python-pillow

Records319All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical40CVSS 9.0–10.0

CVSS high143CVSS 7.0–8.9

Exploited now

python-pillow records in CISA KEV

No python-pillow vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Python 140 records HIGH Pillow 111 records HIGH Urllib3 22 records MEDIUM Requests 6 records MEDIUM Setuptools 4 records HIGH Keyring 3 records LOW Black 2 records MEDIUM Pyxdg 2 records LOW

Records

319 records

TI-2016-01993 CVE-2016-2183 · GHSA-w2rw-pv8p-h9c8

The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other…

HIGH 83

The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obt…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.94697 Published 2016-09-01 Partial fix CWE-200

TI-2022-24108 CVE-2022-48565 · GHSA-crhm-wc96-7579

An XML External Entity (XXE) issue was discovered in Python through 3.9.1.

HIGH 82

An XML External Entity (XXE) issue was discovered in Python through 3.9.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.05233 Published 2023-08-22 Partial fix CWE-611

TI-2022-17508 CVE-2022-37454 · GHSA-6w4m-2xhg-2658

The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and…

HIGH 82

The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.07413 Published 2022-10-21 Partial fix · 1.0.5 CWE-190

TI-2021-02254 CVE-2021-3177 · GHSA-hc96-xw56-vfwh

Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c…

HIGH 82

Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demons…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.24002 Published 2021-01-19 Partial fix CWE-120

TI-2007-04413 CVE-2007-4559 · GHSA-gw9q-c7gh-j9vm

Directory traversal vulnerability in the (1) extract and (2) extractall functions in the…

HIGH 82

Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a ..

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.27095 Published 2007-08-28 Partial fix CWE-22

TI-2026-76627 CVE-2026-112896 · GHSA-pchr-8j38-3x4p

Out-of-bounds read in Pillow TIFF encoder ColorMap handling

HIGH 77

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00475 Published 2026-10-19 Partial fix · 13.0.0 CWE-125

TI-2026-76625 CVE-2026-112894 · GHSA-jg86-v3jv-hrpm

Quadratic-time denial of service in Pillow PDF save_all

HIGH 77

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00594 Published 2026-10-19 Partial fix · 13.0.0 CWE-407

TI-2026-76605 CVE-2026-112405 · GHSA-cp9v-662q-vvx9

NULL pointer dereference in Pillow's Image.merge function

HIGH 77

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00594 Published 2026-10-19 Partial fix · 13.0.0 CWE-476

TI-2026-76604 CVE-2026-112404 · GHSA-c6hw-5grf-ff96

Out-of-bounds read in Pillow TIFF decoding leaks heap memory

HIGH 77

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00444 Published 2026-10-19 Partial fix · 13.0.0 CWE-126

TI-2026-76602 CVE-2026-112402 · GHSA-7mwm-ghpf-9vrm

Double free in Pillow ImagingScaleAffine on allocation failure

HIGH 77

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00594 Published 2026-10-19 Partial fix · 13.0.0 CWE-416

TI-2026-76600 CVE-2026-112400 · GHSA-65qm-jvmh-6pqg

GIF seek in Pillow keeps rejected size, allowing denial of service

HIGH 77

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00594 Published 2026-10-19 Partial fix · 13.0.0 CWE-400

TI-2026-76599 CVE-2026-112399 · GHSA-5xm2-6676-qcp9

Excessive memory use in Pillow APNG handling enables denial of service

HIGH 77

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00529 Published 2026-10-19 Partial fix · 13.0.0 CWE-789

TI-2026-76597 CVE-2026-112397 · GHSA-58r4-6rv3-gfh8

Out-of-bounds memory access in Pillow morphology on zero-width images

HIGH 77

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00573 Published 2026-10-19 Partial fix · 13.0.0 CWE-787

TI-2026-42349 CVE-2026-59204 · GHSA-vjc4-5qp5-m44j

Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service

HIGH 77

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00385 Published 2026-07-14 Partial fix · 12.3.0 CWE-789

TI-2014-00217 CVE-2014-0224 · GHSA-84gm-v5wh-659w

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly…

HIGH 76

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key…

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.95326 Published 2014-06-05 Partial fix CWE-326

TI-2026-79005 CVE-2026-96640 · GHSA-mrfp-p49p-3hf2

Resource exhaustion in Pillow PDF append via malformed page tree

HIGH 75

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00604 Published 2026-10-21 Partial fix · 13.0.0 CWE-400

TI-2026-76624 CVE-2026-112893 · GHSA-j4m9-6w36-pw47

Invalid free in Pillow FreeType rendering when a stroker is active

HIGH 75

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00549 Published 2026-10-19 Partial fix · 13.0.0 CWE-457

TI-2026-76603 CVE-2026-112403 · GHSA-8g5g-8vmr-9782

Heap buffer overflow in Pillow JPEG decoder

HIGH 75

Pillow is a Python imaging library.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00945 Published 2026-10-19 Partial fix · 13.0.0 CWE-122

TI-2026-76598 CVE-2026-112398 · GHSA-5x8w-8jj5-q52h

Heap buffer overflow in Pillow FlashPix JPEG decoding

HIGH 75

Pillow is a Python imaging library.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00696 Published 2026-10-19 Partial fix · 13.0.0 CWE-122

TI-2026-76595 CVE-2026-112395 · GHSA-462x-pgg6-55fp

Pillow tiled-TIFF decoder reads past tile buffer

HIGH 75

Pillow is a Python imaging library.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00514 Published 2026-10-19 Partial fix · 13.0.0 CWE-122

TI-2026-76593 CVE-2026-112393 · GHSA-332p-7hrc-92wf

Pillow heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO

HIGH 75

Pillow is a Python imaging library.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.01019 Published 2026-10-19 Partial fix · 13.0.0 CWE-122

TI-2026-76592 CVE-2026-112392 · GHSA-27h8-gf7j-v5hc

NULL dereference in Pillow rank filters crashes on zero-size images

HIGH 75

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00593 Published 2026-10-19 Partial fix · 13.0.0 CWE-476

TI-2026-76590 CVE-2026-112390 · GHSA-22hg-r758-rrw9

Infinite loop in Pillow MIC frame counting with embedded TIFF

HIGH 75

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00593 Published 2026-10-19 Partial fix · 13.0.0 CWE-835

TI-2026-42344 CVE-2026-59197 · GHSA-xj96-63gp-2gmr

Pillow: Heap out-of-bounds write in Pillow `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`

HIGH 75

Pillow is a Python imaging library.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00445 Published 2026-07-14 Partial fix · 12.3.0 CWE-190

TI-2025-29803 CVE-2025-47273 · GHSA-5rjg-fvgr-3xxf

setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write

HIGH 73

setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.01592 Published 2025-05-17 Partial fix · 78.1.1 CWE-22

Open these records in search →

Critical	40
High	143
Medium	120
Low	16
No CVSS	0