PT-2025-53091

Name of the Vulnerable Software and Affected Versions pixelgrade Category Icon versions through 1.0.2 Description The software contains a flaw related to improper input handling during web page generation, which allows for Stored Cross-site Scripting XSS. This means that malicious scripts can be...

PT-2026-5438

Name of the Vulnerable Software and Affected Versions GIMP affected versions not specified Description A flaw exists in the parsing of ICO files, potentially allowing remote attackers to execute arbitrary code. User interaction is required, such as visiting a malicious page or opening a malicious...

CVE-2025-68525: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in pixelgrade Category Icon category-icon allows Stored XSS.This issue affects Category Icon: from n/a through = 1.0.2...

Mozilla Firefox < 10.0

The version of Firefox installed on the remote Windows host is prior to 10.0. It is, therefore, affected by a vulnerability as referenced in the mfsa2012-06 advisory. - Mozilla Firefox 4.x through 9.0, Thunderbird 5.0 through 9.0, and SeaMonkey before 2.7 do not properly initialize data for...

Mozilla Firefox < 10.0

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 10.0. It is, therefore, affected by a vulnerability as referenced in the mfsa2012-06 advisory. - Mozilla Firefox 4.x through 9.0, Thunderbird 5.0 through 9.0, and SeaMonkey before 2.7 do not properly initialize data...

Mozilla Thunderbird < 10.0

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 10.0. It is, therefore, affected by a vulnerability as referenced in the mfsa2012-06 advisory. - Mozilla Firefox 4.x through 9.0, Thunderbird 5.0 through 9.0, and SeaMonkey before 2.7 do not properly initialize...

ROS-20251216-7349

A vulnerability in the Gimp image processing library is related to writing beyond buffer boundaries. Exploitation of the vulnerability could allow an attacker to execute arbitrary code by loading a specially crafted ICNS file...

CVE-2025-66450 LibreChat JSON Injection in Chat POST Allows Remote Resource Inclusion and PXSS via Image Upload

LibreChat is a ChatGPT clone with additional features. In versions 0.8.0 and below, when a user posts a question, the iconURL parameter of the POST request can be modified by an attacker. The malicious code is then stored in the chat which can then be shared to other users. When sharing chats wit...

CVE-2025-66450 LibreChat JSON Injection in Chat POST Allows Remote Resource Inclusion and PXSS via Image Upload

LibreChat is a ChatGPT clone with additional features. In versions 0.8.0 and below, when a user posts a question, the iconURL parameter of the POST request can be modified by an attacker. The malicious code is then stored in the chat which can then be shared to other users. When sharing chats wit...

LibreChat 安全漏洞

LibreChat is an enhanced ChatGPT clone by Danny Avila Personal Developer. A security vulnerability exists in LibreChat 0.8.0 and prior versions, which stems from the iconURL parameter can be modified, potentially leading to a stored cross-site scripting attack and privacy disclosure...

io.jenkins.plugins:csp (>=2.57.va_b_326b_54f1ee, <=2.58.v31cd65258cb_2), io.jenkins.plugins:custom-folder-icon (>=2.22, <=2.938.vb_42c40c33ea_5) +10 more potentially affected by CVE-2025-67636 via org.jenkins-ci.main:jenkins-core (>=2.529, <=2.540)

org.jenkins-ci.main:jenkins-core MAVEN version =2.529, =2.57.vab326b54f1ee, =2.22, =255.v3a5dec1abe28, =0.119.v479294b419a7, =664.v998752b00adc, =2.529, =1398.v67030756d3fb, =1925.v62fb7ffb08ce, =212.210.v6a4ffe269ef8, =1372.vfeaf21efab26, =4.626.ve5ad9f26c051, =4.731.v4932b506e767 -...

CVE-2025-48628

In validateIconUserBoundary of PrintManagerService.java, there is a possible cross-user image leak due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2025-201741

In validateIconUserBoundary of PrintManagerService.java, there is a possible cross-user image leak due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2025-201330

Malicious code in react-icon-updater npm...

MAL-2025-192311 Malicious code in react-icon-updater (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 755e55af72b70c14edf83bdaea2cbd76dff5c7ab6410f9e3f44f7b521e7248b3 The package react-icon-updater was found to contain malicious code. Source: ghsa-malware...

Malicious code in react-icon-updater (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 755e55af72b70c14edf83bdaea2cbd76dff5c7ab6410f9e3f44f7b521e7248b3 The package react-icon-updater was found to contain malicious code. Source: ghsa-malware...

ASB-A-376462130

In validateIconUserBoundary of PrintManagerService.java, there is a possible cross-user image leak due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

RLSA-2025:21968 Important: gimp security update

The GIMP GNU Image Manipulation Program is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo. Security Fixes: gimp: GIMP DCM...

WordPress Icon List Block plugin server-side request forgery vulnerability

WordPress Icon List Block plugin is a plugin designed for WordPress to insert custom icon lists in the block editor Gutenberg. The WordPress Icon List Block plugin suffers from a server-side request forgery vulnerability that stems from the fsapirequest function failing to implement an adequate...

CVE-2025-12376

The Icon List Block – Add Icon-Based Lists with Custom Styles plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2.1 via the fsapirequest function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...