Pillow — CVE history (PyPI)
Pillow
73 CVEs affect the Pillow PyPI package (highest CVSS 9.8). Latest disclosed: 2026-07-14. Full CVE history sourced from NVD.
Summary
- Package
Pillow(PyPI)- Total CVEs
73- Actively exploited (CISA KEV)
- 0
- Highest CVSS
9.8- Latest disclosed
- 2026-07-14
Recent CVEs (top 20)
| CVE | Severity | CVSS | KEV | Published | Summary |
|---|---|---|---|---|---|
CVE-2026-59200 | High | 7.5 | — | 2026-07-14 | Pillow is a Python imaging library. |
CVE-2026-59197 | High | 8.2 | — | 2026-07-14 | Pillow is a Python imaging library. |
CVE-2026-54058 | — | — | — | 2026-07-14 | Pillow is a Python imaging library. |
CVE-2026-59205 | High | 7.5 | — | 2026-07-14 | Pillow is a Python imaging library. |
CVE-2026-59204 | High | 7.5 | — | 2026-07-14 | Pillow is a Python imaging library. |
CVE-2026-59203 | Medium | 5.3 | — | 2026-07-14 | Pillow is a Python imaging library. |
CVE-2026-59199 | High | 7.5 | — | 2026-07-14 | Pillow is a Python imaging library. |
CVE-2026-59198 | Medium | 6.5 | — | 2026-07-14 | Pillow is a Python imaging library. |
CVE-2026-55798 | Medium | 4.5 | — | 2026-07-06 | Pillow is a Python imaging library. |
CVE-2026-55380 | High | 7.5 | — | 2026-07-06 | Pillow is a Python imaging library. |
CVE-2026-55379 | High | 7.5 | — | 2026-07-06 | Pillow is a Python imaging library. |
CVE-2026-54060 | High | 7.5 | — | 2026-07-06 | Pillow is a Python imaging library. |
CVE-2026-54059 | High | 7.5 | — | 2026-07-06 | Pillow is a Python imaging library. |
CVE-2026-42311 | High | 7.8 | — | 2026-05-09 | Pillow is a Python imaging library. |
CVE-2026-42310 | Medium | 5.5 | — | 2026-05-09 | Pillow is a Python imaging library. |
CVE-2026-42309 | Medium | 5.5 | — | 2026-05-09 | Pillow is a Python imaging library. |
CVE-2026-42308 | Medium | 5.5 | — | 2026-05-09 | Pillow is a Python imaging library. |
CVE-2026-40192 | High | 7.5 | — | 2026-04-15 | Pillow is a Python imaging library. |
CVE-2026-25990 | High | 7.5 | — | 2026-02-11 | Pillow is a Python imaging library. |
CVE-2025-48379 | High | 7.1 | — | 2025-07-01 | Pillow is a Python imaging library. |
All-time worst (top 10 by CVSS)
| CVE | Severity | CVSS | KEV | Published | Summary |
|---|---|---|---|---|---|
CVE-2022-30595 | Critical | 9.8 | — | 2022-05-25 | libImaging/TgaRleDecode.c in Pillow 9.1.0 has a heap buffer overflow in the processing of invalid TGA image files. |
CVE-2022-22817 | Critical | 9.8 | — | 2022-01-10 | PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. |
CVE-2021-34552 | Critical | 9.8 | — | 2021-07-13 | Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c. |
CVE-2021-25289 | Critical | 9.8 | — | 2021-03-19 | An issue was discovered in Pillow before 8.1.1. |
CVE-2020-5312 | Critical | 9.8 | — | 2020-01-03 | libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow. |
CVE-2020-5311 | Critical | 9.8 | — | 2020-01-03 | libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow. |
CVE-2016-4009 | Critical | 9.8 | — | 2016-04-13 | Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote attackers to have unspecified impact via negative values of the new size, which triggers a heap-based buffer overflow. |
CVE-2022-24303 | Critical | 9.1 | — | 2022-03-28 | Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled. |
CVE-2021-25288 | Critical | 9.1 | — | 2021-06-02 | An issue was discovered in Pillow before 8.2.0. |
CVE-2021-25287 | Critical | 9.1 | — | 2021-06-02 | An issue was discovered in Pillow before 8.2.0. |