Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 2 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 402,318All CVEsplus 19,142 rejected
- 286Last 24 hours3,325 in the last 7 days
- 16,941Last 30 days1,542 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 5 | 35 | 19 | 0 | 0 | 59 | 60 |
| 2025 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-112902 | Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tagspython-pillow · Pillow | High8.3 |
| CVE-2026-112899 | Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limitpython-pillow · Pillow | Medium6.3 |
| CVE-2026-114501 | Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1Public exploitpython-pillow · Pillow | Medium6.3 |
| CVE-2026-96639 | Pillow multi-frame loaders can reuse stale native image storage after mode transitionspython-pillow · Pillow | Critical9.8 |
| CVE-2026-96636 | Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)Public exploitpython-pillow · Pillow | Medium6.5 |
| CVE-2026-96640 | Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustionPublic exploitpython-pillow · Pillow | High8.2 |
| CVE-2026-96637 | Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoSpython-pillow · Pillow | High7.1 |
| CVE-2026-96778 | Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills bufferPublic exploitpython-pillow · Pillow | High7.7 |
| CVE-2026-96643 | Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic timepython-pillow · Pillow | High7.1 |
| CVE-2026-96644 | Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)Public exploitpython-pillow · Pillow | High7.1 |
| CVE-2026-96641 | Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromisePublic exploitpython-pillow · Pillow | Medium6.5 |
| CVE-2026-96642 | Pillow: TarIO negative size field causes infinite CPU-spin loopPublic exploitpython-pillow · Pillow | High7.1 |
| CVE-2026-96638 | Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute modepython-pillow · Pillow | Medium6.5 |
| CVE-2026-112901 | Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutespython-pillow · Pillow | Medium6.9 |
| CVE-2026-112900 | Pillow: Argument Injection in Ghostscript call, potentially leading into RCEpython-pillow · Pillow | Critical9.2 |
| CVE-2026-112898 | Pillow: Image.quantize() with empty palette leaks uninitialized stack memoryPublic exploitpython-pillow · Pillow | Medium6.9 |
| CVE-2026-112897 | Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG stripsPublic exploitpython-pillow · Pillow | High8.7 |
| CVE-2026-112896 | Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds readPublic exploitpython-pillow · Pillow | High8.8 |
| CVE-2026-112895 | Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)python-pillow · Pillow | High8.7 |
| CVE-2026-112894 | Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)Public exploitpython-pillow · Pillow | High8.7 |
| CVE-2026-112893 | Pillow: Invalid free in FreeType glyph rendering when a stroker is activePublic exploitpython-pillow · Pillow | High8.2 |
| CVE-2026-112892 | Pillow: MSP RLE decoder expands a tiny file into unbounded memorypython-pillow · Pillow | High8.7 |
| CVE-2026-112891 | Pillow: Quadratic GIF comment copying during savepython-pillow · Pillow | Medium6.9 |
| CVE-2026-112406 | Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cyclepython-pillow · Pillow | High8.7 |
| CVE-2026-112405 | Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0Public exploitpython-pillow · Pillow | High8.7 |
| CVE-2026-112404 | Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixelsPublic exploitpython-pillow · Pillow | High8.8 |
| CVE-2026-112403 | Pillow: Heap buffer overflow in ImagingJpegDecodePublic exploitpython-pillow · Pillow | Critical9.2 |
| CVE-2026-112402 | Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transformPublic exploitpython-pillow · Pillow | High8.7 |
| CVE-2026-112397 | Pillow: Out-of-bounds access in _imagingmorph on a zero-width imagePublic exploitpython-pillow · Pillow | High8.7 |
| CVE-2026-112392 | Pillow: NULL dereference in ImagingExpand via rank filters on zero-size imagesPublic exploitpython-pillow · Pillow | High8.2 |
| CVE-2026-112401 | Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()python-pillow · Pillow | Medium6.9 |
| CVE-2026-112400 | Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoSPublic exploitpython-pillow · Pillow | High8.7 |
| CVE-2026-112399 | Pillow: APNG background disposal allocates full canvas before decompression bomb checkPublic exploitpython-pillow · Pillow | High8.7 |
| CVE-2026-112398 | Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code executionPublic exploitpython-pillow · Pillow | Critical9.2 |
| CVE-2026-112396 | Pillow: Heap use-after-free when encoding TIFF to an in-memory bufferpython-pillow · Pillow | Medium5.9 |
| CVE-2026-112395 | Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)Public exploitpython-pillow · Pillow | Medium6.5 |
| CVE-2026-112394 | Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer sizePublic exploitpython-pillow · Pillow | Medium6.3 |
| CVE-2026-112393 | Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIOPublic exploitpython-pillow · Pillow | Critical9.2 |
| CVE-2026-112391 | Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()python-pillow · Pillow | Medium6.3 |
| CVE-2026-112390 | Pillow: Infinite loop in MIC n_frames when the embedded TIFFPublic exploitpython-pillow · Pillow | High8.2 |
| CVE-2026-54058 | Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)Public exploitpython-pillow · Pillow | High8.3 |
| CVE-2026-59197 | Pillow: Heap out-of-bounds write in Pillow `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`Public exploitpython-pillow · Pillow | High8.2 |
| CVE-2026-59200 | Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()Public exploitpython-pillow · Pillow | High7.5 |
| CVE-2026-59198 | Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated imagesPublic exploitpython-pillow · Pillow | Medium6.5 |
| CVE-2026-59205 | Pillow: Controlled heap out-of-bounds write in `ImageCmsTransform.apply()` via output mode mismatchPublic exploitpython-pillow · Pillow | High7.5 |
| CVE-2026-59203 | Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of servicePublic exploitpython-pillow · Pillow | Medium5.3 |
| CVE-2026-59199 | Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflowPublic exploitpython-pillow · Pillow | High7.5 |
| CVE-2026-59204 | Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of servicePublic exploitpython-pillow · Pillow | High8.7 |
| CVE-2026-55379 | Pillow BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loadingPublic exploitpython-pillow · Pillow | High7.5 |
| CVE-2026-55380 | Pillow GdImageFile decompression bomb protection bypassPublic exploitpython-pillow · Pillow | High7.5 |