CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 25/05/2022 |
| CVE-2022-28470 | 심각9.8 | marcador package in PyPI 0.1 through 0.13 included a code-execution backdoor. | 08/05/2022 |
| CVE-2022-24902 | 보통4.3 | TkVideoplayer is a simple library to play video files in tkinter. Uncontrolled memory consumption in versions of TKVideoplayer prior to 2.0.0 can theoretically lead to performance degradation. There are no known workarounds. This issue has been patched and users are advised to upgrade to version 2.0.0 or later. | 06/05/2022 |
| CVE-2015-20107 | 높음7.6 | In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or argumen | 13/04/2022 |
| CVE-2022-24303 | 심각9.1 | Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled. | 28/03/2022 |
| CVE-2018-25032 | 높음7.5 | zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches. | 25/03/2022 |
| CVE-2022-26488 | 높음7.0 | In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. The installer may allow a local attacker to add user-writable directories to the system search path. To exploit, an administrator must have installed Python for all users and enabled PATH entries. A non- | 10/03/2022 |
| CVE-2021-3733 | 보통6.5 | There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to | 10/03/2022 |
| CVE-2021-3737 | 높음7.5 | A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability. | 04/03/2022 |
| CVE-2022-0391 | 높음7.5 | A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a cr | 09/02/2022 |
| CVE-2022-22817 | 심각9.8 | PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be used. | 10/01/2022 |
| CVE-2022-22816 | 보통6.5 | path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path. | 10/01/2022 |
| CVE-2022-22815 | 보통6.5 | path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path. | 10/01/2022 |
| CVE-2021-42576 | 심각9.8 | The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Python (in pybluemonday), does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements. | 18/10/2021 |
| CVE-2021-23437 | 높음7.5 | The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function. | 03/09/2021 |
| CVE-2021-34552 | 심각9.8 | Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c. | 13/07/2021 |
| CVE-2021-33503 | 높음7.5 | An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect. | 29/06/2021 |
| CVE-2021-28678 | 보통5.5 | An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data. | 02/06/2021 |