gimp: GIMP: Remote code execution via TIF file parsing heap-based buffer overflow

A flaw was found in GIMP. This heap-based buffer overflow vulnerability in the TIF file parsing component allows a remote attacker to execute arbitrary code. User interaction is required, as the target must open a specially crafted malicious TIF file. Successful exploitation can lead to arbitrary...

gimp: GIMP: Arbitrary code execution in PSD plugin due to unsigned underflow

A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the blockrem variable, occurs when a user opens a specially crafted .psd image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource...

gimp: gimp: out-of-bounds write in GIMPressionist plugin via crafted preset file

A flaw was found in GIMP. When processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indices before writing into fixed-size arrays. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to...

gimp: gimp: Heap buffer overflow in read_channel_data()

A flaw was found in GIMP's Paint Shop Pro PSP file format parser. This heap buffer overflow vulnerability allows a remote attacker to cause arbitrary code execution or a denial of service DoS by tricking a user into opening a specially crafted PSP image file. The vulnerability occurs because the...

gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file

A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light sources. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to open a malicio...

gimp: gimp: Stack buffer overflow in pnmscanner_gettoken()

A flaw was found in GIMP's PNM file format parser. When parsing a specially crafted PNM file, the pnmscannergettoken function writes a null terminator one byte past the end of a stack-allocated buffer due to an off-by-one error in the loop boundary check. This could lead to memory corruption,...

gimp: GIMP: Remote code execution via TIF file parsing vulnerability

A flaw was found in GIMP. This vulnerability, a stack-based buffer overflow in the TIF file parsing component, allows a remote attacker to execute arbitrary code. User interaction is required, as the target must open a specially crafted malicious TIF file. The issue stems from insufficient...

gimp: GIMP: Remote code execution via PSD file parsing integer overflow

A flaw was found in GIMP. A remote attacker could exploit an integer overflow vulnerability within the readchanneldata function during PSD Photoshop Document file parsing by enticing a user to open a specially crafted PSD file. This could lead to arbitrary code execution in the context of the...

perl-HTTP-Daemon: HTTP::Daemon: Arbitrary code execution via OS command injection in send_file()

A flaw was found in HTTP::Daemon, a Perl module used for creating HTTP servers. A remote attacker can exploit this vulnerability by providing specially crafted input to the sendfile function, leading to OS command injection. This allows the attacker to execute arbitrary commands on the system wit...

Important: Red Hat Security Advisory: perl-HTTP-Daemon security update

An update for perl-HTTP-Daemon is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Important: Red Hat Security Advisory: perl-HTTP-Daemon security update

An update for perl-HTTP-Daemon is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2026-57203

A flaw was found in Asterisk. The astloggrabber utility executes a script directly from the shared, world-writable temporary directory /tmp. A local attacker with shell access can place a malicious script in this location to achieve privilege escalation and execute arbitrary code when an...

CVE-2026-18199

Zohocorp ManageEngine Password Manager Pro versions before 13236 and PAM360 versions before 8601 are vulnerable to an authenticated Remote Code Execution vulnerability...

CVE-2026-57200

A flaw was found in Asterisk. This vulnerability allows an authenticated remote attacker with read-only permissions to achieve arbitrary code execution by bypassing authorization controls. Under conditions where the HTTP service is enabled and accessible, an attacker can submit unauthorized write...

CVE-2026-57198

A flaw was found in Asterisk. In deployments where the chansip channel driver has text support enabled, an authenticated attacker can send specially crafted network packets to trigger a heap-based buffer overflow in the T.140 Redundant Data RED handling mechanism. This vulnerability could allow t...

CVE-2026-57197

A flaw was found in Asterisk. A heap buffer overflow in the formatoggspeex module allows an attacker to cause a Denial of Service DoS or potentially achieve arbitrary code execution. This issue occurs when Asterisk reads a corrupted Speex audio file, triggering an unbounded memory copy operation...

CVE-2026-57189

A flaw was found in Asterisk. In configurations where the chansip channel driver has text support enabled, an authenticated remote attacker can send specially crafted packets during real-time text processing to trigger an out-of-bounds memory write. This vulnerability may allow the attacker to...

EUVD-2026-115106

Zohocorp ManageEngine Password Manager Pro versions before 13236 and PAM360 versions before 8601 are vulnerable to an authenticated Remote Code Execution vulnerability...

CVE-2026-18199

Zohocorp ManageEngine Password Manager Pro (versions before 13236 ) and PAM360 (versions before 8601 ) are vulnerable to an authenticated Remote Code Execution (RCE) vulnerability. The underlying cause is identified as CWE-78 , which involves the improper neutralization of special elements used i...

CVE-2026-18199 Remote Code Execution Vulnerability

Zohocorp ManageEngine Password Manager Pro versions before 13236 and PAM360 versions before 8601 are vulnerable to an authenticated Remote Code Execution vulnerability...