CLEANSTART-2026-CD57070 Parsing a WEBP image with an invalid, large size panics on 32-bit platforms

CVE-2026-33813 affects multiple packages. Parsing a WEBP image with an invalid, large size panics on 32-bit platforms. See references for individual vulnerability details...

Astra Linux – Vulnerability in libwebp

A heap-based buffer overflow was discovered in libwebp in versions prior to 1.0.1 in the ShiftBytes function...

Astra Linux – Vulnerability in exempi

A buffer overflow vulnerability exists in WEBPSupport.cpp in exempi 2.5.0 and earlier, allowing remote attackers to cause a denial of service by opening crafted webp files...

Astra Linux – Vulnerability in imagemagick

A flaw was discovered in ImageMagick’s coders, specifically in the webp.c file. An attacker who submits a crafted file processed by ImageMagick could trigger undefined behavior, including division by zero in mathematics. The most significant threat of this vulnerability is the impact on system...

CLEANSTART-2024-UG11230 WEBP::GetLE32 function in XMPFiles/source/FormatSupport/WEBP_Support

Security vulnerability affects the exempi package. The WEBP::GetLE32 function in XMPFiles/source/FormatSupport/WEBPSupport...

Rocky Linux 8 [CIQ] Security Update: libwebp / libwebp-debuginfo / libwebp-debugsource / libwebp-devel (crlsa-2023_5309)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20235309 advisory. libwebp: Heap buffer overflow in WebP Codec CVE-2023-4863 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that...

Rocky Linux 8 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource (crlsa-2023_5201)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20235201 advisory. libwebp: Heap buffer overflow in WebP Codec CVE-2023-4863 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that...

Rocky Linux 9 [CIQ] Security Update: libwebp / libwebp-debuginfo / libwebp-debugsource / libwebp-devel / etc (crlsa-2023_5214)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20235214 advisory. libwebp: Heap buffer overflow in WebP Codec CVE-2023-4863 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that...

Rocky Linux 8 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource (crlsa-2023_5184)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20235184 advisory. libwebp: Heap buffer overflow in WebP Codec CVE-2023-4863 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that...

Rocky Linux 8 [CIQ] Security Update: exempi / exempi-debuginfo / exempi-debugsource / exempi-devel Multiple Vulnerabilities (crlsa-2024_3066)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20243066 advisory. exempi: denial of service via opening of crafted audio file with ID3V2 frame CVE-2020-18651 exempi: denial of service via opening of crafted webp file...

CVE-2026-91072

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own uploads directory, letting an attacker with Administrator-level access rename or delete existing WebP-derivative image files outside that scope, including, on...

EUVD-2026-89619

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own uploads directory, letting an attacker with Administrator-level access rename or delete existing WebP-derivative image files outside that scope, including, on...

CVE-2026-91072 EWWW Image Optimizer < 8.8.0 - Admin+ WebP File Rename and Deletion via Unrestricted Path in WebP Migration Handler

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own uploads directory, letting an attacker with Administrator-level access rename or delete existing WebP-derivative image files outside that scope, including, on...

CVE-2026-91072

The EWWW Image Optimizer WordPress plugin (versions before 8.8.0 ) contains a vulnerability where a WebP-derivative file migration routine is not properly confined to the site's specific uploads directory. This flaw allows an attacker with Administrator-level access to rename or delete WebP-deriv...

CVE-2026-91072 EWWW Image Optimizer < 8.8.0 - Admin+ WebP File Rename and Deletion via Unrestricted Path in WebP Migration Handler

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own uploads directory, letting an attacker with Administrator-level access rename or delete existing WebP-derivative image files outside that scope, including, on...

WordPress EWWW Image Optimizer plugin < 8.8.0 - Admin+ WebP File Rename and Deletion vulnerability

Admin+ WebP File Rename and Deletion vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin EWWW Image Optimizer versions 8.8.0...

CVE-2026-91072: External Control of File Name or Path

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own uploads directory, letting an attacker with Administrator-level access rename or delete existing WebP-derivative image files outside that scope, including, on...

PT-2026-103040

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own uploads directory, letting an attacker with Administrator-level access rename or delete existing WebP-derivative image files outside that scope, including, on...

Malicious Package

Overview webp-https-errors is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-91802

A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s WebP image decoding due to improper handling of bitmap stride and target buffer formats. Successful exploitation could result in an application crash...