EUVD-2026-112827

Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to inject script content into HTML responses viewed by another user...

CVE-2026-117555

A flaw was found in cimg. An integer overflow vulnerability in the BMP image loader when calculating row dimensions can trigger an out-of-bounds memory read. An attacker can exploit this flaw by supplying a specially crafted BMP image file to an application using the library, potentially causing ...

VLLM DeepSeek-OCR Image Processing Vulnerable To Denial Of Service

Summary Any vLLM deployment serving a model of the DeepSeek-OCR family — "deepseek-ai/DeepSeek-OCR", "deepseek-ai/DeepSeek-OCR-2", or "baidu/Unlimited-OCR" whose "UnlimitedOCRForCausalLM" subclasses "DeepseekOCRForCausalLM" — can be killed by a single unauthenticated chat request carrying an...

CVE-2026-16889

In openEQUELLA before 2026.1, the pre-login notice image upload endpoint PUT /api/preloginnotice/image/name does not validate the type of uploaded files and serves them with a Content-Type derived from the supplied filename. A user holding the EDITSYSTEMSETTINGS permission can upload an HTML file...

CVE-2026-16889 Stored XSS via Pre-Login Notice Image Upload Serves Attacker HTML from Application Origin

In openEQUELLA before 2026.1, the pre-login notice image upload endpoint PUT /api/preloginnotice/image/name does not validate the type of uploaded files and serves them with a Content-Type derived from the supplied filename. A user holding the EDITSYSTEMSETTINGS permission can upload an HTML file...

CVE-2026-16889 Stored XSS via Pre-Login Notice Image Upload Serves Attacker HTML from Application Origin

In openEQUELLA before 2026.1, the pre-login notice image upload endpoint PUT /api/preloginnotice/image/name does not validate the type of uploaded files and serves them with a Content-Type derived from the supplied filename. A user holding the EDITSYSTEMSETTINGS permission can upload an HTML file...

CVE-2026-16889

In openEQUELLA versions before 2026.1 , the pre-login notice image upload endpoint (PUT /api/preloginnotice/image/{name} ) fails to validate uploaded file types. This allows a user with the EDIT_SYSTEM_SETTINGS permission to upload an HTML file that the application serves with a text/html Content...

EUVD-2026-112563

In openEQUELLA before 2026.1, the pre-login notice image upload endpoint PUT /api/preloginnotice/image/name does not validate the type of uploaded files and serves them with a Content-Type derived from the supplied filename. A user holding the EDITSYSTEMSETTINGS permission can upload an HTML file...

CVE-2026-16889

In openEQUELLA before 2026.1, the pre-login notice image upload endpoint PUT /api/preloginnotice/image/name does not validate the type of uploaded files and serves them with a Content-Type derived from the supplied filename. A user holding the EDITSYSTEMSETTINGS permission can upload an HTML file...

[SECURITY] Fedora 44 Update: python-pillow-12.3.0-4.fc44

Python image processing library, fork of the Python Imaging Library PIL This library provides extensive file format support, an efficient internal representation, and powerful image processing capabilities. There are four subpackages: tk tk interface, qt PIL image wrapper for Qt, devel developmen...

CVE-2026-113957

An attacker who controls the registry, a mirror, or the network path to it may be able to serve arbitrary image content in response to a pull by digest, so that a user runs an image other than the one they pinned. The fix compares the returned digest to the pinned digest and fails the pull on a...

EUVD-2026-112510

A vulnerability was found in a2ui up to 0.10.4. This vulnerability affects unknown code of the file src/v09/basiccatalog/components/Image.js of the component Image Player/Video Player/Audio Player. Performing a manipulation of the argument url results in improper input validation. The attack may ...

CVE-2026-113957

An attacker who controls the registry, a mirror, or the network path to it may be able to serve arbitrary image content in response to a pull by digest, so that a user runs an image other than the one they pinned. The fix compares the returned digest to the pinned digest and fails the pull on a...

CVE-2026-113957

An attacker who controls the registry, a mirror, or the network path to it may be able to serve arbitrary image content in response to a pull by digest, so that a user runs an image other than the one they pinned. The fix compares the returned digest to the pinned digest and fails the pull on a...

EUVD-2026-112561

An attacker who controls the registry, a mirror, or the network path to it may be able to serve arbitrary image content in response to a pull by digest, so that a user runs an image other than the one they pinned. The fix compares the returned digest to the pinned digest and fails the pull on a...

CVE-2026-113957

The containerization software (specifically container and containerization versions prior to 1.6.0 and 0.52.1) is vulnerable to a security flaw where an attacker controlling a registry, mirror, or network path can serve arbitrary image content during a pull by digest. This allows a user to run an...

BMC IT Service Management Suite cross-site scripting vulnerability

Versions 25.3.01, 25.4.01, and 26.1.01 of the BMC IT Service Management Suite contain a cross-site scripting vulnerability. This vulnerability stems from a reflected XSS flaw in SmartIT’s inline image attachment functionality, potentially allowing authenticated users to inject script content into...

CVE-2026-113957: Apple: An attacker who controls the registry, a mirror, or the network path to it may be able to serve arbitrary image content…

An attacker who controls the registry, a mirror, or the network path to it may be able to serve arbitrary image content in response to a pull by digest, so that a user runs an image other than the one they pinned. The fix compares the returned digest to the pinned digest and fails the pull on a...

Measuring Duplication, Leakage, and Rendering Dependence in Malware-As-Image Benchmarks

Classifying malware binaries rendered as images is a popular approach to malware family identification, and papers on the standard benchmarks for this task report accuracies of 97-99%. In this paper we audit ten of these benchmarks for near-duplicate images and test-train leakage, and retrain...

Important: python-pillow security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...