Pillow, a Python imaging library, contains a heap buffer overflow vulnerability in its FlashPix JPEG-tile decoder prior to version 13.0.0. This flaw allows writing beyond the allocated buffer when decoding crafted FlashPix files, potentially leading to arbitrary code execution. The issue arises from incorrect handling of JPEG modes causing four-component scanlines to be written into a two-byte buffer. The vulnerability is fixed in Pillow version 13.0.0.
Pillow versions prior to 13.0.0 contain a vulnerability in the ImageMorph.MorphOp.apply() function where processing a zero-width image can lead to out-of-bounds memory access. This occurs because PPM and PGM image inputs can produce images with zero width, and the morphology operation indexes memory without validating this condition. An attacker supplying such an image to an application using Pillow's morphology operation can cause the process to crash. The issue is resolved in Pillow version 13.0.0.
Pillow versions from 11.3.0 up to but not including 13.0.0 contain a heap use-after-free vulnerability when encoding TIFF images to an in-memory buffer. This occurs if libtiff rejects a tag during encoding, leading to a use-after-free condition that can crash the process and potentially allow code execution. The issue is fixed in version 13.0.0.
A vulnerability in the Pillow Python imaging library's tiled-TIFF decoder allows reading beyond the allocated tile buffer when copying four-byte pixels. This flaw affects Pillow versions from 8.2.0 up to but not including 13.0.0. An attacker can craft a malicious tiled TIFF file that triggers this out-of-bounds read, potentially exposing adjacent heap memory or causing a crash. The issue is resolved in Pillow version 13.0.0.
Pillow versions prior to 13.0.0 contain a vulnerability in the P;2L and P;4L raw decoders where they may read 1 to 3 bytes beyond the provided input buffer. This can lead to disclosure of adjacent heap memory or cause a crash. The issue is resolved in version 13.0.0.
Pillow versions from 2.0.0 up to but not including 13.0.0 contain a heap buffer overflow vulnerability in the _tiffWriteProc function when saving compressed TIFF images to targets without a usable file descriptor, such as BytesIO. This flaw allows an attacker-controlled TIFF tag or ICC profile to overflow the heap buffer, potentially causing a crash or enabling code execution. Additionally, stale heap data may be disclosed through unwritten alignment gaps in compressed TIFF output larger than 64 KiB. The issue is fixed in Pillow version 13.0.0.
A vulnerability in the Pillow Python imaging library prior to version 13.0.0 allows a NULL dereference when applying rank-based filters to zero-size images. This causes a native process crash due to invalid memory access in the ImagingExpand function. The issue is fixed in version 13.0.0.
Pillow versions from 5.1.0 up to but not including 13.0.0 contain a vulnerability in the PdfParser component where the get_value() method can recurse without limit when processing nested PDF objects. This can lead to an uncaught RecursionError or termination of the worker process, resulting in a denial of service. The issue is fixed in version 13.0.0.
Pillow versions from 7.2.0 up to but not including 13.0.0 contain a vulnerability where processing a crafted MIC image with an embedded TIFF having at least three IFDs can cause an infinite loop. This occurs due to a mismatch in frame traversal logic, causing the frame count determination to never advance and potentially leading to a worker thread consuming full CPU indefinitely. The issue is fixed in Pillow version 13.0.0.
MLflow versions 3.17.1 and earlier contain a path traversal vulnerability in the FileStore tracking backend. This flaw allows unauthenticated attackers to submit crafted trace IDs with traversal sequences to the POST /api/3.0/mlflow/traces endpoint, enabling them to write files with attacker-controlled metadata outside the intended experiment trace directory. FileStore is the default tracking backend before MLflow 3.7.0 and optional thereafter, so deployments using FileStore in affected versions are vulnerable.
A critical remote code execution (RCE) vulnerability exists in PHP due to improper handling of out-of-memory (OOM) errors. PHP uses longjmp() to exit contexts on OOM, but some contexts leave memory uninitialized before allocation. This uninitialized memory can be read or branched on during request cleanup, enabling exploitation. Multiple OOM strategies can trigger this condition. Fixed versions are available in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
SeaweedFS versions from 4.0.388 up to but not including 4.41.0 contain a hard-coded unencrypted Ed25519 SSH private host key in the SFTP Helm chart. This key could be presented by certain standalone SFTP Helm deployments under specific configuration conditions, allowing an attacker who can intercept or redirect client traffic to impersonate the SFTP server. This impersonation could expose password credentials or data sent to the rogue endpoint. The issue is fixed in version 4.41.0.
MariaDB server versions from 10.6.1 up to but not including 10.6.28, 10.11.1 up to 10.11.19, 11.4.1 up to 11.4.13, 11.8.1 up to 11.8.9, 12.3.1 up to 12.3.3, and 13.0.1 up to 13.0.2 are affected by an SQL injection vulnerability. The issue arises because SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump commands do not consistently quote identifiers and values when serializing SQL, allowing a low-privileged attacker to inject SQL commands via crafted object identifiers or values. This vulnerability is fixed in the stated versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
A use-after-free vulnerability (CWE-416) exists in MariaDB server versions 12.3.1 through before 12.3.3 and 13.0.1 through before 13.0.2 in the handling of SYS_REFCURSOR. This flaw allows a low-privileged attacker to open many SYS_REFCURSORs and trigger a use-after-free condition, potentially enabling remote code execution when combined with another vulnerability. The issue is fixed in versions 12.3.3 and 13.0.2.
CVE-2026-85746 is a critical out-of-bounds write vulnerability in the MariaDB server affecting multiple versions from 10.6.1 up to but not including 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. The flaw occurs in the ST_AsText function when converting deeply nested GeometryCollections, where recursive WKT serialization fails to properly account for buffer size, leading to memory corruption. A low-privileged remote attacker can exploit this to potentially achieve code execution when combined with another vulnerability. The issue is fixed in the specified later versions.
CVE-2026-92262 is a critical vulnerability in MariaDB server affecting multiple versions from 10.6.1 up to but not including 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. It involves the #mysql50# prefix bypassing normal table-name filesystem encoding, allowing attackers to access files using legacy unencoded names. This can lead to crashes, data corruption, data exfiltration, or remote code execution. The issue is fixed in the specified later versions.