48 matches found
CVE-2026-53502
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, fileloader decodes percent-encoded path segments after its root-boundary validation, allowing traversal outside FILELOADERROOTPATH through watermark or frame filter input. This issue is fixed in 7.8.0...
UBUNTU-CVE-2026-53502
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, fileloader decodes percent-encoded path segments after its root-boundary validation, allowing traversal outside FILELOADERROOTPATH through watermark or frame filter input. This issue is fixed in 7.8.0...
CVE-2026-53502 Thumbor has path traversal via post-validation URL decoding bypass in file_loader
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, fileloader decodes percent-encoded path segments after its root-boundary validation, allowing traversal outside FILELOADERROOTPATH through watermark or frame filter input. This issue is fixed in 7.8.0...
Division by zero
Overview thumbor is a thumbor is an open-source photo thumbnail service by globo.com Affected versions of this package are vulnerable to Division by zero via the convolution filter process in the C extension when user-controlled input is used as a divisor without validation. An attacker can cause...
CVE-2026-53503 Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:convolution, , filter passes the user-controlled value to a C extension thumbor/ext/filters/convolution.c where it is used as a divisor for % and / without validating columns 0. When columns=0, the C...
CVE-2026-53503 Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:convolution, , filter passes the user-controlled value to a C extension thumbor/ext/filters/convolution.c where it is used as a divisor for % and / without validating columns 0. When columns=0, the C...
Improper Verification of Cryptographic Signature
Overview thumbor is a thumbor is an open-source photo thumbnail service by globo.com Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the URL signature removal process. An attacker can manipulate the validated URL and bypass intended access...
CVE-2026-53500
Thumbor (open-source image service by globo.com) is affected prior to version 7.8.0 where ALLOWED_SOURCES is applied by re.match() to unescaped strings, enabling a hostname with dot-position differences to bypass the allowlist. Root cause: unescaped patterns treated as normal strings in a regex m...
CVE-2026-53500 Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWEDSOURCES configuration passes plain strings to re.match without escaping dots, so a hostname differing at dot positions can match the allowlist. This issue is fixed in 7.8.0...
PT-2026-66842
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:proportion filter does not enforce an upper bound on and runs in the post-transform phase. An attacker can trigger extremely large resizes CPU/memory exhaustion and cause denial of service. This issu...
PT-2026-66840
Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:convolution, , filter passes the user-controlled value to a C extension thumbor/ext/filters/ convolution.c where it is used as a divisor for % and / without validating columns 0. When columns=0, the ...
WordPress miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin < 7.8.0 - Unauthenticated Account Takeover vulnerability
Unauthenticated Account Takeover vulnerability discovered by Lyris Vale in WordPress Plugin WordPress Social Login and Register versions 7.8.0...
CVE-2026-65561: Improper Neutralization of Input During Web Page Generation
Contributor Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.0 versions...
PT-2026-64953
Contributor Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.0 versions...
📄 WordPress Hustle 7.8.4 Credential Disclosure Scanner
WordPress Hustle plugin credential disclosure security scanner that detects the installed plugin version, verifies whether it falls within known vulnerable releases 7.8.0–7.8.3, and scans for sensitive files containing hardcoded HubSpot credentials. The tool also fetches the latest official plugi...
OpenSMTPD 7.7.0 DoS Vulnerability
OpenSMTPD is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:openbsd:opensmtpd";...
EUVD-2022-2331
Malicious code in bioql PyPI...
EUVD-2023-51356
Malicious code in bioql PyPI...