Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 6 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,189All CVEsplus 18,875 rejected
- 800Last 24 hours3,227 in the last 7 days
- 17,393Last 30 days1,564 of them critical
- 1,767Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 5 | 34 | 18 | 0 | 0 | 57 | 58 |
| 2025 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-114501 | Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1python-pillow · Pillow | Medium6.3 |
| CVE-2026-96639 | Pillow multi-frame loaders can reuse stale native image storage after mode transitionspython-pillow · Pillow | Critical9.8 |
| CVE-2026-96636 | Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)python-pillow · Pillow | Medium6.5 |
| CVE-2026-96640 | Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustionpython-pillow · Pillow | High8.2 |
| CVE-2026-96637 | Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoSpython-pillow · Pillow | High7.1 |
| CVE-2026-96778 | Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills bufferpython-pillow · Pillow | High7.7 |
| CVE-2026-96643 | Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic timepython-pillow · Pillow | High7.1 |
| CVE-2026-96644 | Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)python-pillow · Pillow | High7.1 |
| CVE-2026-96641 | Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromisepython-pillow · Pillow | Medium6.5 |
| CVE-2026-96642 | Pillow: TarIO negative size field causes infinite CPU-spin looppython-pillow · Pillow | High7.1 |
| CVE-2026-96638 | Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute modepython-pillow · Pillow | Medium6.5 |
| CVE-2026-112901 | Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutespython-pillow · Pillow | Medium6.9 |
| CVE-2026-112900 | Pillow: Argument Injection in Ghostscript call, potentially leading into RCEpython-pillow · Pillow | Critical9.2 |
| CVE-2026-112898 | Pillow: Image.quantize() with empty palette leaks uninitialized stack memorypython-pillow · Pillow | Medium6.9 |
| CVE-2026-112897 | Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG stripspython-pillow · Pillow | High8.7 |
| CVE-2026-112896 | Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds readpython-pillow · Pillow | High8.8 |
| CVE-2026-112895 | Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)python-pillow · Pillow | High8.7 |
| CVE-2026-112894 | Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)python-pillow · Pillow | High8.7 |
| CVE-2026-112893 | Pillow: Invalid free in FreeType glyph rendering when a stroker is activepython-pillow · Pillow | High8.2 |
| CVE-2026-112892 | Pillow: MSP RLE decoder expands a tiny file into unbounded memorypython-pillow · Pillow | High8.7 |
| CVE-2026-112891 | Pillow: Quadratic GIF comment copying during savepython-pillow · Pillow | Medium6.9 |
| CVE-2026-112406 | Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cyclepython-pillow · Pillow | High8.7 |
| CVE-2026-112405 | Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0python-pillow · Pillow | High8.7 |
| CVE-2026-112404 | Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixelspython-pillow · Pillow | High8.8 |
| CVE-2026-112403 | Pillow: Heap buffer overflow in ImagingJpegDecodepython-pillow · Pillow | Critical9.2 |
| CVE-2026-112402 | Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transformpython-pillow · Pillow | High8.7 |
| CVE-2026-112397 | Pillow: Out-of-bounds access in _imagingmorph on a zero-width imagepython-pillow · Pillow | High8.7 |
| CVE-2026-112392 | Pillow: NULL dereference in ImagingExpand via rank filters on zero-size imagespython-pillow · Pillow | High8.2 |
| CVE-2026-112401 | Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()python-pillow · Pillow | Medium6.9 |
| CVE-2026-112400 | Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoSpython-pillow · Pillow | High8.7 |
| CVE-2026-112399 | Pillow: APNG background disposal allocates full canvas before decompression bomb checkpython-pillow · Pillow | High8.7 |
| CVE-2026-112398 | Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code executionpython-pillow · Pillow | Critical9.2 |
| CVE-2026-112396 | Pillow: Heap use-after-free when encoding TIFF to an in-memory bufferpython-pillow · Pillow | Medium5.9 |
| CVE-2026-112395 | Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)python-pillow · Pillow | Medium6.5 |
| CVE-2026-112394 | Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer sizepython-pillow · Pillow | Medium6.3 |
| CVE-2026-112393 | Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIOpython-pillow · Pillow | Critical9.2 |
| CVE-2026-112391 | Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()python-pillow · Pillow | Medium6.3 |
| CVE-2026-112390 | Pillow: Infinite loop in MIC n_frames when the embedded TIFFpython-pillow · Pillow | High8.2 |
| CVE-2026-54058 | Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)python-pillow · Pillow | High8.3 |
| CVE-2026-59197 | Pillow: Heap out-of-bounds write in Pillow `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`python-pillow · Pillow | High8.2 |
| CVE-2026-59200 | Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()python-pillow · Pillow | High7.5 |
| CVE-2026-59198 | Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated imagespython-pillow · Pillow | Medium6.5 |
| CVE-2026-59205 | Pillow: Controlled heap out-of-bounds write in `ImageCmsTransform.apply()` via output mode mismatchpython-pillow · Pillow | High7.5 |
| CVE-2026-59203 | Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of servicepython-pillow · Pillow | Medium5.3 |
| CVE-2026-59199 | Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflowpython-pillow · Pillow | High7.5 |
| CVE-2026-59204 | Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of servicepython-pillow · Pillow | High8.7 |
| CVE-2026-55379 | Pillow BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loadingpython-pillow · Pillow | High7.5 |
| CVE-2026-55380 | Pillow GdImageFile decompression bomb protection bypasspython-pillow · Pillow | High7.5 |
| CVE-2026-54060 | Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`python-pillow · Pillow | High7.5 |
| CVE-2026-54059 | Pillow: PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loadingpython-pillow · Pillow | High7.5 |