TI-2026-42349 CVE-2026-59204 · GHSA-vjc4-5qp5-m44j
Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service
Priority HIGH 77
Pillow is a Python imaging library.
RHSA-2026:70996
Red Hat AI Inference Model Optimization Tools 3.4.5 (cuda)
Released 2026-09-23 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/model-opt-cuda-rhel9
Fixes 11 records
TI-2026-04577 CVE-2026-5241 · GHSA-fgcw-684q-jj6r
Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformers
Priority HIGH 76
A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization.
TI-2026-42344 CVE-2026-59197 · GHSA-xj96-63gp-2gmr
Pillow: Heap out-of-bounds write in Pillow `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`
Priority HIGH 75
Pillow is a Python imaging library.
TI-2026-42350 CVE-2026-59205 · GHSA-9hw9-ch79-4vh6
Pillow: Controlled heap out-of-bounds write in `ImageCmsTransform.apply()` via output mode mismatch
Priority HIGH 72
Pillow is a Python imaging library.
TI-2026-42347 CVE-2026-59200 · GHSA-jjj6-mw9f-p565
Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()
Priority HIGH 72
Pillow is a Python imaging library.
TI-2026-42346 CVE-2026-59199 · GHSA-6r8x-57c9-28j4
Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow
Priority HIGH 72
Pillow is a Python imaging library.
TI-2026-39958 CVE-2026-55380 · GHSA-phj9-mv4w-65pm
Pillow GdImageFile decompression bomb protection bypass
Priority HIGH 72
Pillow is a Python imaging library.
TI-2026-39957 CVE-2026-55379 · GHSA-45hq-cxwh-f6vc
Pillow BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb…
Priority HIGH 72
Pillow is a Python imaging library.
TI-2026-38994 CVE-2026-54060 · GHSA-5x94-69rx-g8h2
Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`
Priority HIGH 72
Pillow is a Python imaging library.
TI-2026-38992 CVE-2026-54058 · GHSA-62p4-gmf7-7g93
Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)
Priority HIGH 69
Pillow is a Python imaging library.
TI-2026-46365 CVE-2026-64847 · GHSA-5p39-cfhj-2xmp
AnyIO process-pool workers can block indefinitely on undrained stderr
Priority LOW 29
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio.