Linux Distros Unpatched Vulnerability : CVE-2026-53500

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWEDSOURCES configuration passes plain strings to re.match without escapi...

PYSEC-2026-3617 Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

Summary The ALLOWEDSOURCES configuration is meant to restrict which hosts Thumbor's HTTP loader may fetch images from. Plain-string entries in that list the overwhelming majority of real-world and documented configurations are passed directly to re.match without escaping. Because . is a regex...

Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

SummaryThe ALLOWEDSOURCES configuration is meant to restrict which hosts Thumbor's HTTP loader may fetch images from. Plain-string entries in that list the overwhelming majority of real-world and documented configurations are passed directly to re.match without escaping. Because . is a regex...

CVE-2026-53500

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWEDSOURCES configuration passes plain strings to re.match without escaping dots, so a hostname differing at dot positions can match the allowlist. This issue is fixed in 7.8.0...

Regular Expression Denial of Service (ReDoS)

Overview thumbor is a thumbor is an open-source photo thumbnail service by globo.com Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in the validate process. An attacker can access unauthorized external resources by supplying crafted hostnames that...

GHSA-6X26-6R6F-M537 Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

Summary The ALLOWEDSOURCES configuration is meant to restrict which hosts Thumbor's HTTP loader may fetch images from. Plain-string entries in that list the overwhelming majority of real-world and documented configurations are passed directly to re.match without escaping. Because . is a regex...

Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

Summary The ALLOWEDSOURCES configuration is meant to restrict which hosts Thumbor's HTTP loader may fetch images from. Plain-string entries in that list the overwhelming majority of real-world and documented configurations are passed directly to re.match without escaping. Because . is a regex...

CVE-2026-53500 Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWEDSOURCES configuration passes plain strings to re.match without escaping dots, so a hostname differing at dot positions can match the allowlist. This issue is fixed in 7.8.0...

CVE-2026-53500 Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWEDSOURCES configuration passes plain strings to re.match without escaping dots, so a hostname differing at dot positions can match the allowlist. This issue is fixed in 7.8.0...

EUVD-2026-51597

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWEDSOURCES configuration passes plain strings to re.match without escaping dots, so a hostname differing at dot positions can match the allowlist. This issue is fixed in 7.8.0...

CVE-2026-53500

Thumbor (open-source image service by globo.com) is affected prior to version 7.8.0 where ALLOWED_SOURCES is applied by re.match() to unescaped strings, enabling a hostname with dot-position differences to bypass the allowlist. Root cause: unescaped patterns treated as normal strings in a regex m...

PYSEC-2026-553 TorchServe Server-Side Request Forgery vulnerability

Impact Remote Server-Side Request Forgery SSRF Issue: TorchServe default configuration lacks proper input validation, enabling third parties to invoke remote HTTP download requests and write files to the disk. This issue could be taken advantage of to compromise the integrity of the system and...