PyPI Advisories.

Pillow: Infinite loop in MIC n_frames when the embedded TIFF

• Denial of service

>=7.2.0, <13.0.0 · fixed in 13.0.0

Pillow: Quadratic GIF comment copying during save

• Denial of service

>=9.2.0, <13.0.0 · fixed in 13.0.0

Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images

• Memory corruption

<13.0.0 · fixed in 13.0.0

Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0

• Memory corruption

>=12.0.0, <13.0.0 · fixed in 13.0.0

Pillow: Invalid free in FreeType glyph rendering when a stroker is active

• Memory corruption

>=10.0.0, <13.0.0 · fixed in 13.0.0

Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform

• Memory corruption

<13.0.0 · fixed in 13.0.0

Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size

• CWE-126

<13.0.0 · fixed in 13.0.0

Pillow: Argument Injection in Ghostscript call, potentially leading into RCE

• Command injection

>=2.6.0, <13.0.0 · fixed in 13.0.0

pypdf: Unvalidated JPEG image data loading

• CWE-20
• CWE-183

<6.21.1 · fixed in 6.21.1

djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool

• Path traversal

>=0.9.0, <1.0.10 || >=1.1.0, <1.1.7 || >=1.2.0.dev0, <1.2.4 || >=1.3.0.dev0, <1.3.0rc8 · fixed in 1.0.10, 1.1.7, 1.2.4, 1.3.0rc8

pypdf: Possible infinite loop in PdfWriter.find_outline_item

• Denial of service

<6.20.1 · fixed in 6.20.1

pypdf: Possible infinite loop when removing tree items

• Denial of service

<6.20.1 · fixed in 6.20.1

pypdf: Possible infinite loop when hitting EOF in standard xref table

• Denial of service

<6.20.0 · fixed in 6.20.0

virtualenv bash activate runs commands from an environment name with a backslash before $

• Command injection
• CWE-116

<21.14.7 · fixed in 21.14.7

pypdf: Possible large memory usage for streams with multiple filters

• Denial of service

<6.20.0 · fixed in 6.20.0

virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST

• Command injection
• CWE-116

<21.14.4 · fixed in 21.14.4

virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote

• Command injection
• CWE-116

<21.14.2 · fixed in 21.14.2

virtualenv activation scripts run code from a path that contains a placeholder name

• Command injection
• Code injection

>=20.26.6, <21.14.2 · fixed in 21.14.2

Pydantic AI Harness tool-call limit bypass in nested CodeMode calls

• Denial of service

<0.59.0 · fixed in 0.59.0

Duplicate Advisory: uv vulnerable to arbitrary file deletion through RECORD entries

• Path traversal

* · no fixed version yet

Duplicate Advisory: vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution

• Code injection

>=0.7.3, <0.31.0 · fixed in 0.31.0

Duplicate Advisory: vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs

• Denial of service

>=0.7.3 · no fixed version yet

Duplicate Advisory: vLLM vulnerable to remote denial of service through forged multimodal UUID cache desynchronization

• CWE-345

* · no fixed version yet

vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying caller-controlled values such as EXIF ImageID or cache_salt....

• Broken access control

<0.31.0 · fixed in 0.31.0

vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mm_processor_kwargs value in...

• Denial of service

>=0.24.0, <0.31.0 · fixed in 0.31.0

certifi bundles emSign root CAs with compromised intermediate CA keys

>=2019.03.09, <2026.10.18 · fixed in 2026.10.18

Pillow: Out-of-bounds access in _imagingmorph on a zero-width image

• Memory corruption

<13.0.0 · fixed in 13.0.0

Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS

• Denial of service

>=9.2.0, <13.0.0 · fixed in 13.0.0

Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit

• Denial of service

>=2.3.0, <13.0.0 · fixed in 13.0.0

Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips

• Memory corruption

>=5.3.0, <13.0.0 · fixed in 13.0.0

Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read

• Memory corruption

<13.0.0 · fixed in 13.0.0

Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)

• Denial of service

>=5.1.0, <13.0.0 · fixed in 13.0.0

Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)

• Memory corruption

>=8.2.0, <13.0.0 · fixed in 13.0.0

Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels

• Memory corruption
• CWE-126

>=8.1.0, <13.0.0 · fixed in 13.0.0

Pillow: Heap buffer overflow in ImagingJpegDecode

• Memory corruption

<13.0.0 · fixed in 13.0.0

AIOHTTP: Absolute-form request targets can spoof Request.scheme

• CWE-807

<3.14.4 · fixed in 3.14.4

AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies

• CWE-565

<3.14.4 · fixed in 3.14.4

AIOHTTP: Connector pool exhaustion via Max-Age overflow

• Denial of service

<3.14.4 · fixed in 3.14.4

AIOHTTP: Pure-Python parser request smuggling

• HTTP request smuggling

<3.14.4 · fixed in 3.14.4

AIOHTTP: File descriptor exhaustion in multipart requests

• Denial of service

>=2.0.0, <3.14.4 · fixed in 3.14.4

uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised

• Weak cryptography or TLS

<0.13.4 · fixed in 0.13.4

MLflow FileStore trace IDs allow path traversal and arbitrary file writes

• Path traversal

<3.17.2 · fixed in 3.17.2

aiohttp server lacks an initial request/header timeout

• Denial of service

<3.14.4 · fixed in 3.14.4

AIOHTTP: Secure attribute not enforced for shared cookie

• Weak cryptography or TLS
• CWE-1004

<3.14.4 · fixed in 3.14.4

aiohttp: Multiple instances of excessive or unbounded memory/CPU use

• Denial of service

<3.14.4 · fixed in 3.14.4

Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML

• Cross-site scripting (XSS)
• CWE-116

>=3.0.0, <3.2.11 · fixed in 3.2.11

Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass

• Broken access control
• CWE-185

>=3.0.0, <3.2.4 · fixed in 3.2.4

Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo

• Path traversal

>=0.7.2, <0.9.70 · fixed in 0.9.70

Mercury: Unauthenticated Remote Code Execution via /api/kernels

• Broken access control

<3.2.6 · fixed in 3.2.6

LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files

• CWE-346
• CWE-942

>=0.0.1, <0.4.5 · fixed in 0.4.5

LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport

• Authentication bypass
• Insecure deserialization

>=0.3.9, <0.5.6 · fixed in 0.5.6

Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution

• Command injection
• CWE-20

<0.2.121 · fixed in 0.2.121

ClickMigrate has Path Traversal in "revision -m" argument

• Path traversal

<1.0.3 · fixed in 1.0.3

Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation

• Denial of service
• Broken access control

>=0.0.98, <1.6.0 · fixed in 1.6.0

JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked

• Race condition
• Broken access control

>=4.5.7, <4.5.11 || >=4.6.0, <4.6.4 · fixed in 4.5.11, 4.6.4

tinytag: Infinite loop when parsing certain M4A files containing invalid atoms

• Denial of service

>=2.0.0, <2.3.0 · fixed in 2.3.0

copyparty FTP: upload outside defined volumes (limited path traversal)

• Path traversal

<1.20.19 · fixed in 1.20.19

unstructured: Stored XSS via unescaped HTML generation

• Cross-site scripting (XSS)
• CWE-116

<0.24.1 · fixed in 0.24.1

MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion

• Denial of service

>=1.8.0, <1.30.0 || >=2.0.0, <2.2.0 · fixed in 1.30.0, 2.2.0

borg extract might modify out-of-tree files when extracting maliciously crafted archives

• Path traversal

<1.4.5 || >=2.0.0b1, <2.0.0b22 · fixed in 1.4.5, 2.0.0b22