1.

A medium severity vulnerability (CVE-2026-114501) affects the Pillow Python imaging library versions from 11.2.1 up to but not including 13.0.0. The vulnerability has a CVSS 4.0 score of 6.3, indicating a network exploitable issue with low complexity and no user interaction required. The exact technical details of the flaw are not fully provided in the input data.

A high-severity vulnerability (CVE-2026-96778) affects the Pillow Python imaging library in versions from 9.4.0 up to 13.0.0. The vulnerability relates to the ImagingJp component. The CVSS 4.0 base score is 7.7, indicating a high impact with network attack vector, low attack complexity, and partial user interaction required. The vulnerability impacts confidentiality, integrity, and availability. No public exploits or patches are currently documented in the provided data.

A high-severity vulnerability (CVE-2026-96644) affects the Pillow Python imaging library on Windows platforms prior to version 13.0.0. The vulnerability has a CVSS 4.0 base score of 7.1, indicating a network-exploitable issue with low attack complexity and no privileges required, but requires user interaction. The impact is high, though no public exploits or vendor patch information are provided in the data.

A high-severity vulnerability (CVE-2026-96643) affects the Pillow Python imaging library in versions from 11.0.0 up to 13.0.0. The issue relates to the Exif.load functionality, though specific technical details are not fully provided. The CVSS 4.0 score is 7.1, indicating a significant security risk. The vulnerability is present in multiple Ubuntu package versions of Pillow. No public exploit or patch information is currently available.

CVE-2026-96642 is a high-severity vulnerability in the Pillow Python imaging library affecting versions prior to 13.0.0. The issue relates to the TarIO initialization process, potentially allowing an attacker to exploit the library. The CVSS 4.0 base score is 7.1, indicating a significant risk. Multiple Ubuntu package versions of Pillow are affected. No public exploits or vendor patches are currently documented.

A vulnerability exists in the Pillow Python imaging library prior to version 13.0.0 affecting the PILfont text-width functionality. The flaw has a CVSS 3.1 base score of 6.5, indicating a medium severity impact primarily causing availability disruption. No known exploits are reported in the wild. Multiple Ubuntu package versions of Pillow are affected.

A high-severity vulnerability (CVE-2026-96640) affects the Pillow Python imaging library versions from 5.1.0 up to 13.0.0. The issue involves the PdfParser component, though specific technical details are not provided. The vulnerability has a CVSS 4.0 base score of 8.2, indicating a network-exploitable flaw with high impact. Multiple Ubuntu package versions of Pillow are affected. No public exploits or vendor patch information are available in the provided data.

A critical vulnerability (CVE-2026-96639) affects the Pillow Python imaging library in versions from 11.0.0 up to 13.0.0. The vulnerability has a CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. The affected versions include multiple Ubuntu package builds of Pillow. No public exploits or vendor patch information are provided in the data.

A vulnerability exists in the Pillow Python imaging library affecting versions from 9.1.0 up to but not including 13.0.0. The issue relates to the BmpRleDec component. The CVSS 3.1 base score is 6.5, indicating a medium severity impact primarily affecting availability. No public exploits or known active exploitation have been reported. The affected versions include specific Ubuntu package builds of Pillow. No patch or remediation details are provided in the available data.

A vulnerability exists in the Pillow Python imaging library prior to version 13.0.0 affecting the SpiderImageFile.s component. This flaw has a CVSS 4.0 base score of 7.1, indicating high severity. The vulnerability allows an attacker to cause a high impact without requiring privileges or user interaction beyond what is specified. Multiple Ubuntu package versions of Pillow are affected. No public exploits or vendor patch information are provided in the input.

A vulnerability exists in the Pillow Python imaging library prior to version 13.0.0 involving the MpoImageFile.seek function. The flaw can cause a denial of service condition. The issue affects multiple Ubuntu package versions of Pillow. The CVSS score is 6.5, indicating a medium severity impact primarily due to availability disruption.

A high-severity vulnerability (CVE-2026-114145) in python-git (GitPython) allows remote code execution due to validation of a submodule's .git path only occurring after cloning into it. This flaw affects multiple specific versions of the python-git package. The vulnerability has a CVSS score of 7.5, indicating a high impact on confidentiality, integrity, and availability. No public exploits or known in-the-wild exploitation have been reported. The vulnerability is not related to a cloud service and no patch information is provided in the data.

CVE-2026-114138 is a high severity vulnerability in the Django REST framework, a toolkit for building Web APIs. The vulnerability affects multiple specific versions of djangorestframework prior to 3.1. It has a CVSS 3.1 score of 7.5, indicating a network exploitable issue with no privileges or user interaction required, causing a high impact on availability but no confidentiality or integrity impact.

CVE-2026-114137 is a high severity vulnerability in the Django REST framework, a toolkit for building Web APIs. It affects multiple specific versions of the djangorestframework package. The vulnerability has a CVSS 3.1 score of 7.4, indicating high impact on confidentiality and integrity with no privileges or user interaction required. No public exploits or patches are currently documented in the provided data.

CVE-2026-114136 is a high-severity vulnerability in the Django REST framework, a toolkit for building Web APIs. The vulnerability affects multiple specific versions of djangorestframework. It has a CVSS 3.1 score of 7.5, indicating high impact primarily due to availability disruption. No public exploit or known active exploitation is reported. The vulnerability does not impact confidentiality or integrity but can cause denial of service.

Apache Traffic Server contains a vulnerability that can cause the server to crash due to a null pointer dereference. This issue affects multiple specific versions of the Traffic Server package. The vulnerability has a CVSS 3.1 base score of 5.9, indicating a medium severity impact primarily affecting availability without compromising confidentiality or integrity.