CVE-2026-118753

A flaw was found in FreeImage. By convincing a user or system to process a specially crafted GIF file with frame boundaries exceeding the logical screen width, an attacker can trigger a heap-based buffer overflow during image compositing. This flaw can corrupt heap memory, potentially leading to...

CVE-2026-114523 Ffmpeg Image Toolkit - Highly critical - Remote Code Execution - SA-CONTRIB-2026-220

Improper Neutralization of Special Elements used in an OS Command "OS Command Injection" vulnerability in Drupal Ffmpeg Image Toolkit allows OS Command Injection. This issue affects Ffmpeg Image Toolkit versions: from 0.0.0 to 1.0.3...

EUVD-2026-113552

Improper Neutralization of Special Elements used in an OS Command "OS Command Injection" vulnerability in Drupal Ffmpeg Image Toolkit allows OS Command Injection. This issue affects Ffmpeg Image Toolkit versions: from 0.0.0 to 1.0.3...

CVE-2026-114523

Improper Neutralization of Special Elements used in an OS Command "OS Command Injection" vulnerability in Drupal Ffmpeg Image Toolkit allows OS Command Injection. This issue affects Ffmpeg Image Toolkit versions: from 0.0.0 to 1.0.3...

CVE-2026-114523 Ffmpeg Image Toolkit - Highly critical - Remote Code Execution - SA-CONTRIB-2026-220

Improper Neutralization of Special Elements used in an OS Command "OS Command Injection" vulnerability in Drupal Ffmpeg Image Toolkit allows OS Command Injection. This issue affects Ffmpeg Image Toolkit versions: from 0.0.0 to 1.0.3...

CVE-2026-114523

The Drupal Ffmpeg Image Toolkit module (versions 0.0.0 to 1.0.3 ) is vulnerable to OS Command Injection (CWE-78). The root cause is the module's failure to sufficiently sanitize file names passed to the ffmpeg cli tool . This allows an attacker to execute arbitrary commands on the system, though ...

CVE-2026-118475

A flaw was found in Eye of GNOME. When parsing a specially crafted PNG image containing malformed color profile metadata, the application fails to validate chunk boundaries while searching for a null terminator. An attacker could trick a user into opening a malicious image, causing the applicatio...

CVE-2026-118475

A flaw was found in Eye of GNOME. When parsing a specially crafted PNG image containing malformed color profile metadata, the application fails to validate chunk boundaries while searching for a null terminator. An attacker could trick a user into opening a malicious image, causing the applicatio...

PT-2026-133739

Quest Bot is an opensource Discord Bot. Prior to 1.1.9, the image to GIF command uses a request helper that validates a hostname's public IP addresses but then sends the actual request by hostname, causing a second DNS lookup. An attacker controlling a domain can return a public address during...

PT-2026-133621

Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out of bounds, causing...

CVE-2026-104062: Scribus: Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the PICT image loader and…

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the PICT image loader and import plugin that allows attackers to corrupt heap memory by supplying an unchecked bytesPerLine value. Attackers can craft a PICT file whose bytesPerLine exceeds the QImage...

Linux Distros Unpatched Vulnerability : CVE-2026-118475

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Eye of GNOME. When parsing a specially crafted PNG image containing malformed color profile metadata, the application fails to validate chun...

RHEL 8 : python-pillow (RHSA-2026:92639)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92639 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

PT-2026-134444

Name of the Vulnerable Software and Affected Versions Photo Reviews for WooCommerce versions prior to 1.2.32 Description Unauthenticated attackers can permanently delete any WordPress media library attachment, including files on disk, by exploiting a flaw in the delete reviews image function. The...

python-pillow security update

5.1.1-33 - CVE-2026-112892 python-pillow: pillow: Denial of Service via unbounded memory expansion in MSP image decoder Resolves: RHEL-290437 5.1.1-32 - CVE-2026-96640 python-pillow: pillow: Denial of Service via duplicate page references in PDF files Resolves: RHEL-289281 5.1.1-31 -...

PT-2026-133257

A flaw was found in Eye of GNOME. When parsing a specially crafted PNG image containing malformed color profile metadata, the application fails to validate chunk boundaries while searching for a null terminator. An attacker could trick a user into opening a malicious image, causing the applicatio...

CVE-2026-61840: vantern-org questbot: Quest Bot is an opensource Discord Bot

Quest Bot is an opensource Discord Bot. Prior to 1.1.9, the image to GIF command uses a request helper that validates a hostname's public IP addresses but then sends the actual request by hostname, causing a second DNS lookup. An attacker controlling a domain can return a public address during...

CVE-2026-62990: shopperlabs shopper: Shopper is a Headless e-commerce Admin Panel

Shopper is a Headless e-commerce Admin Panel. In versions from 2.0.0 prior to 2.10.1 and in the 3.0.0 prereleases beta.1 and beta.2, authenticated back-office staff with a content-upload permission can store executable media on the administrator's own origin. In the 2.x implementation, relevant...

UBUNTU-CVE-2026-118475

A flaw was found in Eye of GNOME. When parsing a specially crafted PNG image containing malformed color profile metadata, the application fails to validate chunk boundaries while searching for a null terminator. An attacker could trick a user into opening a malicious image, causing the applicatio...

Oracle Linux 8 : python-pillow (ELSA-2026-92639)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-92639 advisory. - CVE-2026-112892 python-pillow: pillow: Denial of Service via unbounded memory expansion in MSP image decoder Resolves: RHEL-290437 - CVE-2026-96640...