67 matches found
CVE-2026-65687
Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its SVG processing feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. Attackers can exploit this path...
CVE-2026-65687
Bold Reports Standalone Report Designer (vulnerable before 14.1.12) contains a path traversal vulnerability in its SVG processing feature that allows unauthenticated attackers to read arbitrary files from the server filesystem, potentially exposing credentials and enabling full unauthorized acces...
CVE-2026-65687 Bold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via SVG Processing
Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its SVG processing feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. Attackers can exploit this path...
CVE-2026-65687 Bold Reports Standalone Report Designer < 14.1.12 Arbitrary File Read via SVG Processing
Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its SVG processing feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. Attackers can exploit this path...
SUSE-SU-2026:2877-1 Security update for ImageMagick
This update for ImageMagick fixes the following issues: - CVE-2026-53466: integer overflow in the XCF decoder can result in an out-of-bounds read when a crafted image is read bsc1270073. - CVE-2026-53467: allocated memory left unchanged in the MNG decoder can lead to a heap information disclosure...
USN-8337-1 qtsvg-opensource-src vulnerabilities
It was discovered that QtSvg incorrectly handled certain SVG images. An attacker could possibly use this issue to cause QtSvg to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS. CVE-2018-19869 It was discovered that QtSvg incorrectly handled certain SVG images. ...
PT-2026-37624
Name of the Vulnerable Software and Affected Versions Qt SVG versions 6.7.0 through 6.8.7 Qt SVG versions 6.9.0 through 6.11.0 Description A type confusion issue in Qt SVG allows an attacker to cause an application crash through a crafted SVG image. When processing SVG marker references, the...
Allocation of Resources Without Limits or Throttling
Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the use function in the SVG recursive processing workflow. An attacker can cause excessive CPU consumption by submitting a specially crafted SVG file with deeply nested...
GHSA-F38F-5XPM-9R7C CairoSVG vulnerable to Exponential DoS via recursive <use> element amplification
Summary Kozea/CairoSVG 300K downloads/week has exponential denial of service via recursive element amplification in cairosvg/defs.py line 335. This causes CPU exhaustion from a small input. Severity High — CVSS 3.1: 7.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Vulnerable Code File:...
Improper Encoding or Escaping of Output
Overview Magick.NET-Q8-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...
CVE-2025-67419
A Denial of Service DoS vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust the application server's resources via the "GET /images" API. The application fails to limit the height of the use-element shadow tree or the dimensions of pattern tiles during the...
evershop allows unauthenticated attackers to exhaust application server's resources via "GET /images" API
A Denial of Service DoS vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust the application server's resources via the "GET /images" API. The application fails to limit the height of the use-element shadow tree or the dimensions of pattern tiles during the...
Excessive Platform Resource Consumption within a Loop
Overview @evershop/evershop is a The React Ecommerce platform. Built with React and Postgres. Open-source and free. Fast and customizable. Affected versions of this package are vulnerable to Excessive Platform Resource Consumption within a Loop via the GET /images API endpoint when processing SVG...
CVE-2025-67419
A Denial of Service DoS vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust the application server's resources via the "GET /images" API. The application fails to limit the height of the use-element shadow tree or the dimensions of pattern tiles during the...
CVE-2025-67419
A Denial of Service DoS vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust the application server's resources via the "GET /images" API. The application fails to limit the height of the use-element shadow tree or the dimensions of pattern tiles during the...
CVE-2025-67419
A Denial of Service DoS vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust the application server's resources via the "GET /images" API. The application fails to limit the height of the use-element shadow tree or the dimensions of pattern tiles during the...
CVE-2025-67419
CVE-2025-67419 describes a DoS in evershop prior to 2.1.0 where unauthenticated attackers can exhaust server resources via the GET /images endpoint while processing SVG files. Root cause: the application does not bound the height of the use-element shadow tree or the dimensions of pattern tiles d...
EUVD-2026-0799
A Denial of Service DoS vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust the application server's resources via the "GET /images" API. The application fails to limit the height of the use-element shadow tree or the dimensions of pattern tiles during the...
Integer Overflow or Wraparound
Overview Magick.NET-Q16-OpenMP-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package a...