CVE-2026-25860

CVE-2026-25860 OpenClinic GA 5.247.01 Reflected XSS via DICOM Image Upload Handler If you want to chain this XSS with RCE you can read: https://www.partywave.site/show/research/cve-2026-25860-openclinic-ga-xss-to-rce Description OpenClinic GA = v5.351.19 12/05/2026 contains a reflected cross-site...

bad-dicom

Bad-DICOM PoC of my handcrafted CVE-2019-11687's exploit tool. I've crafted this PEDICOM as a Proof of Concept for my college's capstone: "Detection and prevention of attacks based on vulnerabilities of DICOM files against medical management services ". What is a PEDICOM DoomDicom.dcm is a PEDICO...

CVE-2026-23009-DICOM-Network-Image-Injection-Without-Authentication

CVE-2026-23009 – DICOM Network Image Injection Without Authentication Program Code Python pydicom dicomserversim.py - DICOM C-STORE SCP with no AE title check from pynetdicom import AE, evt, AllStoragePresentationContexts def handlestoreevent: ds = event.dataset No authentication, accepts any ima...

CVE-2024-42845-Exploit

CVE-2024-42845: Remote Code Execution RCE in Invesalius 3.1 Exploit Details Exploit Title : Invesalius 3.1 - Remote Code Execution RCE Discovered By : Alessio Romano sfoffo, Riccardo Degli Esposti partywave Exploit Author : Alessio Romano sfoffo, Riccardo Degli Esposti partywave Date : 2024-08-23...

OHIF Viewers: DOM-Based Cross Site Scripting (XSS) through MIME type of document

Summary An XSS Cross-Site Scripting vulnerability occurs when an attacker is able to inject their own JavaScript code into a web page's source, which is subsequently processed by the victim's browser. A common cause of this vulnerability is the failure to validate user-supplied data before...

GHSA-XWGP-W3PJ-Q5H3 OHIF Viewers: DOM-Based Cross Site Scripting (XSS) through MIME type of document

Summary An XSS Cross-Site Scripting vulnerability occurs when an attacker is able to inject their own JavaScript code into a web page's source, which is subsequently processed by the victim's browser. A common cause of this vulnerability is the failure to validate user-supplied data before...

EUVD-2026-118385

OHIF Viewers: DOM-Based Cross Site Scripting XSS through MIME type of document...

Amazon Linux 2 : gimp (ALASGIMP-2026-022)

The version of gimp installed on the remote host is prior to 2.8.22-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2GIMP-2026-022 advisory. A flaw was found in GIMP's X cursor XMC thumbnail loader. When GIMP generates a thumbnail for a crafted XMC file, it...

Important: gimp

Issue Overview: A flaw was found in GIMP's X cursor XMC thumbnail loader. When GIMP generates a thumbnail for a crafted XMC file, it allocates a pixel buffer using a width height size computed in 32-bit signed arithmetic. If that product overflows, the allocation is smaller than the true image...

CVE-2026-118670

OHIF Viewers is a zero-footprint DICOM viewer with shared extension packages. From 3.5.0-beta.0 until 3.12.15, 3.13.7, and 3.14.0-beta.19, the dicom-pdf extension reads the attacker-controlled MIMETypeOfEncapsulatedDocument value in extensions/dicom-pdf/src/getSopClassHandlerModule.js and uses it...

CVE-2026-118670 OHIF Viewers: DOM-Based Cross Site Scripting (XSS) through MIME type of document

OHIF Viewers is a zero-footprint DICOM viewer with shared extension packages. From 3.5.0-beta.0 until 3.12.15, 3.13.7, and 3.14.0-beta.19, the dicom-pdf extension reads the attacker-controlled MIMETypeOfEncapsulatedDocument value in extensions/dicom-pdf/src/getSopClassHandlerModule.js and uses it...

@ohif/app (>=3.5.0-beta.1, <=3.12.12), @yestoday/ohif (3.7.0) +1 more potentially affected by CVE-2026-118670 via @ohif/extension-dicom-pdf (>=3.5.0-beta.1, <=3.12.12)

@ohif/extension-dicom-pdf NPM version =3.5.0-beta.1, =3.5.0-beta.1, =0.0.8, =0.0.15 Source cves: CVE-2026-118670 Source advisory: MEND:CVE-2026-118670...

CVE-2026-118670 OHIF Viewers: DOM-Based Cross Site Scripting (XSS) through MIME type of document

OHIF Viewers is a zero-footprint DICOM viewer with shared extension packages. From 3.5.0-beta.0 until 3.12.15, 3.13.7, and 3.14.0-beta.19, the dicom-pdf extension reads the attacker-controlled MIMETypeOfEncapsulatedDocument value in extensions/dicom-pdf/src/getSopClassHandlerModule.js and uses it...

CVE-2026-118670 OHIF Viewers: DOM-Based Cross Site Scripting (XSS) through MIME type of document

OHIF Viewers is a zero-footprint DICOM viewer with shared extension packages. From 3.5.0-beta.0 until 3.12.15, 3.13.7, and 3.14.0-beta.19, the dicom-pdf extension reads the attacker-controlled MIMETypeOfEncapsulatedDocument value in extensions/dicom-pdf/src/getSopClassHandlerModule.js and uses it...

CVE-2026-118670

OHIF Viewers is a zero-footprint DICOM viewer with shared extension packages. From 3.5.0-beta.0 until 3.12.15, 3.13.7, and 3.14.0-beta.19, the dicom-pdf extension reads the attacker-controlled MIMETypeOfEncapsulatedDocument value in extensions/dicom-pdf/src/getSopClassHandlerModule.js and uses it...

@ohif/app (>=3.13.0-beta.0, <=3.13.0-beta.89) potentially affected by CVE-2026-118670 via @ohif/extension-dicom-pdf (>=3.13.0-beta.0, <=3.13.0-beta.89)

@ohif/extension-dicom-pdf NPM version =3.13.0-beta.0, =3.13.0-beta.0, =3.13.0-beta.89 Source cves: CVE-2026-118670 Source advisory: MEND:CVE-2026-118670...

CVE-2026-118670

OHIF Viewers is affected by a DOM-Based Cross Site Scripting (XSS) vulnerability in the dicom-pdf extension (versions 3.5.0-beta.0 through 3.12.15, 3.13.7, and 3.14.0-beta.19). The root cause is that the extension reads the attacker-controlled MIMETypeOfEncapsulatedDocument value in extensions/di...

PT-2026-138350

Name of the Vulnerable Software and Affected Versions OHIF Viewers versions 3.5.0-beta.0 through 3.12.14 OHIF Viewers versions 3.13.0 through 3.13.6 OHIF Viewers versions 3.14.0-beta.0 through 3.14.0-beta.18 Description The dicom-pdf extension reads the MIMETypeOfEncapsulatedDocument value in...

CVE-2026-118670: OHIF Viewers: OHIF Viewers is a zero-footprint DICOM viewer with shared extension packages

OHIF Viewers is a zero-footprint DICOM viewer with shared extension packages. From 3.5.0-beta.0 until 3.12.15, 3.13.7, and 3.14.0-beta.19, the dicom-pdf extension reads the attacker-controlled MIMETypeOfEncapsulatedDocument value in extensions/dicom-pdf/src/getSopClassHandlerModule.js and uses it...

CVE-2026-48705

MONAI Medical Open Network for AI is an AI toolkit for health care imaging. Prior to 1.6.1, PydicomReader.getaffine trusts non-finite values in the DICOM PixelSpacing, ImagePositionPatient, and ImageOrientationPatient fields and composes them into an affine matrix without validation. An...