Vulnerabilities
Recent vulnerabilities
Recent vulnerabilities from
🏠GNA-1 (CIRCL)
Select from 85 available sources using the dropdown above.
| ID | Severity | Description | Published | Updated |
|---|---|---|---|---|
| ghsa-58r4-6rv3-gfh8 |
8.7 (4.0)
|
Pillow: Out-of-bounds access in _imagingmorph on a zero-width image | 2026-10-20T20:56:22Z | 2026-10-20T20:56:22Z |
| ghsa-65qm-jvmh-6pqg |
8.7 (4.0)
|
Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS | 2026-10-20T20:53:36Z | 2026-10-20T20:53:36Z |
| ghsa-vx6w-vv9f-6gvg |
6.9 (4.0)
|
Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit | 2026-10-20T20:53:21Z | 2026-10-20T20:53:21Z |
| ghsa-q45j-58j2-45rg |
8.7 (4.0)
|
Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips | 2026-10-20T20:52:43Z | 2026-10-20T20:52:43Z |
| ghsa-pchr-8j38-3x4p |
8.8 (4.0)
|
Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read | 2026-10-20T20:51:40Z | 2026-10-20T20:51:40Z |
| ghsa-p4wg-p73j-c528 |
8.7 (4.0)
|
Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310) | 2026-10-20T20:50:49Z | 2026-10-20T20:50:49Z |
| ghsa-462x-pgg6-55fp |
6.5 (3.1)
|
Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290) | 2026-10-20T20:49:26Z | 2026-10-20T20:49:27Z |
| ghsa-c6hw-5grf-ff96 |
8.8 (4.0)
|
Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels | 2026-10-20T20:42:00Z | 2026-10-20T20:42:00Z |
| ghsa-8g5g-8vmr-9782 |
9.2 (4.0)
|
Pillow: Heap buffer overflow in ImagingJpegDecode | 2026-10-20T20:40:07Z | 2026-10-20T20:40:07Z |
| ghsa-jfgx-762w-99vr |
5.9 (4.0)
|
@angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete … | 2026-10-20T20:37:57Z | 2026-10-20T20:37:57Z |
| ghsa-gfr2-rv44-r23c |
7.5 (3.1)
|
markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default… | 2026-10-20T20:28:44Z | 2026-10-20T20:28:44Z |
| ghsa-vfgh-jcmw-g37q |
3.7 (3.1)
|
markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled | 2026-10-20T20:08:19Z | 2026-10-20T20:08:20Z |
| ghsa-jm63-cq47-j5jp |
7.7 (3.1)
|
MCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messag… | 2026-10-20T20:07:29Z | 2026-10-20T20:07:29Z |
| ghsa-46jr-4wx8-v453 |
7.5 (3.1)
|
MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory duri… | 2026-10-20T20:06:35Z | 2026-10-20T20:06:35Z |
| ghsa-f9xw-jh8m-3mwq |
6.3 (4.0)
|
AIOHTTP: Absolute-form request targets can spoof Request.scheme | 2026-10-20T20:01:40Z | 2026-10-20T20:01:40Z |
| ghsa-gx76-c99x-2c96 |
2.3 (4.0)
|
AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies | 2026-10-20T19:58:14Z | 2026-10-20T19:58:14Z |
| ghsa-6cjc-53gc-5rqm |
6.9 (4.0)
|
AIOHTTP: Connector pool exhaustion via Max-Age overflow | 2026-10-20T19:57:24Z | 2026-10-20T19:57:24Z |
| ghsa-pqxq-w44r-73xw |
6.3 (4.0)
|
AIOHTTP: Pure-Python parser request smuggling | 2026-10-20T19:52:21Z | 2026-10-20T19:52:22Z |
| ghsa-9xw5-w5jj-pvcg |
8.2 (4.0)
|
AIOHTTP: File descriptor exhaustion in multipart requests | 2026-10-20T19:52:09Z | 2026-10-20T19:52:09Z |
| ghsa-r825-w8mm-5pxw |
6.3 (4.0)
|
launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors | 2026-10-20T19:51:52Z | 2026-10-20T19:51:53Z |
| ghsa-587h-7wmj-h5pm |
7.5 (4.0)
|
launch-editor: `fs.existsSync()` existence check can be bypassed on Windows | 2026-10-20T19:48:25Z | 2026-10-20T19:48:25Z |
| ghsa-rvq5-wwqv-78pq |
6.8 (3.1)
|
MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service | 2026-10-20T19:43:36Z | 2026-10-20T19:43:37Z |
| ghsa-hq85-5cpj-mr62 |
9.1 (4.0)
|
uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised | 2026-10-20T19:37:52Z | 2026-10-20T19:37:53Z |
| ghsa-6q48-6c7w-9gw2 |
9.1 (4.0)
|
certifi bundles emSign root CAs with compromised intermediate CA keys | 2026-10-20T19:35:05Z | 2026-10-20T19:35:05Z |
| ghsa-j6fh-9747-5rv9 |
9.8 (3.1)
9.3 (4.0)
|
Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS command injection vulnerabilit… | 2026-10-20T18:31:49Z | 2026-10-20T18:31:49Z |
| ghsa-xjfc-j86g-w62p |
9.9 (3.1)
8.6 (4.0)
|
A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecSh… | 2026-10-20T18:31:48Z | 2026-10-20T18:31:48Z |
| ghsa-xc42-rp7w-hx85 |
6.3 (3.1)
|
Authorization Bypass Through User-Controlled Key vulnerability in xnau webdesign Participants Datab… | 2026-10-20T18:31:48Z | 2026-10-20T18:31:48Z |
| ghsa-vvxf-x39h-gvfp |
5.3 (3.1)
5.5 (4.0)
|
A vulnerability was found in aaPanel up to 8.25.0. The impacted element is the function GetClientIp… | 2026-10-20T18:31:48Z | 2026-10-20T18:31:48Z |
| ghsa-r3pf-g3mr-cmr7 |
9.1 (4.0)
|
Path Traversal (CWE-22) in FileArtifactService in Google ADK TypeScript (@google/adk) versions 0.4.… | 2026-10-20T18:31:48Z | 2026-10-20T18:31:48Z |
| ghsa-hqgx-66xg-f35h |
8.8 (3.1)
|
SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that… | 2026-10-20T18:31:48Z | 2026-10-20T18:31:48Z |