漏洞公告

Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`

Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading

Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`

Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading

Astro: Reflected XSS via unescaped View Transition animation properties

Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)

@better-auth/sso: SSO provider may allow registration for any org member without a checking their role

brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups

Composer: Arbitrary file write outside vendor via malicious transitive package name

vLLM denial of service via prompt embeds on M-RoPE models

pillow-heif: Integer Overflow in Encode Path Buffer Validation Leads to Heap Out-of-Bounds Read

changedetection.io is vulnerable to unauthenticated static path traversal

Tornado: Quadratic DoS via Crafted Multipart Parameters

Tornado: Quadratic DoS via Repeated Header Coalescing

Tornado vulnerable to Header Injection and XSS via reason argument

Axios: Excessive recursion in formDataToJSON can cause denial of service

Axios: Prototype pollution auth subfields can inject Basic auth

Axios: Deep formToJSON Key Recursion Can Cause Denial of Service

Keras: TorchModuleWrapper can deserialize unsafe PyTorch pickle data

Duplicate Advisory: SurrealDB no JavaScript script function default timeout could facilitate DoS

Duplicate Advisory: Uncaught Exception in Macro Expecting Native Function to Exist

Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies

Skipper's routesrv-no-auth component: All routesrv API Endpoints Lack Authentication