CVE-2026-96636 is a denial of service vulnerability in the python-pillow Pillow library affecting versions before 13.0.0. The flaw arises because decompression-bomb protection is only applied on the first frame of multi-frame images, and the MPO and DCX image plugins do not re-check frame size limits when seeking to subsequent frames. This allows crafted MPO or DCX images with a small first frame but an extremely large subsequent frame to bypass memory exhaustion protections, leading to excessive memory use and potential process crashes.
A vulnerability in the python-pillow Pillow library versions 5.1.0 through 12.x allows an attacker to cause uncontrolled resource consumption. The PdfParser.linearize_page_tree() function treats a PDF /Pages graph as a tree without tracking duplicate indirect references, leading to exponential expansion of page references when processing a crafted PDF. This results in disproportionate CPU usage during the append operation. The issue is fixed in version 13.0.0.
A resource consumption vulnerability exists in python-pillow Pillow versions prior to 13.0.0. The SpiderImageFile.seek() function can reparse a later SPIDER stack frame and replace the image size without rerunning the decompression bomb check, allowing an attacker to declare very large image dimensions. This can cause excessive memory allocation, potentially consuming multiple gigabytes of memory. The issue is fixed in version 13.0.0.
A heap out-of-bounds write vulnerability exists in the Pillow Python imaging library versions 9.4.0 through 12.x, fixed in 13.0.0. The flaw occurs in the JPEG encoding process when handling ICC profiles that exactly fill the 65536-byte encoder buffer, allowing an attacker-controlled comment and image data to overwrite adjacent heap memory. This can cause a crash or potentially enable code execution under certain runtime and heap conditions.
CVE-2026-96643 is a high-severity vulnerability in the python-pillow Pillow library affecting versions from 11.0.0 up to but not including 13.0.0. The flaw involves inefficient algorithmic complexity in the Exif.load() function, which processes EXIF data in image files. Specifically, an uncapped PNG eXIf chunk with repeated headers can cause quadratic CPU usage due to repeated slicing and copying operations. This issue can be triggered through common image processing workflows such as Image.getexif(), Image._getexif(), and ImageOps.exif_transpose(). The vulnerability is fixed in version 13.0.0.
CVE-2026-96644 is an out-of-bounds read vulnerability in the python-pillow Pillow library affecting Windows builds. It arises from improper handling of EMF and WMF image dimensions, where 32-bit dimensions are truncated to 16-bit fields for allocation but used fully for copying data, causing a heap over-read. This can lead to memory disclosure or application crashes when processing crafted metafiles. The flaw is fixed in Pillow version 13.0.0.
CVE-2026-96641 is an integer overflow vulnerability in the python-pillow Pillow library prior to version 13.0.0. The flaw occurs in the PILfont text-width accumulation code where negative glyph advances are not properly checked against INT_MIN, allowing a signed 16-bit advance of -32768 to cause an integer overflow. This results in a large positive width from a negative calculation, potentially causing logic errors or excessive resource consumption in applications using text layout or size calculations. The issue is fixed in Pillow version 13.0.0.
A vulnerability in the python-pillow Pillow library's TarIO class allows an infinite loop when processing a crafted tar file with a negative size field in the tar header. This causes the process to consume 100% CPU and hang indefinitely. The flaw exists because the size field is not validated to be non-negative, leading to a backward seek that traps the reading loop. This issue affects versions prior to 13.0.0 and is fixed in version 13.0.0. The vulnerability impacts availability but does not affect confidentiality or integrity. It only affects applications that explicitly use the TarIO.TarIO() method to read tar archives, which is not the default image loading path in Pillow.
A vulnerability in the BmpRleDecoder component of the python-pillow Pillow library allows crafted BMP files to cause uncontrolled memory allocation. This occurs due to unbounded growth in the delta escape and absolute mode branches during decoding, leading to a severe memory amplification denial-of-service (DoS). The flaw affects all versions before 13.0.0. A fix is available in version 13.0.0 that caps memory growth and rejects out-of-bounds deltas.
CVE-2026-114362 is a server-side request forgery (SSRF) vulnerability in HarnessRouter versions up to 0.31.12. The flaw exists in the Targets Test Endpoint component, specifically in the gateway/app.py file, where manipulation of the base_url argument can lead to SSRF. This vulnerability can be exploited remotely. Upgrading to version 0.31.13 resolves the issue.
Nuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer serializes raw useHeadSafe entry input into the island response without preserving the safe-input marker, and NuxtIsland later inserts that input into the page head as an ordinary entry. An application that passes attacker-controlled data to useHeadSafe in a .server.vue component or page, or in a component rendered through NuxtIsland, can therefore render values normally removed by the allowlist, including event-handler attributes or executable script content, resulting in stored cross-site scripting in the application origin. This issue is fixed in version 4.6.2 .
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13, pointerLock permission requests from some cross-origin iframes caused session.setPermissionRequestHandler() to receive the top-level frame's requestingUrl and isMainFrame values instead of those of the requesting frame. An application that embeds untrusted iframe content and grants pointer lock based on the requesting origin could therefore grant the permission under the top-level page's identity. Applications that deny pointerLock for untrusted embedded content are not affected. This issue is fixed in versions 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13.
This update includes the following RPMs:
grafana12.4:
* grafana12.4-12.4.13-0.2.hum1 (aarch64, x86_64)
* grafana12.4-12.4.13-0.2.hum1.src (src)
Security Fix(es):
grafana12.4:
* CVE-2026-111943
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Reflected XSS.This issue affects Geo Mashup: from n/a through 1.13.22.
e107 CMS versions from 2.2.0 up to but not including 2.3.13 contain a reflected cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject malicious HTML and JavaScript by manipulating the author GET parameter in search.php. The vulnerability arises because the author parameter is parsed and concatenated unescaped into an HTML input tag, enabling script injection. The issue is fixed in version 2.3.13.
The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not enforce the same owner-only access control on its REST API that it applies on the front-end, allowing unauthenticated users to read the metadata and item contents of private wishlists.