CVE-2026-119706 LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization

InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /updateweights endpoint. Attackers can submit a base64-encoded crafted pickle in serializednamedtensors, which...

CVE-2026-104067 Scribus before 1.6.7 Out-of-Bounds Memory Access via SVM Import Plugin

Scribus before 1.6.7 contains an out-of-bounds memory access vulnerability in the importsvm plugin that fails to verify bitmap and transparency mask dimensions match. Attackers can supply a crafted SVM file with mismatched mask dimensions to trigger heap reads and writes, causing crashes or code...

CVE-2026-104067

Scribus versions before 1.6.7 are vulnerable to an out-of-bounds memory access vulnerability within the importsvm plugin . The root cause is a failure to verify that bitmap and transparency mask dimensions match during processing. An attacker can exploit this by providing a crafted SVM file with ...

CVE-2026-104067 Scribus before 1.6.7 Out-of-Bounds Memory Access via SVM Import Plugin

Scribus before 1.6.7 contains an out-of-bounds memory access vulnerability in the importsvm plugin that fails to verify bitmap and transparency mask dimensions match. Attackers can supply a crafted SVM file with mismatched mask dimensions to trigger heap reads and writes, causing crashes or code...

EUVD-2026-114103

Scribus before 1.6.7 contains an out-of-bounds memory access vulnerability in the importsvm plugin that fails to verify bitmap and transparency mask dimensions match. Attackers can supply a crafted SVM file with mismatched mask dimensions to trigger heap reads and writes, causing crashes or code...

CVE-2026-104067 Scribus before 1.6.7 Out-of-Bounds Memory Access via SVM Import Plugin

Scribus before 1.6.7 contains an out-of-bounds memory access vulnerability in the importsvm plugin that fails to verify bitmap and transparency mask dimensions match. Attackers can supply a crafted SVM file with mismatched mask dimensions to trigger heap reads and writes, causing crashes or code...

CVE-2026-104066 Scribus before 1.6.7 Heap Buffer Overflow via PICT 4-bit Pixel Unpacking

Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out of bounds, causing...

EUVD-2026-114101

Scribus before 1.6.7 contains an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin that uses an unvalidated y offset to select image scanlines. Attackers can craft a DRW file that, when imported by a user, writes decoded bitmap data outside the heap image buffer, causing...

CVE-2026-104066 Scribus before 1.6.7 Heap Buffer Overflow via PICT 4-bit Pixel Unpacking

Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out of bounds, causing...

CVE-2025-25257-Exploit-Tool

CVE-2025-25257 Exploit Tool Credits Based on watchTowr Labs, 0xbigshaq, and pwner.gg analyses. Warnings For educational purposes only. Use on authorized systems. Modifies database/filesystem. Enhanced Python tool for detecting and exploiting CVE-2025-25257 Pre-Auth SQLi to RCE in Fortinet FortiWe...

CVE-2026-104065

Scribus versions prior to 1.6.7 are vulnerable to a Heap Out-of-Bounds Write in the importdrw Micrografx Draw plugin. The root cause is an unvalidated y offset used during the selection of image scanlines. An attacker can craft a malicious DRW file that, when imported by a user, writes decoded bi...

EUVD-2026-114102

Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out of bounds, causing...

CVE-2026-104065 Scribus before 1.6.7 Heap Out-of-Bounds Write via Micrografx Draw Import

Scribus before 1.6.7 contains an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin that uses an unvalidated y offset to select image scanlines. Attackers can craft a DRW file that, when imported by a user, writes decoded bitmap data outside the heap image buffer, causing...

CVE-2026-104066

Scribus versions prior to 1.6.7 are vulnerable to a heap buffer overflow in the Mac PICT image loader and import plugin. The root cause is improper handling of 4-bit indexed pixel data ; specifically, an attacker can provide a crafted PICT file with inconsistent width and row data. When this file...

CVE-2026-104066 Scribus before 1.6.7 Heap Buffer Overflow via PICT 4-bit Pixel Unpacking

Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out of bounds, causing...

CVE-2026-104065 Scribus before 1.6.7 Heap Out-of-Bounds Write via Micrografx Draw Import

Scribus before 1.6.7 contains an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin that uses an unvalidated y offset to select image scanlines. Attackers can craft a DRW file that, when imported by a user, writes decoded bitmap data outside the heap image buffer, causing...

EUVD-2026-114100

Scribus before 1.6.7 contains an integer overflow vulnerability in the scimgdataloadertiff TIFF loader that allows attackers to trigger a heap overflow via crafted tile dimensions. Attackers can supply a tiled TIFF with large tile width, height and sample values for a user to import, corrupting...

CVE-2026-104064 Scribus before 1.6.7 Heap Overflow via TIFF Tile Buffer Handling

Scribus before 1.6.7 contains an integer overflow vulnerability in the scimgdataloadertiff TIFF loader that allows attackers to trigger a heap overflow via crafted tile dimensions. Attackers can supply a tiled TIFF with large tile width, height and sample values for a user to import, corrupting...

CVE-2026-104064

Scribus versions prior to 1.6.7 are vulnerable to a heap overflow caused by an integer overflow in the scimgdataloader_tiff TIFF loader. An attacker can trigger this by providing a crafted tiled TIFF file with excessively large tile width, height, and sample values for a user to import. This memo...

CVE-2026-104062 Scribus before 1.6.7 Heap Buffer Overflow via PICT Pixmap Loader

Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the PICT image loader and import plugin that allows attackers to corrupt heap memory by supplying an unchecked bytesPerLine value. Attackers can craft a PICT file whose bytesPerLine exceeds the QImage scanline size, so placing ...