Vulnerabilities
Pillow 13.0.0 Fixes High-Severity Heap Buffer Over-Read in TIFF Decoder
Security teams must upgrade Pillow to version 13.0.0 to address a high-severity memory leak in TIFF decoding that exposes heap contents.
Python
Everything Vuln Post has reported about Python: 8 stories, newest first. Part of our Vulnerabilities coverage.
Vulnerabilities
Vulnerabilities
Pillow Ghostscript Argument Injection CVE-2026-112900 Patched in Version 13.0.0 Release
Python imaging library Pillow has released version 13.0.0 to fix a critical argument injection flaw that allows attackers to execute arbitrary commands via Ghostscript.
Vulnerabilities
aiohttp keepalive flaw lets attackers hoard server connections
Versions before 3.14.4 lack initial timeout checks, allowing idle connections to persist indefinitely and exhaust capacity.
Vulnerabilities
Pillow APNG Memory Exhaustion Vulnerability Fixed in Version 13.0.0
A high-severity flaw in the Python imaging library allows crafted animated PNGs to crash servers by exhausting system memory before safety checks run.
Vulnerabilities
aiohttp multipart flaw exhausts file descriptors in Python apps
An unauthenticated attacker can crash servers using crafted requests in aiohttp versions before 3.14.4. A patch is now available for affected Python deployments.
Vulnerabilities
LMCache Unauthenticated RCE Flaw in Multiprocess Mode Affects Versions Before 0.5.6
A critical remote code execution flaw in LMCache allows unauthenticated attackers to run code via Pickle deserialization in distributed deployments.
Vulnerabilities
Critical Command Injection in Claude Agent SDK Python Versions Before 0.2.121
Anthropic releases patch for CVE-2026-96620, a critical flaw allowing arbitrary command execution via unvalidated resume parameters in the Python SDK.
Vulnerabilities
GitPython Argument Injection in Head.checkout() Allows Arbitrary File Read Before 3.2.0
Versions of the GitPython library prior to 3.2.0 contain a high-severity argument injection flaw that lets attackers read local files via malicious branch names.