62774 matches found
CVE-2026-118475
A flaw was found in Eye of GNOME. When parsing a specially crafted PNG image containing malformed color profile metadata, the application fails to validate chunk boundaries while searching for a null terminator. An attacker could trick a user into opening a malicious image, causing the applicatio...
base-drupal
BASE-DRUPAL This is part of Cved: a tool to manage vulnerable docker containers. Cved: https://github.com/git-rep-src/cved Image source: https://github.com/cved-sources/base-drupal Image based on: https://github.com/Medicean/VulApps/tree/master/base/drupal/8.3.0...
CVE-2026-61840
Quest Bot is an opensource Discord Bot. Prior to 1.1.9, the image to GIF command uses a request helper that validates a hostname's public IP addresses but then sends the actual request by hostname, causing a second DNS lookup. An attacker controlling a domain can return a public address during...
cve-2018-17207
CVE-2018-17207 This is part of Cved: a tool to manage vulnerable docker containers. Cved: https://github.com/git-rep-src/cved Image source: https://github.com/cved-sources/cve-2018-17207 Image author: https://github.com/cved-sources/cve-2018-17207...
WordPress Perfect Images: Regenerate Thumbnails, Image Sizes, WebP & AVIF plugin <= 7.2.0 - Missing Authorization to Authenticated (Author+) Image Replacement vulnerability
Missing Authorization to Authenticated Author+ Image Replacement vulnerability discovered by Lucas Montes NiRoX in WordPress Plugin Perfect Images versions = 7.2.0...
CVE-2026-104063
A flaw was found in Scribus. When decoding planar pixel data in the Mac PICT image loader, the application does not properly validate image dimensions, leading to an out-of-bounds read vulnerability. By convincing a user to import or open a specially crafted PICT file, an attacker can trigger an...
CVE-2026-79551-Tenda
CVE-2026-79551 Tenda Hardcoded TLS Private Key CNVD ID: CNVD-2026-25884 Vendor: Tenda Technology Co., Ltd. Product: NVR4H network video recorder hardware version CH3V2.1 Firmware: V27.5.58.6 Class: CWE-321 — Use of Hard-coded Cryptographic Key Overview The NVR4H firmware stores an ECDSA key pair ...
CVE-2026-61840
The Quest Bot Discord bot (prior to version 1.1.9 ) is vulnerable to a Server-Side Request Forgery (SSRF) flaw in the image to GIF command. The root cause is a DNS rebinding vulnerability where the request helper validates a hostname's public IP but performs a second DNS lookup for the actual req...
EUVD-2026-114279
Quest Bot is an opensource Discord Bot. Prior to 1.1.9, the image to GIF command uses a request helper that validates a hostname's public IP addresses but then sends the actual request by hostname, causing a second DNS lookup. An attacker controlling a domain can return a public address during...
CVE-2026-61840 Quest Bot: Server Side Request Forgery in the Image to GIF Feature Lets Any Server Member Reach Internal Services
Quest Bot is an opensource Discord Bot. Prior to 1.1.9, the image to GIF command uses a request helper that validates a hostname's public IP addresses but then sends the actual request by hostname, causing a second DNS lookup. An attacker controlling a domain can return a public address during...
CVE-2026-61840 Quest Bot: Server Side Request Forgery in the Image to GIF Feature Lets Any Server Member Reach Internal Services
Quest Bot is an opensource Discord Bot. Prior to 1.1.9, the image to GIF command uses a request helper that validates a hostname's public IP addresses but then sends the actual request by hostname, causing a second DNS lookup. An attacker controlling a domain can return a public address during...
WP_CROP_RCE
WordPress Image CROP RCE Analysis Report POC & Dockerfile : https://github.com/synod2/WPCROPRCE This document covers CVE-2019-8942 and CVE-2019-8943, known as WordPress Image CROP RCE, which are vulnerabilities found in WordPress versions prior to 4.9.9 and 5.0.1. CVE Number| Disclosure Date|...
CVE-2026-104062
A flaw was found in Scribus. This flaw allows an attacker to achieve arbitrary code execution or cause a denial of service DoS by convincing a user to open or import a specially crafted PICT image file. The issue occurs due to improper boundary checks in the PICT image loader and import plugin,...
cve-2017-1000486
CVE-2017-1000486 This is part of Cved: a tool to manage vulnerable docker containers. Cved: https://github.com/git-rep-src/cved Image source: https://github.com/cved-sources/cve-2017-1000486 Image author: https://github.com/pimps/CVE-2017-1000486...
cve-2016-6515
CVE-2016-6515 This is part of Cved: a tool to manage vulnerable docker containers. Cved: https://github.com/git-rep-src/cved Image source: https://github.com/cved-sources/cve-2016-6515 Image author: https://github.com/opsxcq/exploit-CVE-2016-6515...
DEBIAN-CVE-2026-104066
Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out...
CVE-2026-104066
Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out...
DEBIAN-CVE-2026-104063
Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds read vulnerability in the Mac PICT image loader and import plugin when decoding planar pixel data. Attackers can supply a crafted PICT file with manipulated dimensions that, when placed or imported, causes heap over-reads leadi...
DEBIAN-CVE-2026-104062
Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the PICT image loader and import plugin that allows attackers to corrupt heap memory by supplying an unchecked bytesPerLine value. Attackers can craft a PICT file whose bytesPerLine exceeds the QImage...
CVE-2026-104062
Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the PICT image loader and import plugin that allows attackers to corrupt heap memory by supplying an unchecked bytesPerLine value. Attackers can craft a PICT file whose bytesPerLine exceeds the QImage...