pillow: Pillow: Denial of Service via infinite loop during crafted MIC image parsing

A flaw was found in Pillow. This vulnerability allows a remote attacker to cause a Denial of Service DoS by supplying a specially crafted Microsoft Image Composer MIC file. When an application attempts to count or extract frames from the malicious image, an improper state reset triggers an infini...

pillow: pillow: Denial of service via crafted APNG image

A flaw was found in Pillow. A remote attacker can trigger a Denial of Service DoS by providing a specially crafted Animated Portable Network Graphics APNG image. Pillow allocates memory for the full canvas dimensions before validating safety size limits during initial file opening. Processing suc...

pillow: pillow: Denial of Service via memory exhaustion from crafted GIF image

A flaw was found in Pillow. When parsing a crafted GIF image, the library fails to discard rejected frame dimensions after encountering an excessively large image exception. If an application catches this exception and continues processing the image, subsequent operations attempt to allocate memo...

pillow: pillow: Denial of service via double free during image transformation

A flaw was found in Pillow. A remote attacker who can submit large image transformation operations under memory pressure can trigger improper error handling, leading to a double-free vulnerability releasing the same memory block twice. This issue can result in an application crash, causing a Deni...

pillow: pillow: Denial of Service via unbounded memory expansion in MSP image decoder

A flaw was found in Pillow. A remote attacker can cause a Denial of Service DoS by supplying a specially crafted Microsoft Paint MSP image file to an application that processes image pixels. Due to missing expansion limits during decompression, the run-length encoding RLE decoder expands image da...

pillow: pillow: Denial of Service via crafted multi-frame image conversion

A flaw was found in Pillow. When converting multi-frame images into a multi-page PDF document, the library repeatedly scans previously assigned object identifiers, resulting in quadratic processing time. A remote attacker could exploit this vulnerability by supplying a crafted image with a large...

CVE-2026-118752

A flaw was found in FreeImage. This vulnerability allows an attacker to achieve arbitrary code execution or cause an application crash leading to a Denial of Service DoS by tricking a user or automated system into processing a specially crafted image file. The issue occurs due to a heap-based...

Critical: Red Hat Security Advisory: satellite/foreman-mcp-server-rhel9 container image available as a Technology Preview

A new satellite/foreman-mcp-server-rhel9 container image is now available as a Technology Preview in the Red Hat container registry. Satellite provides a container image that you can use to run an MCP server locally. The MCP server for Satellite is designed for advanced reporting and data analysi...

Critical: Red Hat Security Advisory: satellite/foreman-mcp-server-rhel9 container image available as a Technology Preview

A new satellite/foreman-mcp-server-rhel9 container image is now available as a Technology Preview in the Red Hat container registry. Satellite provides a container image that you can use to run an MCP server locally. The MCP server for Satellite is designed for advanced reporting and data analysi...

resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS)

A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very larg...

Important: Red Hat Security Advisory: Technical preview of the satellite/iop-vmaas-rhel9 container image

A new satellite/iop-vmaas-rhel9 container image is now available as a technical preview in the Red Hat container registry. Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running...

Important: Red Hat Security Advisory: Technical preview of the satellite/iop-vmaas-rhel9 container image

A new satellite/iop-vmaas-rhel9 container image is now available as a technical preview in the Red Hat container registry. Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running...

CVE-2022-25275

In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the image styles system. Access to a non-public file is checked only if it is stored in the "private" file system. However,...

CVE-2026-113695

Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to inject script content into HTML responses viewed by another user...

CVE-2026-113695 Reflected Cross-Site Scripting in BMC ITSM SmartIT

Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to inject script content into HTML responses viewed by another user...

CVE-2026-113695 Reflected Cross-Site Scripting in BMC ITSM SmartIT

Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to inject script content into HTML responses viewed by another user...

CVE-2026-113695

Reflected cross-site scripting (XSS) exists in the SmartIT inline-image attachment feature of the BMC IT Service Management Suite (versions 25.3.01, 25.4.01, and 26.1.01). This vulnerability allows authenticated users to inject malicious script content into HTML responses viewed by other users. N...

EUVD-2026-112827

Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to inject script content into HTML responses viewed by another user...

CVE-2026-117555

A flaw was found in cimg. An integer overflow vulnerability in the BMP image loader when calculating row dimensions can trigger an out-of-bounds memory read. An attacker can exploit this flaw by supplying a specially crafted BMP image file to an application using the library, potentially causing ...

VLLM DeepSeek-OCR Image Processing Vulnerable To Denial Of Service

Summary Any vLLM deployment serving a model of the DeepSeek-OCR family — "deepseek-ai/DeepSeek-OCR", "deepseek-ai/DeepSeek-OCR-2", or "baidu/Unlimited-OCR" whose "UnlimitedOCRForCausalLM" subclasses "DeepseekOCRForCausalLM" — can be killed by a single unauthenticated chat request carrying an...