CVE-2026-65368

A logic issue in Apple macOS allows a maliciously crafted disk image to bypass Gatekeeper checks. The vulnerability stems from insufficient validation and has been addressed through improved validation measures. This issue impacts versions prior to macOS Golden Gate 27 , macOS Sequoia 15.8.2 , an...

CVE-2026-86988

Processing a maliciously crafted image may result in the disclosure of process memory due to improper validation. This vulnerability affects iOS , iPadOS , macOS (Golden Gate), tvOS , visionOS , and watchOS prior to version 27.2 . The issue has been addressed with improved checks in version 27.2 ...

CVE-2026-116463

A vulnerability was identified in FastStone Image Viewer up to 8.5. Affected is the function FUN0062d96c of the component Box-Average Downsampler Engine. The manipulation leads to out-of-bounds read. It is possible to initiate the attack remotely. The vendor was contacted early about this...

CVE-2026-116463

A vulnerability exists in FastStone Image Viewer up to version 8.5 . The flaw is located in the FUN_0062d96c function within the Box-Average Downsampler Engine component. This vulnerability allows for an out-of-bounds read via remote manipulation. While the impact is noted as MEDIUM severity (CVS...

EUVD-2026-110055

A vulnerability was identified in FastStone Image Viewer up to 8.5. Affected is the function FUN0062d96c of the component Box-Average Downsampler Engine. The manipulation leads to out-of-bounds read. It is possible to initiate the attack remotely. The vendor was contacted early about this...

CVE-2026-116463 FastStone Image Viewer Box-Average Downsampler FUN_0062d96c out-of-bounds

A vulnerability was identified in FastStone Image Viewer up to 8.5. Affected is the function FUN0062d96c of the component Box-Average Downsampler Engine. The manipulation leads to out-of-bounds read. It is possible to initiate the attack remotely. The vendor was contacted early about this...

CVE-2026-116463 FastStone Image Viewer Box-Average Downsampler FUN_0062d96c out-of-bounds

A vulnerability was identified in FastStone Image Viewer up to 8.5. Affected is the function FUN0062d96c of the component Box-Average Downsampler Engine. The manipulation leads to out-of-bounds read. It is possible to initiate the attack remotely. The vendor was contacted early about this...

CVE-2026-115914 vLLM DeepSeek-OCR image processing vulnerable to denial of service

vLLM is an inference and serving engine for large language models. From 0.11.1 until 0.32.0, the DeepSeek-OCR, DeepSeek-OCR-2, and Unlimited-OCR image path allows a remote client that can reach the OpenAI-compatible API to submit a legal image whose normalized pixels sum to zero when that image i...

CVE-2026-115914 vLLM DeepSeek-OCR image processing vulnerable to denial of service

vLLM is an inference and serving engine for large language models. From 0.11.1 until 0.32.0, the DeepSeek-OCR, DeepSeek-OCR-2, and Unlimited-OCR image path allows a remote client that can reach the OpenAI-compatible API to submit a legal image whose normalized pixels sum to zero when that image i...

CVE-2026-115914

The vLLM inference engine (versions 0.11.1 through 0.32.0) is vulnerable to a denial of service via the DeepSeek-OCR, DeepSeek-OCR-2, and Unlimited-OCR image paths. A remote client capable of reaching the OpenAI-compatible API can submit a legal image with normalized pixels summing to zero. When ...

CVE-2026-115914 vLLM DeepSeek-OCR image processing vulnerable to denial of service

vLLM is an inference and serving engine for large language models. From 0.11.1 until 0.32.0, the DeepSeek-OCR, DeepSeek-OCR-2, and Unlimited-OCR image path allows a remote client that can reach the OpenAI-compatible API to submit a legal image whose normalized pixels sum to zero when that image i...

image-downloader CVE-2026-103648 wrapper detect

Detects Node.js apps exposing a user-controlled image URL fetch endpoint pattern associated with CVE-2026-103648 image-downloader 4.3.1 path traversal. !/usr/bin/env python3 -- coding: utf-8 -- """Detect HTTP wrappers around vulnerable image-downloader 4.3.1.""" import json from kittysploit impor...

image-downloader CVE-2026-103648 path traversal

CVE-2026-103648 npm image-downloader 4.3.1: when a Node app passes a user-controlled URL to download.image, percent-encoded ../ in the URL path survives basename and writes outside the intended dest directory. Starts a short-lived payload HTTP server on lhost:lport and triggers GET...

CVE-2026-116256

A vulnerability was found in geesondog RhaPHP up to 7ae639ccf8dcb627faace096d030bd4cb4cfb905. Affected by this vulnerability is the function image of the file application/mp/controller/Show.php of the component Mp Module Media Proxy. The manipulation of the argument url results in server-side...

CVE-2026-115956

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bPlugins Panorama Viewer – 360 Degree Image + Video Viewer panorama allows Stored XSS.This issue affects Panorama Viewer – 360 Degree Image + Video Viewer: from n/a through 1.8.3...

EUVD-2026-109732

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bPlugins Panorama Viewer – 360 Degree Image + Video Viewer panorama allows Stored XSS.This issue affects Panorama Viewer – 360 Degree Image + Video Viewer: from n/a through 1.8.3...

CVE-2026-115956 WordPress Panorama Viewer – 360 Degree Image + Video Viewer plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bPlugins Panorama Viewer – 360 Degree Image + Video Viewer panorama allows Stored XSS.This issue affects Panorama Viewer – 360 Degree Image + Video Viewer: from n/a through 1.8.3...

CVE-2026-115956 WordPress Panorama Viewer – 360 Degree Image + Video Viewer plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bPlugins Panorama Viewer – 360 Degree Image + Video Viewer panorama allows Stored XSS.This issue affects Panorama Viewer – 360 Degree Image + Video Viewer: from n/a through 1.8.3...

CVE-2026-115956

The WordPress Panorama Viewer – 360 Degree Image + Video Viewer plugin (versions n/a through 1.8.3 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the Improper Neutralization of Input During Web Page Generation , which allows an attacker to execute malicious scripts...

WordPress Panorama Viewer – 360 Degree Image + Video Viewer plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by V1T in WordPress Plugin Panorama Viewer – 360 Degree Image + Video Viewer versions = 1.8.3...