CVE-2025-57810

jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.2, user control of the first argument of the addImage method results in CPU utilization and denial of service. If given the possibility to pass unsanitized image data or URLs to the addImage method, a user can provide a harmful PNG...

CVE-2025-57810 jsPDF Parsing of Corrupt PNGs Leads to Potential Denial of Service (DoS)

jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.2, user control of the first argument of the addImage method results in CPU utilization and denial of service. If given the possibility to pass unsanitized image data or URLs to the addImage method, a user can provide a harmful PNG...

Linux Distros Unpatched Vulnerability : CVE-2020-35531

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In LibRaw, an out-of-bounds read vulnerability exists within the gethuffmandiff function libraw\src\x3f\x3futilspatched.cpp when reading data from an image file...

OSV-2025-627 Null-dereference READ in ProcessRows

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=438295348 Crash type: Null-dereference READ Crash state: ProcessRows DecodeImageData VP8LDecodeImage...

Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

Overview Magick.NET-Q16-HDRI-OpenMP-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this...

Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

Overview Magick.NET-Q16-OpenMP-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package...

Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

Overview Magick.NET-Q16-AnyCPU is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

Overview Magick.NET-Q16-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

Overview Magick.NET-Q16-x86 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

CVE-2025-21464

Information disclosure while reading data from an image using specified offset and size parameters...

Linux Distros Unpatched Vulnerability : CVE-2024-5693

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Offscreen Canvas did not properly track cross-origin tainting, which could be used to access image data from another site in violation of same-origin policy. Th...

CVE-2025-21464

Information disclosure while reading data from an image using specified offset and size parameters...

CVE-2025-21464 Out-of-bounds Read in Core

Information disclosure while reading data from an image using specified offset and size parameters...

CVE-2025-21464

CVE-2025-21464 is documented in multiple sources as an information-disclosure (out-of-bounds read) issue affecting Qualcomm closed-source components, with the core vulnerability described as an information disclosure when reading data from an image using a specified offset and size. The CVE is li...

Heap Based Buffer Overflow

Pillow is vulnerable to heap-based buffer overflow.. The vulnerability is due to writing into a buffer without checking for available space when saving a large 64k image in DDS format, which allows an attacker to trigger a heap buffer overflow by tricking the application into processing malicious...

Heap Buffer Overflow

electron is vulnerable to Heap buffer overflow. The vulnerability is due to improper handling of image data in the nativeImage.createFromPath and nativeImage.createFromBuffer functions, which allows an attacker by supplying crafted image data with controlled height, width, and contents...

Rectifying Privacy and Efficacy Measurements in Machine Unlearning: a New Inference Attack Perspective

Machine unlearning focuses on efficiently removing specific data from trained models, addressing privacy and compliance concerns with reasonable costs. Although exact unlearning ensures complete data removal equivalent to retraining, it is impractical for large-scale models, leading to growing...

CLSA-2025-1748629211 java-11-openjdk: Fix of 3 CVEs

Upgrade to openjdk-11.0.27+6 GA. The following CVEs were fixed: - CVE-2025-21587: fix TLS connection support to avoid unauthorized access to critical data - CVE-2025-30698: fix buffered image handling to avoid unauthorized access to accessible data - CVE-2025-30691: improve compiler...

CVE-2024-5737

Script afGdStream.php in AdmirorFrames Joomla! extension doesn’t specify a content type and as a result default text/html is used. An attacker may embed HTML tags directly in image data which is rendered by a webpage as HTML. This issue affects AdmirorFrames: before 5.0...

CVE-2023-21239

In visitUris of Notification.java, there is a possible way to leak image data across user boundaries due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...