photovoltaic_systems

Certifi removes GLOBALTRUST root certificate

Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists

urllib3 streaming API improperly handles highly compressed data

PyTorch susceptible to local Denial of Service

Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)

UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps()

Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading

urllib3 does not control redirects in browsers and Node.js

Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path

pip's fallback tar extraction doesn't check symbolic links point to extraction directory

PyTorch: `torch.load` with `weights_only=True` leads to remote code execution

pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files

setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write

Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`

Pillow has a heap buffer overflow with nested list coordinates

Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)

geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclosure

Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix

Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow

pip Path Traversal vulnerability

fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib

Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector Parser

PyTorch Improper Resource Shutdown or Release vulnerability

Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading

Requests vulnerable to .netrc credentials leak via malicious URLs

Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch

Requests `Session` object does not verify requests after making first request with verify=False

UltraJSON has a Memory Leak in ujson.dump() on Write Failure

PyTorch Tuple Handler is Vulnerable to Memory Corruption through Manipulation of None Argument

UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop

Pillow affected by out-of-bounds write when loading PSD images

Jinja2 vulnerable to sandbox breakout through attr filter selecting format method

setuptools vulnerable to Command Injection via package URL

PyTorch is Vulnerable to Memory Consumption through pad_packed_sequence Function

Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images

tqdm CLI arguments injection attack

Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function

urllib3 allows an unbounded number of links in the decompression chain

Jinja has a sandbox breakout through malicious filenames

setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+

Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter

Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()

pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere

urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

Command Injection in pip when used with Mercurial

Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service

Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`

urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation