Missing Release of Memory after Effective Lifetime

Overview Magick.NET-Q16-HDRI-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Memory Allocation with Excessive Size Value

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via image decompression bomb handling in loadbytes in vllm/multimodal/media/image.py and the video frame...

CVE-2026-116152

A flaw was found in ImageMagick. An attacker could exploit this issue by providing a specially crafted MAT image file that triggers an error-handling path where allocated memory is not properly released. Over time, repeated processing of these files can cause memory exhaustion, potentially leadin...

CVE-2026-116182 phpMyFAQ before 4.1.10 SSRF via PDF Export Image Fetching

phpMyFAQ before 4.1.10 contains a server-side request forgery vulnerability in the PDF export feature that fetches external images referenced in FAQ answers. Attackers who can influence FAQ content can embed image URLs pointing to loopback or internal services, causing the server to request them...

CVE-2026-116182 phpMyFAQ before 4.1.10 SSRF via PDF Export Image Fetching

phpMyFAQ before 4.1.10 contains a server-side request forgery vulnerability in the PDF export feature that fetches external images referenced in FAQ answers. Attackers who can influence FAQ content can embed image URLs pointing to loopback or internal services, causing the server to request them...

CVE-2026-116182 phpMyFAQ before 4.1.10 SSRF via PDF Export Image Fetching

phpMyFAQ before 4.1.10 contains a server-side request forgery vulnerability in the PDF export feature that fetches external images referenced in FAQ answers. Attackers who can influence FAQ content can embed image URLs pointing to loopback or internal services, causing the server to request them...

CVE-2026-116182

The software phpMyFAQ versions before 4.1.10 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability within its PDF export feature. The flaw occurs because the system fetches external images referenced in FAQ answers. An attacker capable of influencing FAQ content can embed URLs point...

VLLM : DoS Via Unvalidated Mm_processor_kwargs In Multimodal Image Processors (Isaac, InternVL, H2OVL, Etc.)

Summary API clients can supply arbitrary "mmprocessorkwargs" per request. vLLM forwards these values through the multimodal rendering and processing pipeline to Hugging Face and custom image/video processor constructors and calls. Resource-sensitive values such as image size, patch size, patch...

PT-2026-123023

phpMyFAQ before 4.1.10 contains a server-side request forgery vulnerability in the PDF export feature that fetches external images referenced in FAQ answers. Attackers who can influence FAQ content can embed image URLs pointing to loopback or internal services, causing the server to request them...

Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image

Summary Multiple vulnerabilities were addressed in IBM Observability with Instana within Instana Agent container image build 1.0.328 Vulnerability Details CVEID:CVE-2026-6368 DESCRIPTION: Calling wordexp with WRDEAPPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to...

CVE-2026-113491

The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing, allowing users with Subscriber-level access and above to read files from outside the web root and to delete files on the server, limit...

CVE-2026-113489

The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, a...

EUVD-2026-109223

The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, a...

CVE-2026-113489 GeoDirectory < 2.8.194 - Subscriber+ Arbitrary Listing Image Modification via IDOR

The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, a...

WordPress GeoDirectory plugin < 2.8.194 - Subscriber+ Arbitrary Listing Image Modification vulnerability

Subscriber+ Arbitrary Listing Image Modification vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin GeoDirectory versions 2.8.194...

CVE-2026-113489

The GeoDirectory WordPress plugin versions prior to 2.8.194 is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The software fails to verify that a referenced attachment belongs to the listing being saved. This allows users with Subscriber-level access or higher to modify the title,...

[SECURITY] [DSA 6583-1] libheif security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6583-1 [email protected] https://www.debian.org/security/ Aron Xu October 24, 2026 https://www.debian.org/security/faq -...

CLEANSTART-2026-XI97037 flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count

Security vulnerability affects the wildfly package. A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count...

Exploit for CVE-2026-102785

█████╗ ███╗ ██╗ ████████╗ ██╗ ██████╗ ██████╗ ██████...

Fedora 44 : gegl04 (2026-34e59263ad)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-34e59263ad advisory. This update fixes an overflow in parsing RGBE/HDR image files. Tenable has extracted the preceding description block directly from the Fedora security...