URBAN.KI SmartEnergie

Pillow: Infinite loop in MIC n_frames when the embedded TIFF

pypdf: Possible long runtimes/large memory usage when retrieving outlines

pypdf: Possible long runtimes for zero-only width values in cross-reference streamsuntimes for zero-only width values in cross-reference streams

Certifi removes GLOBALTRUST root certificate

Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode

Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()

Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images

fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

HuggingFace transformers vulnerable to remote code execution

Starlette has possible denial-of-service vector when parsing large files in multipart forms

aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence

Chainlit contain a server-side request forgery (SSRF) vulnerability

aiohttp: Multiple instances of excessive or unbounded memory/CPU use

PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)

NLTK network URL validation permits SSRF to RFC 6598 shared-address-space hosts

pypdf has possible Infinite Loop when processing outlines/bookmarks

pypdf has a possible infinite loop when loading circular /Prev entries in cross-reference streams

AIOHTTP has CRLF injection through multipart part content type header construction

Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists

urllib3 streaming API improperly handles highly compressed data

Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO

Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

PyTorch susceptible to local Denial of Service

Transformers is vulnerable to ReDoS attack through its DonutProcessor class

Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)

Black: Arbitrary file writes from unsanitized user input in cache file name

virtualenv: Xonsh activation literals depend on the script decoding codec

pypdf: Possible infinite loop when hitting EOF in standard xref table

Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)

pypdf: Manipulated XMP metadata entity declarations can exhaust RAM

NLTK: Corpus Reader Sandbox Bypass

NLTK: SSRF Fail-Open in validate_network_url() via DNS Resolution Failure

NLTK: Symlink-based arbitrary file read in IPIPANCorpusReader, bypasses nltk.pathsec entirely

Tornado: Unbounded query-string argument count allows event-loop-stalling DoS

Pillow: TarIO negative size field causes infinite CPU-spin loop

AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS

Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient

Marshmallow has DoS in Schema.load(many)

pypdf has possible long runtimes when retrieving page labels

PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)

virtualenv: Deletion recovery can change a symlink target's mode

Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size

Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading

Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)

NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite

urllib3 does not control redirects in browsers and Node.js

AIOHTTP: Secure attribute not enforced for shared cookie

virtualenv: Downloaded wheel selection and caching precede verification