CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 25/05/2022 |
| CVE-2022-28470 | CRITICAL9.8 | marcador package in PyPI 0.1 through 0.13 included a code-execution backdoor. | 08/05/2022 |
| CVE-2022-24902 | MEDIUM4.3 | TkVideoplayer is a simple library to play video files in tkinter. Uncontrolled memory consumption in versions of TKVideoplayer prior to 2.0.0 can theoretically lead to performance degradation. There are no known workarounds. This issue has been patched and users are advised to upgrade to version 2.0.0 or later. | 06/05/2022 |
| CVE-2015-20107 | HIGH7.6 | In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or argumen | 13/04/2022 |
| CVE-2022-24303 | CRITICAL9.1 | Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled. | 28/03/2022 |
| CVE-2018-25032 | HIGH7.5 | zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches. | 25/03/2022 |
| CVE-2022-26488 | HIGH7.0 | In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. The installer may allow a local attacker to add user-writable directories to the system search path. To exploit, an administrator must have installed Python for all users and enabled PATH entries. A non- | 10/03/2022 |
| CVE-2021-3733 | MEDIUM6.5 | There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to | 10/03/2022 |
| CVE-2021-3737 | HIGH7.5 | A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability. | 04/03/2022 |
| CVE-2022-0391 | HIGH7.5 | A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a cr | 09/02/2022 |
| CVE-2022-22817 | CRITICAL9.8 | PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be used. | 10/01/2022 |
| CVE-2022-22816 | MEDIUM6.5 | path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path. | 10/01/2022 |
| CVE-2022-22815 | MEDIUM6.5 | path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path. | 10/01/2022 |
| CVE-2021-42576 | CRITICAL9.8 | The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Python (in pybluemonday), does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements. | 18/10/2021 |
| CVE-2021-23437 | HIGH7.5 | The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function. | 03/09/2021 |
| CVE-2021-34552 | CRITICAL9.8 | Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c. | 13/07/2021 |
| CVE-2021-33503 | HIGH7.5 | An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect. | 29/06/2021 |
| CVE-2021-28678 | MEDIUM5.5 | An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data. | 02/06/2021 |