python-pillow Pillow

• CVE-2026-54060 High 7.5 Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()` 0.4%
• CVE-2026-54059 High 7.5 Pillow: PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading 0.4%
• CVE-2026-55798 Medium 4.5 Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path 0.2%
• CVE-2026-42311 High 8.6 Pillow: OOB Write with Invalid PSD Tile Extents (Integer Overflow) 0.1%
• CVE-2026-42310 Medium 5.1 Pillow: PDF Parsing Trailer Infinite Loop (DoS) 0.2%
• CVE-2026-42308 Medium 5.1 Pillow: Integer overflow when processing fonts 0.1%
• CVE-2026-42309 Medium 5.1 Pillow: Heap buffer overflow with nested list coordinates 0.1%
• CVE-2026-40192 High 7.5 Pillow is vulnerable to a FITS GZIP decompression bomb 0.7%
• CVE-2026-25990 High 7.3 Pillow has an out-of-bounds write when loading PSD images 0.4%
• CVE-2025-48379 High 7.1 Pillow Vulnerable to Write Buffer Overflow on BCn encoding 0.3%