Astra Linux – Vulnerability in libwebp

A heap-based buffer overflow was discovered in libwebp in versions prior to 1.0.1 in the ShiftBytes function...

CVE-2026-19082 Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-read from zero-count ASCII EXIF entries in copy_string_tags

Imager versions from 0.4502 before 1.034 for Perl may expose adjacent heap bytes via strlen over-read from zero-count ASCII EXIF entries in copystringtags. copystringtags computes an ASCII EXIF tag's length as entry-size - 1 to strip the trailing NUL. A zero-count ASCII entry sets entry-size to 0...

CVE-2026-56671

The CVE-2026-56671 affects ComfyUI prior to 0.28.0. Root cause: get_model_preview in app/model_manager.py constructs a path using os.path.join(folder, filename) with an unrestricted {filename} capture, allowing path traversal via literals like ../, encoded traversal, absolute paths, or an unbound...

EUVD-2026-51401

ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.28.0, getmodelpreview in app/modelmanager.py joins an unrestricted filename route capture to a selected model directory without a containment check, allowing an unauthenticated remote attacker to us...

PT-2026-66678

Name of the Vulnerable Software and Affected Versions ComfyUI versions prior to 0.28.0 Description An unauthenticated remote attacker can read image-decodable files and enumerate host paths. The get model preview function in app/model manager.py uses os.path.joinfolder, filename with an...

CVE-2026-58186

The Apache Traffic Server webptransform plugin can decode unsafely and serve mislabeled, cacheable responses. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4,...

UBUNTU-CVE-2026-58186

The Apache Traffic Server webptransform plugin can decode unsafely and serve mislabeled, cacheable responses. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4,...

CVE-2026-58186

The Apache Traffic Server webptransform plugin can decode unsafely and serve mislabeled, cacheable responses. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4,...

CVE-2026-58186

The Apache Traffic Server webptransform plugin can decode unsafely and serve mislabeled, cacheable responses. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4,...

CVE-2026-58186

The Apache Traffic Server webptransform plugin can decode unsafely and serve mislabeled, cacheable responses. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4,...

CVE-2026-58186 Apache Traffic Server: webp_transform plugin decodes unsafely and mislabels degraded responses

The Apache Traffic Server webptransform plugin can decode unsafely and serve mislabeled, cacheable responses. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4,...

CVE-2026-58186

CVE-2026-58186 affects Apache Traffic Server: the webp_transform plugin can decode unsafely and serve mislabeled, cacheable responses. Impacted versions: 8.0.0–8.1.9, 9.0.0–9.2.14, and 10.0.0–10.1.3. Upgrading to 8.2.x/9.2.15 or 10.1.4+ fixes the issue (per the advisory). The CVSS metrics indicat...

CVE-2026-58186 Apache Traffic Server: webp_transform plugin decodes unsafely and mislabels degraded responses

The Apache Traffic Server webptransform plugin can decode unsafely and serve mislabeled, cacheable responses. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4,...

CVE-2026-58186 Apache Traffic Server: webp_transform plugin decodes unsafely and mislabels degraded responses

The Apache Traffic Server webptransform plugin can decode unsafely and serve mislabeled, cacheable responses. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4,...

PT-2026-65763

The Apache Traffic Server webp transform plugin can decode unsafely and serve mislabeled, cacheable responses. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4,...

Linux Distros Unpatched Vulnerability : CVE-2026-58186

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Apache Traffic Server webptransform plugin can decode unsafely and serve mislabeled, cacheable responses. This issue affects Apache Traffic Server: from 8.0...

webp-https-errors (4.7.2) potentially affected by unknown CVE via prettier-lint-lenz (2.6.4)

prettier-lint-lenz NPM version 2.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on prettier-lint-lenz and may be impacted: - webp-https-errors 4.7.2 Source cves: unknown CVE Source advisory: SNYK:JS-PRETTIERLINTLENZ-18505266...

SUSE CVE-2026-58586

Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp. Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 released 2013-03-20. That version has multiple known vulnerabilities, including CVE-2023-4863. Any caller that decod...

CVE-2026-58586

Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp. Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 released 2013-03-20. That version has multiple known vulnerabilities, including CVE-2023-4863. Any caller that decod...

CVE-2026-58586

Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp. Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 released 2013-03-20. That version has multiple known vulnerabilities, including CVE-2023-4863. Any caller that decod...