CVE Vulnerability Catalog

A vulnerability in macOS Sequoia 15.8 and macOS Tahoe 26.7 due to improper checks. An app may be able to elevate privileges.

JoySafeter through 1.0.0 contains a remote code execution vulnerability that allows authenticated users to run operating system commands via an unsandboxed execute tool in Copilot standard mode. Attackers can self-register, select standard mode in the WebSocket chat.start extension, and have the agent invoke subprocess.run with shell=True on the host to access other tenants' data and server secrets.

LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or Python by planting instructions in web content retrieved by the agent. Because Bash and ExecuteCode lack an allow-list and human-in-the-loop approval, attackers can run code in the workspace sandbox and exfiltrate vault secrets from _internal/.vault_secrets.json.

Before version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits, allowing a remote, unauthenticated client to send 1-byte HPACK references to a near-empty header. This caused the server to allocate hundreds of thousands of header fields per stream across an unlimited number of streams on one connection, potentially exhausting memory and terminating the Pingora process.

IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow a physically proximate attacker to gain elevated privileges due to the use of hard-coded credentials.

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper authentication.

IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hijack an entire conversation session by reassigning its session ID.

IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 could allow a local attacker to gain elevated privileges due to improper privilege management.

MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend. An unauthenticated attacker can submit a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint, causing trace_info.yaml, request_metadata and tag files to be written outside the intended experiment trace directory (within the server process's filesystem permissions). FileStore was the default backend before MLflow 3.7.0 and is opt-in thereafter.

Pillow prior to 13.0.0 is vulnerable to regular-expression denial of service in its XBM header parser. Calling Image.open() on a small crafted XBM file causes a backtracking expression to be applied to the attacker-controlled header, stalling a worker for minutes.

In Pillow prior to 13.0.0, the TIFF encoder can read beyond a ColorMap buffer when retained TIFF metadata has a plane size inconsistent with BitsPerSample. A small TIFF can be opened normally and then retain a crafted ColorMap that is reused when the image is saved. An application that re-encodes the attacker's TIFF with libtiff can trigger the out-of-bounds read.

In Pillow from 5.1.0 until 13.0.0, the library can exhaust resources while parsing an existing PDF during an append operation. PdfParser follows page-tree child references without cycle or duplication tracking and follows previous-trailer chains with only an exact repeated-offset guard, so deep or cyclic page trees and long chains of unique trailer offsets can exhaust the Python stack. An attacker can supply such a PDF to an application that calls Image.save with PDF append enabled.

In Pillow from 5.1.0 until 13.0.0, reserving PDF object identifiers when saving many frames with save_all enabled takes quadratic time. PdfParser.next_object_id() repeatedly rebuilds and scans all previously reserved identifiers for every object. An attacker can supply a multi-frame image, including a small APNG with a large declared frame count, to an application that converts it to a multipage PDF.

In Pillow from 10.0.0 until 13.0.0, the library can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale glyph variable. An attacker can supply a malformed font as untrusted bytes to an application that draws text with a nonzero stroke width.

In Pillow from 4.1.0 until 13.0.0, the MSP RLE decoder can expand a small file into an unbounded in-memory buffer. The decoder writes run-length output to BytesIO without limiting expansion to the declared image size. An attacker can supply a crafted MSP image to an application that loads its pixels.

Pillow from 9.2.0 until 13.0.0 performs quadratic copying when saving a GIF with a long comment. _get_global_header() repeatedly copies portions of comment data, including comments from an untrusted input image, which can consume excessive CPU.

In Pillow from 5.1.0 until 13.0.0, the library can enter an infinite loop while rewriting PDF pages. PdfParser.rewrite_pages() follows Parent relationships without detecting a cycle in the page tree. An attacker can supply a cyclic PDF to an application that appends an image to that PDF.

In Pillow from 12.0.0 until 13.0.0, Image.merge() can dereference a null image8 plane. Validation skips the first input band, allowing a 32-bit integer or floating-point image backed by image32 storage to be merged as a narrower multiband image. A crafted IPTC file can reach this path when an application opens and loads it, or a caller can invoke Image.merge() directly with such a first band.

In Pillow from 8.1.0 until 13.0.0, the TIFF tile and RGBA decode paths can read beyond row data produced by libtiff. In _decodeTile and the RGBA unpacker path, when Pillow and libtiff interpret duplicated PhotometricInterpretation or BitsPerSample tags differently, Pillow does not verify that the required input row fits inside the row libtiff produced (the strip path has this validation). Loading pixels from such a crafted TIFF can expose adjacent heap data in output pixels or crash the process.

Pillow before version 13.0.0 can double free image memory when ImagingScaleAffine encounters a selective allocation failure. This affects the fast path for Transform.EXTENT or pure scale-and-translate Transform.AFFINE operations with default NEAREST resampling. An attacker can trigger the failure by driving a large Image.transform() operation under memory pressure.