{"vulnerability": "CVE-2026-5919", "sightings": [{"uuid": "4d9a2b07-c9cf-4e3e-b63f-30c923be2b5b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-5919", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities_20260409", "content": "", "creation_timestamp": "2026-04-08T18:00:00.000000Z"}, {"uuid": "e6bffbc1-0460-419f-bf35-5f6a7ac96280", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-5919", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities_20260413", "content": "", "creation_timestamp": "2026-04-12T20:00:00.000000Z"}, {"uuid": "78e2fb22-f220-4dd0-a9b5-408555f2a81b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5919", "type": "seen", "source": "https://www.thezdi.com/blog/2026/4/14/the-april-2026-security-update-review", "content": "", "creation_timestamp": "2026-04-14T15:49:19.000000Z"}, {"uuid": "941b07c9-d711-4425-bc46-ac390eb5dbfe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59196", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpyhgmpw5b27", "content": "CVE-2026-59196 - pnpm: hoisted install imports lockfile alias outside node_modules\nCVE ID : CVE-2026-59196\n \n Published : July 6, 2026, 3:18 p.m. | 29\u00a0minutes ago\n \n Description : pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted lockfile alias could be joined ...", "creation_timestamp": "2026-07-06T15:58:42.371712Z"}, {"uuid": "591d88d5-6498-42dd-a09b-61339d5efa29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59194", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpyi3sovst2q", "content": "CVE-2026-59194 - pnpm: patch-remove could delete project-selected files outside the patches directory\nCVE ID : CVE-2026-59194\n \n Published : July 6, 2026, 3:16 p.m. | 31\u00a0minutes ago\n \n Description : pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted patch entry ...", "creation_timestamp": "2026-07-06T16:10:33.447729Z"}, {"uuid": "ec8a7115-e778-460f-8e02-e2f6685680af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59195", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpyiac7bhz2h", "content": "CVE-2026-59195 - pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config\nCVE ID : CVE-2026-59195\n \n Published : July 6, 2026, 3:21 p.m. | 27\u00a0minutes ago\n \n Description : pnpm is a package manager. Prior to 10.34.4 and 1...", "creation_timestamp": "2026-07-06T16:13:06.107423Z"}, {"uuid": "9cd59299-36d8-49c5-b0fa-3ac161557a11", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59195", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mq2akkns5g2g", "content": "CVE-2026-59195 - Path Traversal in pnpm. Malicious lockfile can create symlinks outside expected directory. CVSS 8.2. Update to 10.34.4 or 11.8.0 immediately. #CVE #pnpm #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-59195/", "creation_timestamp": "2026-07-07T09:00:57.706747Z"}, {"uuid": "b034a43e-1478-4a1b-8ba0-8b10e6fa948b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59190", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdascvdwg2d", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-59190 \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 Grav Admin: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/8A0CAD34-416D-43F3-AE94-51B43564662B", "creation_timestamp": "2026-07-10T22:59:15.571452Z"}, {"uuid": "cf492a3a-d358-4988-9dc9-4bd83ea15d24", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59193", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdbicyild2z", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-59193 \u0432 Grav: \u0443\u0433\u0440\u043e\u0437\u0430 \u0434\u043b\u044f \u0444\u0430\u0439\u043b\u043e\u0432\u044b\u0445 \u0432\u0435\u0431-\u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\n\n\n\nhttps://kripta.biz/posts/B23F11D5-D91E-4846-95BD-96FFBD313EA2", "creation_timestamp": "2026-07-10T23:11:33.989454Z"}, {"uuid": "2807c78e-06e4-4ef4-97f7-0280a8e7cb01", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59190", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqddb35rt72s", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-59190 \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 Grav Admin: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/7F03F1C1-65CE-4D24-9E62-5B2687FE1002", "creation_timestamp": "2026-07-10T23:43:18.246494Z"}, {"uuid": "5af54793-029c-44c5-89c5-edcc07ff996a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59195", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mqztqy7dvw26", "content": "\ud83d\udccc CVE-2026-59195 - pnpm is a package manager. Prior to 10.34.4 and 11.8.0, pnpm accepts package names from the env lockfile configDependencies section and uses those nam... https://www.cyberhub.blog/cves/CVE-2026-59195", "creation_timestamp": "2026-07-19T22:37:06.616985Z"}, {"uuid": "c9062d4b-8991-4ac5-a8b1-3ccbe427115a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-59199", "type": "published-proof-of-concept", "source": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4", "content": "", "creation_timestamp": "2026-07-21T00:35:17.054203Z"}, {"uuid": "a93e4b91-54c3-45a2-9228-2e5a1202c80e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-59198", "type": "published-proof-of-concept", "source": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-fj7v-r99m-22gq", "content": "", "creation_timestamp": "2026-07-21T00:35:19.270704Z"}, {"uuid": "4d7d9870-4e6d-428d-bd3e-c6cb96013472", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-59197", "type": "published-proof-of-concept", "source": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr", "content": "", "creation_timestamp": "2026-07-21T00:35:21.497750Z"}, {"uuid": "63016cc9-eb72-4511-9214-60741dcc43b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59199", "type": "seen", "source": "https://gist.github.com/alon710/8369d28698d5eaa2f4badffaca60e4b4", "content": "# CVE-2026-59199: CVE-2026-59199: Signed 32-Bit Integer Overflow and Heap Backward Underwrite in Pillow\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-20\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59199\n\n## Summary\nA critical signed 32-bit integer overflow vulnerability was identified in Pillow (Python Imaging Library) versions prior to 12.3.0. The vulnerability resides within the native C extension library (libImaging) during coordinate and bounding box calculations in functions like ImagingPaste and ImagingFill2. Exploitation can bypass bounds and clipping safety checks, leading to a controlled heap backward underwrite and application crash.\n\n## TL;DR\nA signed integer overflow in Pillow before 12.3.0 allows unauthenticated remote attackers to bypass memory safety checks and perform a native heap out-of-bounds write via crafted coordinates, leading to a denial of service.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-190, CWE-787\n- **Attack Vector**: Network (Remote)\n- **CVSS Score**: 7.5 (High)\n- **EPSS Score**: 0.0039 (Percentile: 31.40%)\n- **Impact**: Denial of Service, Native Heap Corruption\n- **Exploit Status**: Proof of Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Pillow prior to version 12.3.0\n- **Pillow**: < 12.3.0 (Fixed in: `12.3.0`)\n\n## Mitigation\n\n- Upgrade Pillow to version 12.3.0 or higher\n- Apply strict application-layer validation on bounding box input values\n- Sandbox Python imaging processes inside containerized environments with seccomp policies enabled\n\n**Remediation Steps:**\n1. Identify all environment dependencies referencing Pillow packages prior to version 12.3.0\n2. Update requirements files to specify Pillow>=12.3.0 and redeploy the application\n3. Implement bounding box sanitization functions for any user-facing APIs exposing image coordinate parameters\n\n## References\n\n- [NVD CVE-2026-59199 Record](https://nvd.nist.gov/vuln/detail/CVE-2026-59199)\n- [Pillow Security Advisory GHSA-6r8x-57c9-28j4](https://github.com/python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4)\n- [Fix Pull Request #9703](https://github.com/python-pillow/Pillow/pull/9703)\n- [Fix Commit ceefc348](https://github.com/python-pillow/Pillow/commit/ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b)\n- [Pillow Release 12.3.0 Notes](https://github.com/python-pillow/Pillow/releases/tag/12.3.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59199) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-21T10:31:21.339083Z"}, {"uuid": "09b1fe6d-25bd-4186-9068-8300edc8fea8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59198", "type": "seen", "source": "https://gist.github.com/alon710/48f3deb1ca1eafb4018fbe6276da18c1", "content": "# CVE-2026-59198: CVE-2026-59198: Heap Out-of-Bounds Read in Pillow TGA RLE Encoder\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-07-20\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59198\n\n## Summary\nCVE-2026-59198 is a high-severity heap out-of-bounds read vulnerability in Pillow, the Python imaging library, affecting versions from 5.2.0 up to 12.3.0. The vulnerability occurs in the TGA RLE compression path due to a calculation mismatch between the allocated packed 1-bit row buffer and the byte-level pixel stride assumption in the C-level encoder. This mismatch allows an attacker to leak up to approximately 57 KB of adjacent process heap memory directly into generated TGA image files.\n\n## TL;DR\nA calculation mismatch in Pillow's TGA RLE encoder allows remote attackers to leak up to 57 KB of process heap memory by saving 1-bit images with RLE compression.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-125\n- **Attack Vector**: Network\n- **CVSS v3.1**: 6.5 (Medium)\n- **EPSS Score**: 0.00313\n- **Impact**: Information Disclosure (Heap Leak up to ~57 KB)\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Pillow (Python Imaging Library)\n- **Pillow**: >= 5.2.0, < 12.3.0 (Fixed in: `12.3.0`)\n\n## Mitigation\n\n- Upgrade Pillow to 12.3.0 or higher\n- Implement strict image mode validation before saving TGA outputs\n- Disable TGA RLE compression for untrusted user inputs\n\n**Remediation Steps:**\n1. Update requirements.txt or dependency configuration to use Pillow>=12.3.0\n2. Execute local test suites to verify that saving 1-bit (mode 1) TGA files with RLE compression raises an OSError exception\n3. Sandbox high-risk image-processing pipelines using isolated worker containers with limited privileges\n\n## References\n\n- [Pillow GitHub Security Advisory](https://github.com/python-pillow/Pillow/security/advisories/GHSA-fj7v-r99m-22gq)\n- [GitHub Pull Request #9709](https://github.com/python-pillow/Pillow/pull/9709)\n- [Official Patch Commit](https://github.com/python-pillow/Pillow/commit/eada3cbd7fb9963ee90673fb7b5270124a0d5f4b)\n- [Pillow v12.3.0 Release Notes](https://github.com/python-pillow/Pillow/releases/tag/12.3.0)\n- [NVD Vulnerability Details](https://nvd.nist.gov/vuln/detail/CVE-2026-59198)\n- [CVE.org Official Record](https://www.cve.org/CVERecord?id=CVE-2026-59198)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59198) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-21T11:31:12.909840Z"}, {"uuid": "d8b4b80a-e3cc-4f53-b3a9-b0a965b43e72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59197", "type": "seen", "source": "https://gist.github.com/alon710/a3a7380a4e0465c6c32d9063bd8033a6", "content": "# CVE-2026-59197: CVE-2026-59197: Heap Out-of-Bounds Write and Division-by-Zero in Pillow libImaging\n\n> **CVSS Score:** 8.2\n> **Published:** 2026-07-20\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59197\n\n## Summary\nA heap out-of-bounds write vulnerability exists in Pillow prior to version 12.3.0 due to an integer overflow during image expansion calculations. The subsequent patch introduced a division-by-zero regression causing denial of service.\n\n## TL;DR\nInteger overflow in Pillow image expansion leads to heap out-of-bounds write. Initial patch introduces a division-by-zero crash.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-190, CWE-787\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 8.2\n- **Impact**: Heap Out-of-Bounds Write / Denial of Service\n- **Exploit Status**: PoC Available\n\n## Affected Systems\n\n- Pillow (Python Imaging Library) versions prior to 12.3.0\n- **Pillow**: < 12.3.0 (Fixed in: `12.3.0`)\n\n## Mitigation\n\n- Upgrade to Pillow 12.3.0 or higher\n- Implement strict input validation on filter sizes at the application boundary\n- Validate margin is non-zero before calling C extension functions\n\n**Remediation Steps:**\n1. Verify the current Pillow version using python -c 'import PIL; print(PIL.__version__)'\n2. Upgrade using pip install --upgrade Pillow>=12.3.0\n3. Deploy updated application code to production\n\n## References\n\n- [GitHub Advisory](https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr)\n- [Fix Commit](https://github.com/python-pillow/Pillow/commit/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1)\n- [Pull Request](https://github.com/python-pillow/Pillow/pull/9695)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59197) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-21T12:31:41.596835Z"}, {"uuid": "7b1bab5a-915a-49a8-a4ea-3c9a092365ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59197", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mrafcjbw2i2v", "content": "\ud83d\udccc CVE-2026-59197 - Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very l... https://www.cyberhub.blog/cves/CVE-2026-59197", "creation_timestamp": "2026-07-22T13:07:06.918099Z"}, {"uuid": "6851a8c3-aebb-44a0-8718-b1c5fde74a02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59197", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mrasoxs43p2a", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-59197 \u0432 Pillow: \u0430\u043d\u0430\u043b\u0438\u0437 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/1F9D355C-4444-4038-84FC-BAF3A22EF8EB", "creation_timestamp": "2026-07-22T17:06:43.266057Z"}, {"uuid": "51de13f5-f5b2-475b-aaad-8a302a5ac9d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59197", "type": "seen", "source": "https://bsky.app/profile/khesefxyz.bsky.social/post/3mrasp47rfm2j", "content": "\u05d7\u05e9\u05d9\u05e4\u05ea \u05e4\u05d2\u05d9\u05e2\u05d4 \u05d7\u05de\u05d5\u05e8\u05d4 \u05d1\u05e4\u05d9\u05d9\u05dc\u05d5: CVE-2026-59197 - \u05db\u05ea\u05d9\u05d1\u05d4 \u05de\u05d7\u05d5\u05e5 \u05dc\u05d2\u05d1\u05d5\u05dc\u05d5\u05ea \u05d4\u05d4\u05e8\u05e3\n\n\n\nhttps://khesef.xyz/posts/4E4B5381-1B26-4051-9A47-90E32480B2B3", "creation_timestamp": "2026-07-22T17:06:47.998686Z"}]}