TI-2026-42349 CVE-2026-59204 · GHSA-vjc4-5qp5-m44j
Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service
Priority HIGH 77
Pillow is a Python imaging library.
RHSA-2026:81110
Red Hat Quay 3.18.1
Released 2026-10-12 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Quay 3.18 registry.redhat.io/quay/quay-builder-rhel9, registry.redhat.io/quay/quay-rhel9
Fixes 21 records
TI-2026-42344 CVE-2026-59197 · GHSA-xj96-63gp-2gmr
Pillow: Heap out-of-bounds write in Pillow `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`
Priority HIGH 75
Pillow is a Python imaging library.
TI-2026-42350 CVE-2026-59205 · GHSA-9hw9-ch79-4vh6
Pillow: Controlled heap out-of-bounds write in `ImageCmsTransform.apply()` via output mode mismatch
Priority HIGH 72
Pillow is a Python imaging library.
TI-2026-42347 CVE-2026-59200 · GHSA-jjj6-mw9f-p565
Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()
Priority HIGH 72
Pillow is a Python imaging library.
TI-2026-42346 CVE-2026-59199 · GHSA-6r8x-57c9-28j4
Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow
Priority HIGH 72
Pillow is a Python imaging library.
TI-2026-39958 CVE-2026-55380 · GHSA-phj9-mv4w-65pm
Pillow GdImageFile decompression bomb protection bypass
Priority HIGH 72
Pillow is a Python imaging library.
TI-2026-39957 CVE-2026-55379 · GHSA-45hq-cxwh-f6vc
Pillow BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb…
Priority HIGH 72
Pillow is a Python imaging library.
TI-2026-36631 CVE-2026-49477 · GHSA-836r-79rf-4m37
Soup Sieve: Regular Expression Denial of Service (ReDoS) in soupsieve Selector Parser
Priority HIGH 72
Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4.
TI-2026-47617 CVE-2026-67321 · GHSA-hcpx-6fm6-wx23
axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypass
Priority HIGH 70
axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'.
TI-2026-38992 CVE-2026-54058 · GHSA-62p4-gmf7-7g93
Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)
Priority HIGH 69
Pillow is a Python imaging library.
TI-2026-36731 CVE-2026-49825 · GHSA-4jhm-jv67-739f
lxml: javascript: URL bypass in Cleaner via xlink:href
Priority HIGH 69
lxml is a library for processing XML and HTML in the Python language.
TI-2026-32592 CVE-2026-44705 · GHSA-ph9p-34f9-6g65
tmp: Path Traversal via unsanitized prefix/postfix enables directory escape
Priority HIGH 69
tmp is a temporary file and directory creator for node.js.
TI-2026-47609 CVE-2026-67313 · GHSA-42h9-826w-cgv3
axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON
Priority HIGH 67
axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments.
TI-2026-47610 CVE-2026-67314 · GHSA-xj6q-8x83-jv6g
axios before 1.18.0 Prototype Pollution via auth subfields
Priority MEDIUM 61
axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js).
TI-2026-39576 CVE-2026-54770 · GHSA-6hx8-3wjj-gr8g
WebOb: Open redirect in Location header normalization via leading C0 control / space characters
Priority MEDIUM 60
WebOb provides objects for HTTP requests and responses.
TI-2026-42700 CVE-2026-59886 · GHSA-hm4w-wwcw-mr6r
pyasn1: Uncontrolled resource consumption when converting decoded REAL values
Priority LOW 39
pyasn1 is a generic ASN.1 library for Python.
TI-2026-13562 CVE-2026-16221 · GHSA-v2hh-gcrm-f6hx
fast-uri vulnerable to host confusion via literal backslash authority delimiter
Priority LOW 39
Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter.
TI-2026-47616 CVE-2026-67320 · GHSA-gcfj-64vw-6mp9
axios before 0.33.0 Prototype Pollution via Node HTTP adapter
Priority LOW 37
axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy.
TI-2026-47530 CVE-2026-67214 · GHSA-28wg-ghj8-5hjv
nanoid Infinite Loop via Negative Size in non-secure module
Priority LOW 36
nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure).
TI-2026-15009 CVE-2026-18255 · GHSA-x8x8-qp2x-c2mj
Quay: quay: global read-only superuser can view robot account tokens
Priority LOW 35
A flaw was found in Quay.
Priority LOW 28
A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic.