sprache2text+meer - Transkription für Jugendamt Verwaltung

Pillow: Infinite loop in MIC n_frames when the embedded TIFF

Certifi removes GLOBALTRUST root certificate

Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode

Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()

Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images

fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

HuggingFace transformers vulnerable to remote code execution

Werkzeug safe_join() allows Windows special device names

Starlette has possible denial-of-service vector when parsing large files in multipart forms

aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence

Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain

aiohttp: Multiple instances of excessive or unbounded memory/CPU use

Mako vulnerable to path traversal via backslash URI on Windows in TemplateLookup

AIOHTTP has CRLF injection through multipart part content type header construction

urllib3 streaming API improperly handles highly compressed data

Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO

PyTorch susceptible to local Denial of Service

Transformers is vulnerable to ReDoS attack through its DonutProcessor class

Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)

Pillow: TarIO negative size field causes infinite CPU-spin loop

AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS

Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size

Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading

Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)

urllib3 does not control redirects in browsers and Node.js

AIOHTTP: Secure attribute not enforced for shared cookie

aiohttp: HTTP/1 Pipelined Requests Queue Without Limit

Accelerate path traversal and denial of service via sharded checkpoint weight_map entries

aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections

Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise

Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer

Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer

Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path

pip's fallback tar extraction doesn't check symbolic links point to extraction directory

Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching

PyTorch: `torch.load` with `weights_only=True` leads to remote code execution

AIOHTTP vulnerable to brute-force leak of internal static file path components

Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction

Mako: Path traversal via drive-letter URI on Windows in TemplateLookup

filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break

pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files

Pillow: Out-of-bounds access in _imagingmorph on a zero-width image

Denial of service (DoS) via deformation `multipart/form-data` boundary

Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer

AnyIO process-pool workers can block indefinitely on undrained stderr

setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write

python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service

python-socketio: Binary attachment accumulation can cause denial of service