A high-severity vulnerability (CVE-2026-112399) affects the Pillow Python imaging library versions from 8.1.0 up to 13.0.0. The vulnerability has a CVSS 4.0 base score of 8.7, indicating it is exploitable remotely without authentication and requires no user interaction. The specific impact details are not fully described in the input data. Multiple Ubuntu package versions of Pillow are listed as affected. No public exploits or patch information are provided.
A critical vulnerability (CVE-2026-112398) affects the Pillow Python imaging library in versions prior to 13.0.0. The flaw is related to the handling of FlashPix files. It has a high CVSS 4.0 score of 9.2, indicating severe impact potential. No public exploits or vendor patch information are provided in the data. The affected versions include multiple Ubuntu package builds of Pillow versions 2.2.1, 2.3.0, 2.9.0, and 3.0.0. The vulnerability is network exploitable but requires high attack complexity and no privileges or user interaction. No cloud service is involved.
A high-severity vulnerability (CVE-2026-112397) affects the Pillow Python imaging library in versions prior to 13.0.0. The vulnerability allows for a significant impact without requiring user interaction or privileges. It is identified with a CVSS 4.0 score of 8.7, indicating a network exploitable flaw with high impact on availability. Multiple Ubuntu package versions of Pillow are affected. No public exploits or vendor patches are explicitly stated in the provided data.
A vulnerability exists in the Pillow Python imaging library affecting versions from 11.3.0 up to but not including 13.0.0. The flaw has a CVSS 3.1 base score of 5.9, indicating a medium severity issue primarily impacting availability. The vulnerability does not affect confidentiality or integrity but can cause denial of service. No public exploits or known active exploitation have been reported. The affected versions include various Ubuntu package builds of Pillow. No explicit patch or remediation details are provided in the available data.
CVE-2026-112392 is a high-severity vulnerability affecting the Pillow Python imaging library prior to version 13.0.0. The vulnerability relates to Pillow's rank-based functionality, though specific technical details are not provided. Multiple Ubuntu package versions of Pillow are affected. The CVSS 4.0 base score is 8.2, indicating a high impact with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on availability. No known exploits in the wild have been reported. No patch or remediation details are provided in the available data.
A high-severity vulnerability (CVE-2026-112257) exists in GIMP affecting multiple specific versions. The flaw is related to the PSD thumbnail resource loader, potentially allowing an attacker to cause significant confidentiality, integrity, and availability impacts. The vulnerability requires local access and user interaction to exploit.
A medium severity vulnerability (CVE-2026-112395) affects the Pillow Python imaging library versions from 8.2.0 up to but not including 13.0.0. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a network attack vector with low complexity and no privileges or user interaction required. The impact includes limited confidentiality loss and availability impact, with no integrity impact reported. The vulnerability affects multiple Ubuntu package versions of Pillow. No public exploits or known active exploitation have been reported. Patch status is not confirmed from the provided data.
CVE-2026-112394 is a medium severity vulnerability in the Pillow Python imaging library affecting certain Ubuntu package versions prior to 13.0.0. The vulnerability involves Pillow's P;2L and related components, though detailed technical specifics are not provided. The flaw has a CVSS 4.0 base score of 6.3, indicating a network exploitable issue with low complexity and partial impact on confidentiality and availability. No public exploits or known active exploitation have been reported. The affected versions are specific Ubuntu package builds of Pillow up to version 3.0.0-1build1.
Pillow, a Python imaging library, contains a critical vulnerability identified as CVE-2026-112393 affecting versions from 2.0.0 up to but not including 13.0.0. The vulnerability has a CVSS 4.0 score of 9.2, indicating a high-severity security issue. The flaw allows network-based exploitation with high complexity and requires partial user interaction, resulting in high impact on confidentiality, integrity, and availability. No known exploits are reported in the wild. The affected versions include multiple Ubuntu package builds of Pillow versions 2.2.1, 2.3.0, 2.9.0, and 3.0.0. No patch or remediation details are provided in the source data.
CVE-2026-112391 is a high-severity vulnerability affecting the Pillow Python imaging library versions from 5.1.0 up to 13.0.0. The vulnerability impacts availability but does not affect confidentiality or integrity. It has a CVSS 3.1 base score of 7.5. Specific affected Ubuntu package versions are listed, but no patch or remediation details are provided in the source data.
A high-severity vulnerability (CVE-2026-112390) affects the Pillow Python imaging library versions from 7.2.0 up to but not including 13.0.0. The vulnerability has a CVSS score of 7.5, indicating a network exploitable issue with no required privileges or user interaction, causing a high impact on availability. No known exploits are reported in the wild. The affected versions include several Ubuntu package versions of Pillow, but no specific technical details about the nature of the vulnerability are provided.
A medium severity vulnerability (CVE-2026-112300) has been identified in DiffSK configobj affecting versions up to 5.0.9. The flaw does not impact confidentiality or integrity but can cause a denial of service. No public exploits or active exploitation in the wild are known at this time.
Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl have a vulnerability in the canonical encoding of JSON keys. The issue arises from misordering byte-string keys during UTF-16 comparison, causing inconsistent canonical documents across processes.
Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl have a memory leak vulnerability. The encode_stringify function retains overloaded objects and their references without releasing them, causing unbounded memory growth when encoding such data repeatedly.
Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl improperly accept malformed UTF-8 in bare hash keys when using allow_barekey in decode_hv. This causes malformed UTF-8, control bytes, and backslashes to be stored without validation, leading to errors in later operations such as case conversion or re-encoding of the hash.
Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl have a vulnerability involving duplicate non-ASCII bare keys in JSON decoding. This flaw allows type confusion under the dupkeys_as_arrayref option in decode_hv, potentially causing process crashes or dereferencing arbitrary memory addresses when decoding untrusted JSON with specific relaxed options enabled.
Cpanel::JSON::XS versions before 4.80 for Perl contain a vulnerability where nested tagged values under allow_tags in decode_tag can cause stack exhaustion. This occurs because each tagged value and its content are decoded recursively without counting against max_depth, leading to unbounded recursion. An attacker can trigger an uncatchable segmentation fault by sending a crafted input with many nested tagged values, causing a denial of service.
A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
Craft CMS versions 4.x before 4.18.8 and 5.x before 5.11.0 have a vulnerability in the Twig create() function where case-sensitive class-name checks allow bypass of input restrictions. This enables attackers with template-execution privileges to instantiate the SplFileObject class using a lowercase name, potentially reading sensitive .env files or writing PHP files to the webroot, leading to remote code execution.
Craft CMS versions 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 have a vulnerability in the Twig sandbox allowlist. Authenticated Control Panel users can bypass sandbox restrictions using certain filters to access sensitive information such as security keys, database credentials, and authentication tokens.