[{"data":1,"prerenderedAt":58},["ShallowReactive",2],{"sicherheitsluecke-cve-2026-112900":3},{"l":4,"details":28,"weitere":36,"indexierbar":56,"updated":57},{"cve":5,"status":6,"vendor":7,"product":8,"name":9,"added":10,"due":9,"ransomware":11,"published":10,"cwes":12,"cvss":15,"epss":20,"slug":23,"bereich":24,"schweregrad":25,"art":26,"produktLabel":27},"CVE-2026-112900","gemeldet","Python","Pillow","","2026-10-19",false,[13,14],"CWE-78","CWE-88",{"version":16,"score":17,"severity":18,"vector":19},"4.0",9.2,"CRITICAL","CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",{"score":21,"percentile":22},0.01303,0.70743,"cve-2026-112900","dev","kritisch","Einschleusen von Betriebssystem-Befehlen (OS Command Injection)","Python Pillow",{"description":29,"refs":30},"Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name beginning with a hyphen can be interpreted as a Ghostscript option. An attacker who controls the filename can inject Ghostscript arguments. Arbitrary command execution specifically requires a leading @ argument-file filename and control of the referenced text file containing additional Ghostscript arguments; the reported chain reproduces with the default -dSAFER invocation. This issue is fixed in version 13.0.0.",[31,34],{"url":32,"host":33},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fa2c363141da31a265dd536c945677db4b64f3ec9","github.com",{"url":35,"host":33},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-w889-685w-c8fh",[37,45,51],{"cve":38,"status":6,"produktLabel":39,"vendor":40,"product":41,"art":42,"bereich":24,"schweregrad":25,"score":43,"epss":-1,"added":44,"ransomware":11},"CVE-2026-120779","Microsoft Visual Studio Code","Microsoft","Visual Studio Code","Einschleusen von Programmcode (Code Injection)",9.6,"2026-11-10",{"cve":46,"status":6,"produktLabel":47,"vendor":9,"product":47,"art":48,"bereich":24,"schweregrad":25,"score":49,"epss":50,"added":44,"ransomware":11},"CVE-2026-125370","Kubero","Fest eingebauter Schlüssel für die Verschlüsselung",9.3,0.00683,{"cve":52,"status":6,"produktLabel":53,"vendor":9,"product":53,"art":54,"bereich":24,"schweregrad":25,"score":55,"epss":-1,"added":44,"ransomware":11},"CVE-2026-125758","Aptabase","Unsichere Standardeinstellung",9.1,true,"2026-11-11T14:28:43.107Z",1794407353797]